{"slug": "show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams", "title": "Show HN: Willder, an open source context layer that syncs apps, agents and teams", "summary": "Willder, an open source context layer from the team behind willder.ai, launched as a Show HN project that syncs apps, agents and teams so that what one agent writes, others read on their next call. Each agent holds its own scoped, expiring token, and its memory reads and writes pass a single check and land in an audit log; a revoked token is refused on its next call. Willder connects Claude Code, Codex and Cursor agents over MCP, with connectors for GitHub, Google Drive, Slack, Figma and PostHog syncing into scopes, backed by Postgres with pgvector and Neo4j via Graphiti using BGE-384 embeddings.", "body_md": "**Apps, Agents, Teams Synced.**\n\nWillder is a context layer that syncs your apps, agents and teams, with access control on every call and real-time coordination: what one agent writes, the others read on their next call. Each agent holds its own scoped, expiring token; its memory reads and writes pass one check and land in the audit log; revoke a token and its next call is refused. Connect your Claude Code or Cursor agent over MCP in five minutes.\n\n[Website](https://willder.ai) ·\n  [Docs](https://github.com/willderai/willder-core/blob/main/docs/README.md) ·\n  [Architecture](https://github.com/willderai/willder-core/blob/main/docs/architecture.md) ·\n  [Connect a client](https://github.com/willderai/willder-core/blob/main/docs/connect/README.md) ·\n  [Discussions](https://github.com/willderai/willder-core/discussions)\n\n1. **The right context, unasked.** At the start of a task an agent gets a short brief of what\nmatters for it: the scope's rules, decisions and recent writes, ranked by the task's words.\nQueries search by words, by meaning and by links in the graph.[Task-start briefs](https://github.com/willderai/willder-core/blob/main/docs/architecture.md#change-notices-and-task-start-briefs) ,[hybrid retrieval](https://github.com/willderai/willder-core/blob/main/docs/architecture.md#hybrid-retrieval) .\n2. **One memory across every agent.** What Claude Code saves, Codex reads on its next call, with\nwho wrote it. Change a fact once and every agent reads the new version.[Versions and conflicts](https://github.com/willderai/willder-core/blob/main/docs/architecture.md#versions-and-conflicts) .\n3. **Connectors into scopes.** GitHub, Google Drive, Slack, Figma and PostHog sync into a scope\nyou choose, under that scope's rules.[services/connectors/](https://github.com/willderai/willder-core/blob/main/services/connectors) .\n4. **Access control.** Each agent holds its own scoped, expiring token. Its memory reads and\nwrites pass one check and land in the audit log; a revoked token is refused on its next call.\nWhat the check does not cover is listed under[Limits](#limits) .[The single check](https://github.com/willderai/willder-core/blob/main/docs/architecture.md#access-model-and-the-single-check) .\n5. **Set up in minutes.** One command connects Claude Code; Codex, Cursor and other clients\nhave a page each.[Connect a client](https://github.com/willderai/willder-core/blob/main/docs/connect/README.md) .\n6. **Memory you can see.** Every fact keeps who wrote it, where it came from, what it replaced\nand which agents first read it.[Audit and provenance](https://github.com/willderai/willder-core/blob/main/docs/architecture.md#audit-and-provenance) .\n\n```\nflowchart LR\n  accTitle: The parts of Willder and how a request moves through them.\n  accDescr: An MCP client with a capability token and a person in the web app both reach the memory operations. check() decides each guarded operation against Postgres and writes an audit row. Allowed operations read and write the Postgres stores, including pgvector, and the graph through the memory service, which owns Neo4j and the embedding model.