Memory layer for AI agents

Long-term memory for AI agents — with guarantees, not vibes.

Your agent forgets between runs. ShineMnemos gives it a memory it can trust: every fact is checked before it is written, every recall is an exact hit, and the whole thing is one MCP server your agent already knows how to talk to. Pay per call in USDC — no subscription, no registration required.

0.001msexact lookup, in-process

100%exact-key recall, no embedding guesswork

5+1write gates + truth-gate verdict

11plugins in the catalog

What you get

Exact lookup in ~0.001 msin-process on a single SQLite file (~10k nodes, no network round-trip) — a key hit is exact, not the nearest embedding

5 quality gates on every writefreshness, source, numbers, consistency, reproducibility — plus a truth-gate verdict and a confidence score. Stale facts expire on their own TTL

MCP server, drop-inruns in-process next to your agent; the graph is the storage model on every install, not a paid tier

x402 pay-as-you-gothe agent pays USDC on Base from its own wallet, per call — no plan, no invoice, no KYC

Ready to start?

Your wallet address is the account. One signature, no password and no e-mail — signing costs no gas and sends no transaction.

How it works Documentation

Just browsing? The and are open without an account.

POST /api/auth/challenge → /api/auth/verify

Log in or sign up with your wallet

No password, no e-mail, no KYC and no third-party service. Your wallet address is your account: the server hands out a one-time challenge, your wallet signs it, and the signature is verified on our side. Signing costs no gas and sends no transaction.

Step 1 · Connect a wallet

We ask the browser wallet for your address, request a challenge for it and pass the message to the wallet for signing.

No browser wallet? Any wallet that can sign an EIP-191 message works — use the manual flow below.

Manual signing · for CLI and agents

Paste an address, take the message, sign it in your own tooling (ethers, eth-account, a hardware wallet) and send the signature back.

Sign this message verbatim (personal_sign / EIP-191). The challenge is single-use and expires in 5 minutes.

What sign-up gives you

Plugin checkoutthe x402 challenge and the on-chain confirmation are bound to your account

Private API keysonly you see your keys; the server keeps a sha-256 hash, never the key itself

Access grantsevery confirmed payment is recorded against your address

The session is an HMAC-signed token in an httpOnly SameSite=Strict cookie, valid for 7 days. Nothing about you is stored beyond the address you signed with.

GET /api/auth/me

My account

The wallet address is the only identifier. A display name is optional and purely cosmetic.

Session

Display name

GET /api/plugins

Memory plugin catalog

The server catalog is the single source of truth. Available plugins are bought with x402 (USDC on Base) once you are signed in; the ones marked “soon” are described here but not on sale yet.

— 0.005 USDC / request

POST /plugin-buy/:id

Checkout · x402 · USDC on Base

The server issues an HTTP 402 challenge in the same format as apix402: amount, recipient, network, nonce and deadline. You pay from your wallet, then send the transaction hash — the server checks the transfer on-chain via eth_getTransactionReceipt and issues your key.

Step 1 · Pick a plugin and get the challenge

Plugin

The payment-required header carries the same base64 challenge: an agent reads it without parsing the response body.

This route is limited to 5 requests per minute per IP.

Step 2 · Confirm the payment on-chain

Payment happens in your wallet: connect, confirm the USDC transfer — done. The site verifies it on-chain automatically.

/api/keys

API keys

Keys are generated with crypto.randomBytes(16) and shown in full exactly once — at creation. The server stores only a sha-256 hash plus a display prefix; the listing always shows the mask: first 8 characters and last 4.

Issue a key

Issued keys

GET /api/grants

Access grants

Every payment confirmed on-chain lands here: plugin, masked payer address, transaction hash and the time the access was issued.

—

GET /healthz

Status & limits

Live service state and a map of the public API. Budget values come from the X-RateLimit-* headers of the last server response.

—service state

—general limit left

5/minstrict limit: checkout and keys

10 KBmaximum body size

0.005 USDCprice per request, Base network

/healthz response

—

API map

Accounts and keys live in SQLite. API keys are stored as a sha-256 hash plus a display prefix — the full key is issued once at creation and cannot be read back from the database.