GreyMatter — A Second Brain for Your AI

The Problem

Every AI session starts at zero.

Your architecture decisions, your coding patterns, your preferences — gone. Every session, you re-explain. Every session, your AI starts as a stranger.

Context windows aren't memory. They're a junk drawer that empties when you close the tab. GreyMatter fixes this.

Architecture

The System — How It All Works

GreyMatter isn't a chatbot. It's the infrastructure that turns AI coding agents into an autonomous development platform.

Core

AI Coding Agents

Claude Code, Codex CLI, or Gemini CLI. GreyMatter doesn't replace them — it gives them a persistent brain, a work queue, and parallel sessions.

Click to expand →

What It Does

Wraps your existing AI agent with persistent memory
Injects project knowledge at session start: bugs, decisions, patterns
Your AI starts informed, not empty
Run up to 8 agents in parallel on one machine

Compatible Agents

Claude Code (Anthropic)
Codex CLI (OpenAI)
Gemini CLI (Google)
Any tool supporting MCP protocol

What It Solves

Every session starts from scratch — no memory of what worked
Re-explain your architecture, every single time
Corrections given yesterday are forgotten today
No way to dispatch parallel work to multiple agents

Core

Go Coordinator

A compiled binary that manages work dispatch, session lifecycle, quality gates, and health monitoring. Runs as a system service.

Click to expand →

Capabilities

Submit tasks, set priorities, walk away — agents execute autonomously
Run up to 8 agents in parallel per node
Tiered eval pipeline: compile, test, lint (Tier 1), structural analysis (Tier 2)
Auto-push to GitHub when code passes all quality gates

Tech Stack

Written in Go — single compiled binary, no runtime dependencies
SQLite for state (WAL mode, concurrent reads)
Bearer token authentication (auto-generated)
TLS 1.3 with post-quantum key exchange
macOS launchd + Linux systemd service support

What It Solves

Manual dispatch — you had to tell each agent what to do
No quality verification — agents could ship broken code
No session recovery — if the coordinator restarted, work was lost
No parallel execution — one agent at a time

Core

MCP Plugin

20+ tools your AI calls naturally during conversation. Save knowledge, search memory, dispatch agents, scan for secrets.

Click to expand →

Memory Tools

gm_knowledge — search, create, manage knowledge
gm_observe — capture observations from sessions
gm_pattern — detect and record recurring patterns
gm_semantic — search by meaning, not keywords

Work Tools

gm_work — create, list, complete work items
gm_status — full system overview
gm_context — get project context for injection
gm_soul — manage agent expertise profiles

Quality & Security

gm_standards — enforce team quality rules
gm_security — PII, secrets, injection scanning
All tools accessible via natural conversation
Compatible with MCP protocol (Claude, Codex, Gemini)

Core

SQLite + Ollama

Your second brain. A local database stores everything. Ollama runs semantic search — finding related knowledge by meaning, not keywords.

Click to expand →

What It Stores

Tens of thousands of observations in active deployments
Hundreds of knowledge entries across all domains
100+ patterns detected from recurring behaviors
Work items, session history, audit trail

How Search Works

FTS5 for fast keyword search
Ollama + nomic-embed-text for semantic search
Ask "how do we handle auth?" — finds JWT, OAuth, SAML entries
Both search modes are local — no cloud required

Why Local Matters

Your code, your data, your knowledge — never leaves your machine
No cloud vector DB fees or API costs
Works fully offline — no internet required
SQLCipher encryption at rest with FIPS key derivation

You (Developer)

↓

AI Coding Agent

Claude Code · Codex CLI · Gemini CLI · Any MCP-compatible agent

↓

MCP Plugin

20 tools: gm_knowledge · gm_work · gm_security · gm_observe · gm_semantic

↙

↘

Go Coordinator

Work Dispatch · Session Lifecycle

Quality Gates · Agent Recovery · Idle Detection

TLS 1.3 · FIPS 140-3 · Bearer Auth · PQC

Second Brain

SQLite Knowledge Graph · Ollama Embeddings

Spaced Repetition · Semantic Search · FTS5

50K+ obs · 500+ know · 100+ patterns

↓

SecureLLM

PII Detection · Prompt Injection Guard · Secret Scanning · Encryption at Rest · FIPS #4631

Everything runs on your machine. Nothing leaves.