\n  mcp[\"MCP client: agent token\"] --> ops[\"Memory operations\"]\n  web[\"Web app: signed-in person\"] --> ops\n  ops --> chk{\"check()\"}\n  chk --> pg[(\"Postgres: scopes, grants, tokens, audit_log, versions, pgvector chunks\")]\n  chk -- allow --> pg\n  chk -- allow --> ms[\"Memory service: FastAPI, BGE-384 embeddings\"]\n  ms --> neo[(\"Neo4j via Graphiti: facts and relations\")]\n```\n\nDeep dives: [architecture](https://github.com/willderai/willder-core/blob/main/docs/architecture.md), [hybrid retrieval](https://github.com/willderai/willder-core/blob/main/docs/willder_memory_hybrid.md),\n[conflict resolution](https://github.com/willderai/willder-core/blob/main/docs/willder_conflict_resolution.md), [database](https://github.com/willderai/willder-core/blob/main/docs/willder_database.md),\n[API](https://github.com/willderai/willder-core/blob/main/docs/willder_api.md), [export format](https://github.com/willderai/willder-core/blob/main/docs/export-format.md), [self-hosting](https://github.com/willderai/willder-core/blob/main/docs/self-host.md).\n\nYou run several agents on real work: a coding agent in the repo, a research agent on a schedule, a side project's agent. Nothing decides what each may see, tells the others when one changes something, or records what was read. Willder is the memory they share and the fence between them: scopes, per-agent tokens, a change feed and an audit, with no model in any access decision.\n\nThis repository is the engine: Postgres with pgvector, Neo4j, the memory service and the MCP\nserver. It runs on your own machine with no willder.ai account and no call to willder.ai. You\nneed Docker with Compose v2, Node 20.19+, 22.12+ or 24+, and a few GB of disk. Without Docker,\n[docs/self-host.md](https://github.com/willderai/willder-core/blob/main/docs/self-host.md#without-docker) says what to run instead.\n\n```\ngit clone https://github.com/willderai/willder-core.git && cd willder-core\nnpm install\ncp .env.selfhost.example .env          # then set GRAPHITI_SERVICE_API_KEY to any string\ndocker compose up -d --wait            # Postgres, Neo4j, the memory service; the first build takes minutes\nnpx prisma migrate deploy              # create the tables\nnpm run selfhost:smoke                 # write, scoped read, refusal, export, no outside calls\n```\n\nThe smoke ends with `9 of 9 steps passed`. [docs/self-host.md](https://github.com/willderai/willder-core/blob/main/docs/self-host.md) describes each\nline it prints and what to do when one fails.\n\n**Mint a token for your agent.** One per agent, scoped and expiring:\n\n```\nnpm run selfhost:token -- --scope team --agent claude-code\n```\n\nIt prints a `wcap_...` token once. Put it in an environment variable and nowhere else:\n\n```\nprintf 'Willder token: '\nstty -echo; read -r WILLDER_TOKEN; stty echo\nprintf '\\n'\nexport WILLDER_TOKEN\n```\n\n**Connect Claude Code** to the local stdio MCP server, from this directory:\n\n```\nclaude mcp add -s user willder-local -e WILLDER_CAPABILITY_TOKEN=\"$WILLDER_TOKEN\" \\\n  -- npm --prefix \"$PWD\" run --silent mcp\n```\n\nThen tell the agent: `Save this to Willder: we store sessions in Postgres, not Redis, so they survive a restart. Then ask Willder where we store sessions and why.`\nIt calls `memory_ingest` with two required arguments, `content` (the fact) and `name` (what the\nfact is about), and gets back the id a later update passes as `baseVersion`:\n\n```\nStored and readable now; graph extraction continues in the background. Version: <version id>.\n```\n\nThen it calls `memory_query`, which returns one bullet per fact with when and who wrote it (an\nagent that has only a token is named by it, quoted), notes on what its grant let it read, and the\nanswer's revision:\n\n```\n• we store sessions in Postgres, not Redis, so they survive a restart. (as of <when it was stored>) — from: \"claude-code\" (agent token) (agent) · version <version id>\nrevision: <16 hex characters>\n```\n\nA token for another scope (`npm run selfhost:token -- --scope research --agent second-agent`)\ngets `No facts found.` for the same question. Other clients: [docs/connect/](https://github.com/willderai/willder-core/blob/main/docs/connect/README.md);\nthe stdio server and its tools: [mcp/README.md](https://github.com/willderai/willder-core/blob/main/mcp/README.md#local-stdio-development).\n\nThe engine calls out to one thing at most, and only if you configure it: an OpenAI-compatible\nmodel endpoint that extracts facts on writes (a local server works; without one a write is still\nstored and readable, and only graph extraction is skipped). The web app is optional: it needs a\nfree Clerk development instance to sign people in, and\n[docs/self-host.md](https://github.com/willderai/willder-core/blob/main/docs/self-host.md#what-it-needs) lists the other outside calls it makes.