Getting started

Run the service and its node in one container, then add it to Claude Code or Codex as a remote MCP server.

The image tessaridb/agent-memory carries the memory service and a TessariDB node together, so a machine with Docker gets a working memory from one command.

Run it

Choose the first owner's passphrase — it is what you type in the browser when an agent asks to be authorized — and start the container:

mkdir -m 700 -p ~/.tessaridb
read -rs "p?Passphrase for the first owner: " && printf '%s\n' "$p" > ~/.tessaridb/owner-passphrase; unset p
chmod 644 ~/.tessaridb/owner-passphrase
docker run -d --name agent-memory --restart unless-stopped --stop-timeout 30 \
  -p 127.0.0.1:39142:39142 \
  -v tessaridb-agent-memory:/var/lib/tessaridb \
  -v ~/.tessaridb/owner-passphrase:/run/secrets/owner-passphrase:ro \
  -e TESSARI_AM_OWNER=ada -e TESSARI_AM_OWNER_IDENTITY=acme \
  -e TESSARI_AM_OWNER_PASSPHRASE_FILE=/run/secrets/owner-passphrase \
  tessaridb/agent-memory

(read -rs "p?…" is zsh; in bash it is read -rsp "…" p.) --stop-timeout 30 lets docker stop close the store cleanly.

What the container does on purpose:

The store is never open. It always declares a database user, so a store nobody secured cannot be read by whoever reaches it.
The first owner is created once, on an empty store; later starts leave it alone, and the passphrase file can be removed after the first start.
Only the memory service is published. The node listens on the container's own loopback.

Connect an agent

Claude Code:

claude mcp add --transport http -s user --client-id claude-code --callback-port 39143 \
  tessaridb-am http://127.0.0.1:39142/mcp

Codex:

codex mcp add tessaridb-am --url http://127.0.0.1:39142/mcp --oauth-client-id codex
codex mcp login tessaridb-am

In Claude Code, /mcp → tessaridb-am → Authenticate opens the browser; sign in as the owner and approve. Neither client needs registering first.

A project is its folder

An agent sends the absolute folder it works in with session_start. The first time a folder is seen the start is refused with what to do: the agent asks you whether the folder is one project or a group of them, and declares it. From then on every agent that starts inside that folder is placed by it, with no question asked.