Cognitive Memory

A Second Brain, Not a Context Window

GreyMatter models memory the way your brain does. Important knowledge gets reinforced. Stale knowledge decays naturally.

Core

Spaced Repetition (FSRS-6)

Following the same forgetting curves Ebbinghaus documented in 1885. Your AI's memories age like yours do. The important ones get stronger.

Click to expand →

How It Works

Every knowledge entry has a stability score
Score increases when knowledge is used, decreases over time
FSRS-6 algorithm — same as Anki, proven by millions of users
Configurable decay rates per memory type

In Practice

Bug fix from yesterday: high retention
Architecture decision from 3 weeks ago: starting to fade
AI uses a fading entry: retention clock resets
Status line shows "N fading" — entries approaching decay

Why It Matters

Your AI's memory self-curates — no manual cleanup
Important knowledge stays; noise fades naturally
Based on 140 years of cognitive science research
No other AI memory system models actual forgetting

Core

Five Memory Types

Observations, patterns, expertise, corrections, and gotchas. Each type has different decay rates and promotion paths.

Click to expand →

Memory Categories

Observations — raw session data. High volume, fast decay
Patterns — recurring behaviors. "Team writes tests first." Medium decay
Expertise — deep knowledge. "FIPS requires NIST algorithms." Slow decay
Corrections — fixes. "Never use shell=True." Very slow decay
Gotchas — traps hit. "macOS SIGKILL on unsigned binaries." Highest retention

Promotion Paths

Observations → confirmed across sessions → Pattern
Patterns → validated by multiple agents → Expertise
Corrections override stale knowledge automatically
Gotchas get highest retention — mistakes shouldn't repeat

Why It Matters

Not all knowledge is equal — a crash report outranks a style preference
Automatic categorization — no manual tagging
Each type decays at the right rate for its importance
Your AI learns what matters from how knowledge is used

Core

Semantic + Full-Text Search

Two search modes, both local. FTS5 for keywords, Ollama for meaning. Ask "how do we handle auth?" and find JWT, OAuth, and session cookie entries.

Click to expand →

Full-Text Search (FTS5)

Instant keyword matching across all knowledge
SQLite FTS5 — millisecond response times
Type "database" → every entry mentioning databases
No external service required

Semantic Search (Ollama)

Search by meaning, not just keywords
Powered by nomic-embed-text running locally
"How do we handle auth?" finds JWT, OAuth, SAML entries
No data sent to cloud embedding services

Why Both

Keywords are fast and precise when you know the term
Semantic is powerful when you know the concept but not the words
Both run 100% locally — no internet, no API costs
Your knowledge never leaves your machine

Core

Cross-Session Consolidation

After each session, GreyMatter detects contradictions and promotes stable observations into permanent expertise. Like sleep consolidation for your AI.

Click to expand →

Contradiction Detection

New entry says "coordinator on Mac Mini" but old says "coordinator on node-2"
Older entry flagged as stale automatically
No more acting on outdated information
Conflict resolution is automatic, not manual

Observation Promotion

Same observation across 3+ sessions → promoted to Pattern
Validated pattern → promoted to Expertise
Like sleep consolidation: important memories strengthen
Noise gets naturally filtered out over time

The Result

Your AI's knowledge self-curates — no manual cleanup
Important things get stronger with each session
Outdated things fade gracefully
The more you use GreyMatter, the smarter it gets

The Status Line

Your live dashboard, every session

GreyMatter adds a status line to every Claude Code session. At a glance: what your AI knows, what it's working on, and whether it's safe. Tell Claude “explain the status line” and it will walk you through it.

Terminal — ~/my-project

you@dev:~/my-project$ claude

▾ Claude Code v2.1.89

/help for commands • /mcp to see tools • type your request to begin

✓ GreyMatter — 20 tools loaded • 500+ memories injected • 47 quality standards active

▾ What would you like to work on?

↓ THE STATUS LINE — always visible at the bottom of your session

The status line appears in every Claude Code session with GreyMatter installed.

