inspeximus — a zero-dependency Python agent-memory library
Correct a fact once and it stays corrected. Delete it, and get a signed certificate that it is gone.
pip install inspeximus ·
PyPI ·
GitHub · MIT · v1.88.1
A delete that returns success is not a delete. We measured one that reported success and left the data
recoverable in five of six places the application had put it — the app's own vector index, its cache,
its logs. inspeximus issues an erasure certificate: content-free, signed, and checkable after the
fact, so "deleted" is something you verify rather than something you are told.
No third-party dependencies in the core. An MCP server ships alongside it, so any Claude / Cursor / agent
can use it as memory. Ten framework adapters (LangGraph, LlamaIndex, Haystack, CrewAI, AutoGen, LangChain,
Google ADK, OpenAI Agents, pydantic-ai, MemoryAgentBench). 1,797 tests.
What it does that a recall-first memory layer does not
- A corrected fact stays corrected. Deterministic keyed supersession plus
echo_guard: when the old
value is restated later — verbatim or paraphrased — it lands retired instead of resurrecting. No LLM on
the write path.
- Proof of deletion.
forget_subject() erases and erasure_certificate() proves it, without
restating the erased content. Honest scope: this proves erasure within this store, and names the
registered app-side targets it cascaded to. It is not a media-level unrecoverability claim.
- Influence gating.
recall(influence_only=True) lets anything be retrieved but gates what a memory
is allowed to drive on provenance rather than content. Measured: action-hijack 0.00 across three
retrievers, at a stated cost — rare uncorroborated true memories fall to 0.083 (1 of 12, small n).
- Tamper-evident receipts. Hash-chained, optionally Ed25519-signed, so an out-of-band edit to what
your agent "remembers" is detectable.
- Per-tenant isolation via
for_tenant(), and bitemporal as_of() / history().
Honest limits, because they are the point
The corroboration check counts distinct source strings — a string is not an identity, so an attacker
who can write three times under two labels gets through. The residue scan is a literal, case-sensitive
byte match: it finds the exact bytes you pass it and misses a lowercased, re-wrapped, base64 or hex copy.
Both are documented in the code with the measurement next to them.
We also publish our failures. One of our own posts had its headline killed by a control we ran on
ourselves, and we printed the control.
Cite
See CITATION.cff, or the DOI on the GitHub repository.