\nAn export is one JSON Lines file in a documented format:\n[docs/export-format.md](https://github.com/willderai/willder-core/blob/main/docs/export-format.md).\n\nPrefer not to run it? The hosted service at [willder.ai](https://willder.ai) runs the same\nengine: [docs/quickstart.md](https://github.com/willderai/willder-core/blob/main/docs/quickstart.md).\n\nTwo checks, about ten minutes, and neither needs an account. The second revokes the\n`claude-code` token from [Run it on your machine](#run-it-on-your-machine) (any token you are\nwilling to revoke works).\n\n**1. Run the leak suite.** From a fresh clone, with Node 20.19, 22.12 or 24:\n\n```\ngit clone https://github.com/willderai/willder-core.git && cd willder-core\nnpm ci\nnpm run test:leaks\n```\n\nInstalling takes about a minute; the suite runs in seconds with no keys and no network. It\nis every test file named `*eval.test.ts`, `*leak.test.ts` or `*leakage.test.ts`: `check()`,\nthe guarded memory reads and the MCP tool bodies run for real, and only the database and\nmemory backends are stubbed. A pass ends with no failed file. One file,\n`app/api/briefs/staleness-scope-leak.test.ts`, reports as skipped unless `QA_DATABASE_URL`\nnames a test Postgres ([docs/development.md](https://github.com/willderai/willder-core/blob/main/docs/development.md)). The suite asserts that:\n\n- a token scoped to one team never receives a sibling scope's facts, graph nodes, uploaded files or briefs, and the in-scope token still does, so an over-broad filter fails too;\n- a revoked or expired token is refused on every memory tool over the real MCP endpoint;\n- a call without a real caller identity is denied, never audited under a stand-in actor;\n- the account tier can narrow a read and never widen one;\n- the same holds with thousands of facts and concurrent callers, and a backend failure is reported as a failure, not as an empty answer.\n\nA few cases are named `GAP:`. They pass by pinning a known defect, and each one says what\nthe correct behaviour is. The suite proves the code; step 2 proves the running service.\n\n**2. Revoke a token and see its next call refused.** Revoke the agent's token from the\nterminal:\n\n```\nnpm run selfhost:token -- --revoke claude-code\n```\n\nIt prints each token it revoked by id, scope, permission and expiry, never the token, and nothing waits for the token to expire. What the agent sees next depends on how it connects:\n\n- **A stdio MCP server already running** , like the`claude mcp add` connection above: it keeps\nlisting its tools, but every memory call after the revoke is refused and nothing is read or\nwritten. Memory tools answer`Access denied: no valid capability for agent claude-code granting read` (or`write` )`on the target scope …` , and each refusal is a deny row in the audit log\nunder the call's own action (`memory.read` ,`memory.write` or`memory.entity` ).\n- **A stdio MCP server started with the revoked token** exits before connecting, with`WILLDER_CAPABILITY_TOKEN is not a live token in this database (unknown, expired or revoked)` ,\nand records a`capability.refused` row.\n- **Over HTTP** , the web app's`/api/mcp` or`https://willder.ai/api/mcp` on the hosted service,\nthe next call gets`HTTP 401` with`Invalid or unknown capability token.` and a`capability.refused` deny row for that agent.\n\n`npm run selfhost:export` holds every one of those refusals as `audit` lines.\n\nMeasured with dates: the first three rows on the hosted service at willder.ai, the setup row in a clean container. The harness that produced them is not in this repository. Implementation is not proof, and nothing here is a guaranteed latency.\n\n| Claim | Evidence | Status | \n|---|---|---|\n| Access control under failure: scoped tokens, default deny, a token revoked mid-sequence denied on its next call, one audit row per read and per refusal | 2026-10-01: held under six concurrent readers and a revoke mid-sequence | Proven in production at failure load | \n| Connected sources: connect, ask, get a cited answer, disconnect, answer gone | 2026-09-26, GitHub: 5 of 5 steps, sync 177.6 s, cited answer in 0.9 s, answer gone 1.6 s after disconnect. Disconnect mid-sync and credential failures are measured separately | Proven in production at normal load (GitHub); other connectors not individually measured | \n| Real-time memory: a write is readable by other agents on their next call | 2026-10-02, six concurrent writers: 60 of 60 writes acknowledged, write-to-read p50 575 ms, p95 1025 ms timed from before the write is sent | Proven in production at six concurrent writers | \n| Setup: clone to first query, following the ten-minute local path in [docs/development.md](https://github.com/willderai/willder-core/blob/main/docs/development.md#ten-minute-path-a-local-mcp-server) | 2026-10-07: scripted cold install on a clean Ubuntu 24.04 container, 254.4 s from machine start to the first answer (102.6 s of it after the clone), zero stalls, first answer `No facts found.