Live Data

Brain Metrics

50K+obs +N/hr . 500+know +N/hr . 100+pat . 47std

Click to expand →

What It Shows

50K+ obs — Tens of thousands of observations captured across all sessions
+N/hr — learning rate: Dozens of new observations per hour during active work
500+ know — knowledge entries (promoted from observations)
100+ pat — patterns detected from recurring behaviors
47 std — quality standards enforced on every agent

How to Read It

Green * at the start = coordinator connected and healthy
+N/hr in cyan = your AI is actively learning right now
Counts grow over time — your second brain getting smarter
If +N/hr for all: your AI is idle, not capturing new knowledge

What to Do

High +N/hr = good — your AI is learning from your work
Low counts early on are normal — knowledge accumulates over days
Example from active GreyMatter deployments
Tell Claude "explain the status line" for a live walkthrough

Attention

Knowledge Recall

N fading

Click to expand →

What It Shows

N fading — Knowledge entries approaching decay get flagged
FSRS-6 spaced repetition tracks retention for every entry
Yellow = entries need reinforcement soon
Red = entries at critical decay (below 30% retention)

How It Works

Each knowledge entry has a stability score
Score decays over time following Ebbinghaus forgetting curves
When your AI uses an entry, the score resets (reinforcement)
Entries that aren't used gradually fade from active recall

What to Do

Fading entries aren't deleted — they're just deprioritized
Review fading entries: gm_knowledge(action="search", query="fading")
Confirm an entry to strengthen it: use it in a session
This is self-curating — noise fades, important knowledge stays

Pipeline

Work Pipeline & Fleet

auto . P:9 . W:8 | [8local+5mini=13sess]

Click to expand →

What It Shows

auto — dispatch mode (autonomous / supervised / planned)
P:9 — 9 work items pending in the queue
W:8 — 8 work items actively being built by agents
[8local+5mini=13sess] — 13 total sessions across 2 nodes

Fleet View

8local — 8 agent sessions on your MacBook
5mini — 5 agent sessions on Mac Mini
=13sess — total fleet-wide session count
Red numbers mean a node has 0 active sessions (idle or offline)

Dispatch Modes

auto (green) — agents dispatch and execute without approval
supv (yellow) — items need approval before dispatch
plan (dim) — items queued but not dispatched
Change mode: gm_work(action="mode", status="autonomous")

Quality

Quality Gates

Gate 200+ 3x

Click to expand →

What It Shows

200+ (green) — 242 work items passed all quality gates
3x (red) — 3 work items failed quality checks
Pass rate: 98.8% — high quality from autonomous agents
Example from active GreyMatter deployments

Tier 1 (Mechanical)

Compile: Does the code build without errors?
Test: Do all tests pass? (retries flaky tests once)
Lint: Does it pass static analysis?
Commit: Was the work committed with the work item ID?

Tier 2 (Structural)

File relevance: Did the agent modify the right files?
Acceptance coverage: Does the diff match the acceptance criteria?
Scope compliance: Did the agent stay on task?
Failed items get requeued or flagged for human review

Secure

Security Scans

> 1K+scans

Click to expand →

What It Shows

> 1.2K scans — Thousands of security scans completed today
Cyan > prefix = SecureLLM active and scanning
Red numbers would indicate blocked requests
Every LLM call is scanned — no exceptions

What Gets Scanned

PII: SSNs, credit cards, phone numbers, emails
Secrets: API keys, tokens, private keys, connection strings
Prompt injection: instruction override, role hijacking
Policy violations: custom rules you define

What Happens on Detection

Redact: Replace with reversible token ([SSN_a3f8])
Block: Reject the entire request
Detect: Log but allow (for monitoring)
All events logged in the audit trail with timestamps

Monitor

Context Pressure

CTX 45%

Click to expand →

What It Shows

CTX 45% — 45% of the 1M token context window used
Green (<60%) — plenty of context remaining
Yellow (60-85%) — context filling up, quality may decline
Red (>85%) — critical, auto-compaction triggered

Why It Matters

AI quality degrades as context fills up
GreyMatter tracks this so you know when to start a new session
Auto-compaction at 80% preserves the most important context
Knowledge injection replaces lost context from compaction

What to Do

Below 60%: keep working, you have plenty of room
60-80%: consider finishing current task, then new session
Above 80%: GreyMatter auto-saves context before compaction
Next session starts with knowledge re-injected — no loss

Security

Every. Single. LLM Call. Scanned.

