Icaro0310/devin-brain

> Track: Build · Nature: product
> For: AI engineers, Developers, Data Scientists
> Interface: CLI / Python library / MCP server / Service
> Path: AI engineers · step 3/3 — after devin-orchestrator
Where this fits
- **Job:** Build
- **Product:** devin-brain
- **Packages:** devin-memory
- **Mode:** mixed
- **Foundation:** devin-internals-spec
- **Ecosystem:** awesome-devin · registry: devin-powerups
devin-memory
> **Renamed (Oct 2026):** this repository moved from Icaro0310/devin-memory
> to Icaro0310/devin-brain — the PyPI package, CLI commands and MCP server
> name stay devin-memory; stars, issues and history are preserved by the
> GitHub redirect.
> **Unofficial community project.** Not affiliated with, endorsed by, or
> sponsored by Cognition AI. "Devin" is a trademark of Cognition AI.
**Linux** · **Personal Windows** · **Corporate Windows**
Part of the awesome-devin ecosystem: the curated hub for the devin-* tools.
An anti-poisoning memory store for Devin: durable facts with provenance,
versioning, and a quarantine gate — so agent memory can't be silently
corrupted by a bad session or injected content.
The problem
Agent memory is a poisoning vector. Any tool that persists "facts" between
sessions can be corrupted by a single bad session — an injected instruction
or a pasted secret becomes a trusted belief in every future session, with no
review step and no way to answer *"where did this come from?"*.
Prior art
- The **Devin memory MCP** (retain/recall/reflect over
.devin/memory/memories.jsonl) — append-only, no screening, no session
provenance. devin-memory exports to that exact line shape.
- **MemGPT / LangChain memory** — persistence layers that optimize for
recall, not for auditing or distrusting what was stored.
devin-memory adapts the memory-store idea; it adds the parts those tools
don't have: a quarantine gate and provenance back to real session rows.
What makes it Devin-native
1. **Side-by-side:** every entry can carry source_session_id +
source_rowid, auditable against Devin's sessions.db via
devin-internals' read-only store — the memory MCP cannot verify that a
claimed source session (or a specific message row) ever existed. The
quarantine gate also screens every write for secret and injection shapes.
2. **No-Devin:** without sessions.db there is no session provenance to
audit — the extra disappears.
3. **One sentence:** *it's a memory store that remembers where each memory
came from — and quarantines suspicious ones until a human releases them.*
Install
Python ≥ 3.10 required; install with uv (recommended) or pipx.
or with pipx (alternative):
For development:
Usage
MCP server
devin-memory is also a real MCP server (stdio) — the same retain/recall
pipeline with the quarantine gate on every write, callable from Devin,
Claude Desktop, Cursor or any MCP client:
The devin-memory-mcp console script also ships inside the base
devin-memory dist, so a bare uv tool install devin-memory (no extra)
leaves a script that exits with error: The MCP server needs the 'mcp'
extra — recovery steps live in the Troubleshooting section of each
platform guide (Linux,
Personal Windows,
Corporate Windows).
Client config:
The same stdio server registers in other MCP hosts:
**Zed** — context_servers in settings.json:
**JetBrains** — Settings → Tools → AI Assistant → Model Context Protocol → Add:
**Antigravity** — ~/.gemini/config/mcp_config.json:
Tools: retain, recall, screen (dry-run the gate, no write), list,
retract, supersede, quarantine, release, approve, conflicts,
prime, verify, extract, compact, quarantine_digest. The release
and approve promotion overrides are only registered when the server runs
with DEVIN_MEMORY_MCP_PROMOTE=1 — otherwise promotion stays human-only via
the CLI (devin-memory quarantine --release / devin-memory approve
). The same flag gates extract's auto_approve parameter, which is