` Scripted operator, reading time excluded. | One measured sample, not a promised time | \n\nAudit rows are evidence of access decisions, not proof that an answer is correct. The\ncode-level leak claims are reproduced without an account by `npm run test:leaks`\n([Prove it does not leak](#prove-it-does-not-leak)).\n\nEach line names the file that makes it true.\n\n- **Who can see what is decided by `check()` in the application, not by the database.** No\nrow-level security is enabled (no migration in`prisma/migrations/` creates a policy), so\nthe credentials listed in the next section reach memory without`check()` .\n- **Source permissions do not carry over.** A connected source takes the access of the\nscope it lands in, not its own sharing list. Connecting asks you to acknowledge any\nwidening, people and agents both, before it goes ahead\n(`services/access/source-widening.ts` ).\n- **Conflicting writes are detected and notified, nothing more.** When two agents write the\nsame fact in one scope within one second, the version stored first stays current, the\nlater one is recorded as superseded, and its writer is told on its next tool call. Both\nversions stay readable (`services/memory/conflict.ts` ,`mcp/README.md` ).\n- **No cost saving is claimed.** No measure of tokens per run has run on a deployed commit.\n- **Connectors read, with one write.** GitHub, Google Drive, Slack, Figma, PostHog and\nwebsites today (`SourceType` in`prisma/schema.prisma` ); no Linear connector. The one\nwrite into a connected tool is exporting a brief as a new Google Doc in the org's\nconnected Drive (`POST /api/briefs/[id]/export-doc` ,`createGoogleDoc` in`services/connectors/gdrive.ts` ). Nothing else writes back to a connected tool\n(`services/connectors/source-readers.ts` ).\n- **The memory service needs Neo4j and a local embedding model** (about 130 MB), plus an\nextraction model key to write. Reads work without a model key\n(`memory-service/README.md` ,`memory-service/app/config.py` ).\n- **OAuth-only clients cannot connect yet.** claude.ai and ChatGPT sign in with OAuth, which\nis built but off until`MCP_OAUTH_ENABLED` is turned on in production\n(`mcp/oauth-discovery.ts` ); until then hosted MCP needs a client that sends the bearer header.\n- **MCP has no delete tool.** A fact is replaced with`memory_ingest` and`baseVersion` ;\ndeleting one goes through the app (`mcp/tools/` ,`mcp/README.md` ).\n- **The Starter account tier returns no facts.** It allows only the`source` and`files` stores, and memory search reads only the graph and vector stores\n(`services/memory/account-tiers.ts` ,`services/memory/hybrid-store.ts` ).\n\nMemory in Postgres is read and written through `check()` in `services/access/check.ts`.\nThe lint gate `eslint/eslint.memory-access.mjs` enforces this in code: a query against a memory\ntable (a model marked `@memory` in `prisma/schema.prisma`) outside `services/access` and\n`services/memory` fails `npm run scope-gate:check` in CI, and no `eslint-disable` comment\ncan silence it there. The gate does not cover the memory\ngraph: a few routes and jobs still write it through the unguarded `memory` store export\nrather than `guardedMemory`, and the gate does not see those calls. The authorizer runs\ninside the application, so a person holding one of these credentials can reach memory\nwithout it.