Every line of code your AI writes passes through an LLM. What else passes through? Your API keys. Your database credentials. Your customers' PII.

On by Default

TLS 1.3 Encryption

Every connection between your AI agents and the coordinator is encrypted. Not optional. Not "enable if you care." On from the first install.

Click to expand →

What You Get

TLS 1.3 enabled on first install — zero configuration
Auto-generated self-signed ECDSA P-256 certificates
Bring your own CA-signed certs for production
HTTP → HTTPS redirect built in
Certificate auto-renewal support

How It Works

Coordinator generates certs on first startup in ~/.greymatter/tls/
All agent ↔ coordinator traffic is encrypted
Set GM_TLS_CERT and GM_TLS_KEY for custom certs
Minimum TLS version: 1.2 (1.3 negotiated when available)

Why It Matters

Most dev tools ship with encryption off — GreyMatter ships with it on
Defense in depth — even localhost traffic is encrypted
No OpenSSL commands, no cert management burden
FedRAMP, CJIS, and HIPAA require encryption in transit

On by Default

Post-Quantum Encryption

Hybrid X25519 + ML-KEM 768 key exchange on every TLS connection. Protected against both classical and quantum threats.

Click to expand →

What You Get

Hybrid post-quantum key exchange on every TLS handshake
X25519MLKEM768 — classical + quantum-resistant combined
SecP256r1MLKEM768 and SecP384r1MLKEM1024 also available
Zero configuration — enabled by default in Go 1.24+ TLS 1.3

How It Works

Classical X25519 protects you against today's computers
ML-KEM 768 (NIST FIPS 203) protects against quantum computers
If either algorithm breaks, the other still holds — belt and suspenders
No performance penalty — hybrid adds ~1KB to the TLS handshake

Why It Matters

"Harvest now, decrypt later" — adversaries capture traffic today to decrypt with quantum computers tomorrow
Hybrid PQC makes that strategy worthless
Government and defense organizations are mandating PQC readiness
Most developers don't know TLS 1.3 already supports this — yours does

On by Default

FIPS 140-3 Cryptography

Every cryptographic operation uses FIPS-validated modules. Not "FIPS compatible." Validated. Certificate numbers and everything.

Click to expand →

Validated Modules

Go Coordinator: BoringCrypto (Google's FIPS-validated BoringSSL fork)
SecureLLM: aws-lc-rs — FIPS 140-3 Certificate #4631
AES-256-GCM encryption, SHA-256 hashing, ECDSA signing
Compiled with GOEXPERIMENT=boringcrypto by default

How It Works

Every crypto/rand, crypto/tls, crypto/sha256 call routes through BoringSSL
SecureLLM PII encryption uses aws-lc-rs (Amazon's validated Rust crypto)
Self-test on startup verifies the crypto module is operational
Panics if self-test fails — broken crypto means no start

Why It Matters

FIPS certification costs $50K-$200K and takes 12-18 months
But using a pre-validated module? Free. The work was done by Google and Amazon
Procurement asks "do you use FIPS crypto?" Answer: yes, Certificate #4631
Required for SLED, CJIS, HIPAA, FedRAMP, DoD IL2-IL5

On by Default

PII & Secret Detection

SSNs, credit cards, API keys, AWS credentials, private keys — caught and redacted before the LLM sees them. Every call. In real time.

Click to expand →

What It Catches

Social Security numbers (dashed and undashed formats)
Credit card numbers (Visa, Mastercard, Amex, Discover)
AWS access keys (AKIA...) and secret keys
GitHub tokens (ghp_, gho_, ghs_), API keys
Private SSH/PEM keys, database connection strings
Email addresses, phone numbers, custom patterns

How It Works

Redact: Replace with reversible token like [SSN_a3f8]
Block: Reject the entire request
Detect: Log but allow (for monitoring)
Redacted values are restored on the response — your code sees the real value
8 prompt injection patterns (instruction override, role hijacking, delimiter attacks)

Why It Matters

Every LLM call passes through your AI. What else passes through?
Developers accidentally paste API keys, credentials, and customer data
SecureLLM catches what humans miss — before it reaches the model
Real-time, on-device — no data sent to an external scanning service

Built In

Security Posture API

One API call shows your entire security state. TLS, FIPS, PQC, auth, audit, SecureLLM — prove your compliance on demand.

