一个自托管的内存、书籍和技能服务器，面向 AI 代理，使用 Rust 编写，并基于模型上下文协议（MCP）公开。

Mycelium2 基于两个假设构建：

1. 数据库在静止状态下不可信。 泄露的数据库不得提供明文、可用会话、API密钥或第二因素秘密。
2. 模型不可信。 LLM提出对内存的更改;代码决定允许什么、落脚地点以及是否有效。

它是对 Mycelium 的彻底重写，保留了开放知识格式（OKF）内存模型，并增加了每用户加密存储、用户认证、共享书架和技能存储。

状态

处于积极开发阶段。加密、存储、认证、MCP和图书馆管理员层均已实现并通过250+测试覆盖。网页界面运行良好且正在改进中;预计它会有所变化。

它的作用

• **代理内存。**代理以标记式概念存储和查询知识，带有YAML前置，交叉链接成图。每个用户拥有一个私有的加密捆绑包。
• **书架。**管理员上传书籍;图书管理员将其编目为章节和章节，供特工按段落搜索和阅读。
• **技能店。

Mycelium2

A self-hosted memory, book, and skills server for AI agents, written in Rust and exposed over the Model Context Protocol (MCP).

Mycelium2 is built on two assumptions:

1. The database is untrusted at rest. A leaked database must not yield plaintext, a usable session, an API key, or a second-factor secret.
2. The model is untrusted. The LLM proposes changes to memory; code decides what is allowed, where it lands, and whether it worked.

It is a ground-up rewrite of Mycelium that keeps the Open Knowledge Format (OKF) memory model and adds per-user encrypted stores, user authentication, shared bookshelves, and a skills store.

Status

In active development. Crypto, storage, authentication, MCP, the librarian, and the full memory lifecycle (status-aware reads, BM25 + hybrid retrieval, revision history, scheduled dream maintenance) are implemented and covered by 860+ tests. The web interface works and is being improved; expect it to change.

What it does

• Agent memory. Agents store and query knowledge as markdown concepts with YAML frontmatter, cross-linked into a graph. Each user has a private, encrypted bundle.
• Memory lifecycle. Concepts carry frontmatter status (active, superseded, retired) with superseded_by and valid_to, so stale knowledge stops contaminating search. Retrieval uses BM25 scoring with optional hybrid vector fusion; a scheduled dream job flags duplicates, drift, and broken links for consolidation; every write records a per-concept revision with one-click restore.
• Bookshelves. An administrator uploads books; a librarian catalogs them into chapters and sections that agents can search and read by passage.
• Skills store. Agents fetch skills (SKILL.md-style markdown) by name: private skills per user and administrator-managed global skills, with installable bundles (zip download / CLI export).
• MCP server. Seven tools over Streamable HTTP at /mcp, authenticated per user.
• Web interface. Bundle browser, concept editor, search, graph view, chat, per-concept revision history, and an admin portal (including retrieval tuning and the dream maintenance page).

Security model

Encryption

Every concept file and every search index entry is encrypted. Nothing a user stores is written in plaintext.

password ──Argon2id──▶ KEK ──unseals──▶ master key ──HKDF-SHA256──▶ per-file DEK ──AES-256-GCM──▶ file

• Per-file keys. Each file is encrypted under its own key, derived from the user’s master key and bound to the file it protects.
• Two-layer envelopes. The outer layer is bound to the stored filename, so a file swapped under a known name fails to decrypt. The inner layer carries the true path, checked on read, so a file copied to another name fails too.
• No path leakage. Files are stored under flat, opaque HMAC filenames, so concept names and paths are not visible on disk.