\n\n| Credential | What it reaches without `check()` | Read by | \n|---|---|---|\n| `DATABASE_URL` ,`DATABASE_URL_UNPOOLED` | Every Postgres table, memory tables included. No row-level security is enabled. `build.sh` runs migrations with it, so it can also change the schema. | `lib/db.ts` ,`prisma.config.ts` ,`build.sh` | \n| `NEO4J_URI` ,`NEO4J_USERNAME` ,`NEO4J_PASSWORD` | The memory graph itself: every org's entities, facts and episodes. | `memory-service/app/config.py` ,`lib/inngest/scheduled-jobs.ts` | \n| `GRAPHITI_SERVICE_API_KEY` | The memory service's HTTP API. It trusts whatever `group_id` the caller sends, so the key can read or write any org's graph partition. | `memory-service/app/main.py` (`require_api_key` ),`services/memory/graphiti-store.ts` | \n| `INNGEST_EVENT_KEY` ,`INNGEST_SIGNING_KEY` | Background jobs. The memory-ingest, file-ingest and connector-sync jobs write what their event payload names, because the request that sent the event has already been authorized. A forged event writes memory into any scope. | The Inngest SDK, through `lib/inngest/client.ts` and`app/api/inngest/route.ts` | \n| `BLOB_READ_WRITE_TOKEN` | Uploaded source files, stored privately under `memory/<orgId>/` , before extraction. | `@vercel/blob` , through`lib/blob-storage.ts` ;`memory-service/app/config.py` | \n| `CLERK_WEBHOOK_SECRET` ,`CLERK_WEBHOOK_SECRET_2` | A forged membership event writes an episode naming the member into the org's graph through the unguarded store, and deletes that user's row. | `app/api/webhooks/clerk/route.ts` | \n| `APP_ENCRYPTION_KEY` | With database access, the sealed connector and mailbox credentials ( `Source.encryptedTokens` ,`Integration.encryptedTokens` , mailbox OAuth tokens), and through them the connected sources that memory is built from. | `lib/crypto.ts` ,`services/integrations/mailbox.ts` | \n| `LANGFUSE_SECRET_KEY` | Agent traces. These record the full prompt, including memory an agent was allowed to read. | `services/langfuse.ts` | \n| `VERCEL_TOKEN` , or other access to the Vercel project's environment | Every value above. The QA sandbox reads the token wherever it is set, and uses it with `VERCEL_TEAM_ID` and`VERCEL_PROJECT_ID` (without them, on Vercel, it authenticates by OIDC); a token with access to the project can read its environment. | `services/agents/qa-sandbox.ts` ; Vercel | \n\nCredentials that act as someone *through* the authorizer are not on this list, because\n`check()` still decides what they can do: capability tokens, a Clerk session, and\n`CLERK_SECRET_KEY` (which can sign in as any user). Revoking or narrowing those works as\ndescribed above. Rotating one of the credentials in the table is the only way to cut off\nwhoever holds it.\n\n`npm run bypass-credentials:check` (`scripts/check-bypass-credentials.mjs`) keeps this\ntable honest: it fails when the code or `.env.example` reads a credential that is neither\nlisted here nor recorded there with the reason it does not reach memory.\n\n- [docs/self-host.md](https://github.com/willderai/willder-core/blob/main/docs/self-host.md) : every self-host step, tokens, revoking, export, refusals, no Docker.\n- [mcp/README.md](https://github.com/willderai/willder-core/blob/main/mcp/README.md) : tools, permissions, the local stdio server.\n- [docs/development.md](https://github.com/willderai/willder-core/blob/main/docs/development.md) : the web app and local development.\n- [docs/willder_api.md](https://github.com/willderai/willder-core/blob/main/docs/willder_api.md) : the route map.\n- [docs/architecture.md](https://github.com/willderai/willder-core/blob/main/docs/architecture.md) : the architecture, with diagrams and measured numbers.\n- [docs/README.md](https://github.com/willderai/willder-core/blob/main/docs/README.md) : every document in this repository, one line each.\n\n[CONTRIBUTING.md](https://github.com/willderai/willder-core/blob/main/CONTRIBUTING.md) covers tests, lint and what a PR\nneeds. Report a vulnerability per [SECURITY.md](https://github.com/willderai/willder-core/blob/main/SECURITY.md), not in a public issue.\n\nMIT, see [LICENSE](https://github.com/willderai/willder-core/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams", "canonical_source": "https://github.com/willderai/willder-core", "published_at": "2026-11-10 06:44:36+00:00", "updated_at": "2026-11-10 06:56:57.894909+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Willder", "willder.ai", "Claude Code", "Codex", "Cursor", "GitHub", "Google Drive", "Slack"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams", "markdown": "https://wpnews.pro/news/show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams.md", "text": "https://wpnews.pro/news/show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams.txt", "jsonld": "https://wpnews.pro/news/show-hn-willder-an-open-source-context-layer-that-syncs-apps-agents-and-teams.jsonld"}}