Click to expand →

What It Reports

TLS: Enabled, cert expiry, key algorithm, self-signed status
FIPS: BoringCrypto mode, validated module status
PQC: Available algorithms, active key exchange
Auth: Bearer token source, JWT status
Audit: Events in 24h, total count, last event
SecureLLM: PII mode, injection check active

How It Works

GET /api/security/posture — single JSON response
Reads runtime TLS cert, inspects actual crypto module
Counts real audit events from the database
Reports Go version, OS, architecture, DB lock status

Why It Matters

Being secure isn't enough — you need to prove it
SOC 2, HIPAA, CJIS, FedRAMP all want evidence
Machine-readable format for automated compliance checks
No manual audit — the endpoint does it for you, on demand

Built In

Append-Only Audit Trail

Every scan, every block, every agent dispatch — logged with timestamps. Full forensic history in your local database.

Click to expand →

What Gets Logged

Agent spawns, work item assignments, completions, failures
PII detections with pattern name and action taken
Prompt injection blocks with matched pattern
Session recoveries, idle cleanups, state transitions
Security scan results and policy violations

How It Works

Append-only — nothing gets deleted, nothing gets overwritten
Stored in your local SQLite database
Queryable via REST API: GET /api/audit/recent
Each entry: timestamp, actor, action, work_id, details

Why It Matters

When an auditor asks "what happened?" — you have the exact sequence
Not "we think this happened" — timestamped, attributed, complete
Tamper-evident — append-only design prevents retroactive changes
Your data, your machine — no third-party audit service

SecureLLM is also available as a standalone product for teams that need LLM security without the full GreyMatter platform. Learn more →

Expert Agents

Not One Assistant — A Fleet

An agent without context is just a fancy autocomplete. GreyMatter agents carry "souls" — persistent identity documents with domain expertise, coding standards, common patterns, and failure modes.

When GreyMatter dispatches a work item, it matches the task to the right expert. A Rust issue gets the Rust expert. A React component gets the TypeScript expert. The right brain for every job.

Autonomous work queue: Submit tasks, set priorities, walk away. Agents execute in parallel, run quality gates, and generate follow-up work items when something fails.

Create your own experts by dropping a markdown file in ~/.greymatter/soul/experts/

Editions

GreyMatter Solo & Teams

GreyMatter Solo GMS

Your personal second brain. Everything runs on your machine, controlled by you.

Full knowledge graph with spaced repetition
Go coordinator with session dispatch
20 MCP tools for Claude, Codex, and Gemini
SecureLLM security on every interaction
Works fully offline — no internet required

GreyMatter Teams GMT

Your team's collective intelligence. Share knowledge with encryption and access controls.

Everything in Solo, plus team synchronization
Encrypted knowledge sharing with retractable access
mTLS on all inter-node communication
Quality gates that review AI-generated code
Air-gapped and enterprise deployment support

Developer Platform

SDK, API & MCP

GreyMatter isn't just a tool — it's a platform. Three transports, one API:

MCP — 20 tools that integrate directly with Claude Code, Codex CLI, and Gemini CLI. Memory, work queue, security, agents — all through natural conversation.

REST API — The Go coordinator exposes a full REST API. Access GreyMatter from any web app, mobile app, or dashboard. Every endpoint secured by API key + rate limiting.

Python SDK — Import GreyMatter directly into your Python 3.12+ applications. Six namespaces: gm.knowledge, gm.work, gm.agents, gm.security, gm.sync, gm.config.

Quick Start

Up and running in two minutes.

1. Install GreyMatter

curl -sSL greymatter.axiomworks.ai/install | bash

Checks for Claude Code, downloads GreyMatter, sets up your database, configures the MCP plugin. Two minutes.

2. Log into Claude Code

With an API key: export ANTHROPIC_API_KEY=your-key — or with Claude Pro: /login

3. Open your project and start Claude

cd your-project && claude — 20 tools loaded automatically. Type /mcp to see them.

4. Optional: Local LLM for semantic search

Ollama enables vector search. GreyMatter works without it (keyword search only).

curl -fsSL https://ollama.com/install.sh | sh && ollama pull nomic-embed-text