Show HN: Willder, an open source context layer that syncs apps, agents and teams

Willder, an open source context layer from the team behind willder.ai, launched as a Show HN project that syncs apps, agents and teams so that what one agent writes, others read on their next call. Each agent holds its own scoped, expiring token, and its memory reads and writes pass a single check and land in an audit log; a revoked token is refused on its next call. Willder connects Claude Code, Codex and Cursor agents over MCP, with connectors for GitHub, Google Drive, Slack, Figma and PostHog syncing into scopes, backed by Postgres with pgvector and Neo4j via Graphiti using BGE-384 embeddings.

Apps, Agents, Teams Synced. Willder is a context layer that syncs your apps, agents and teams, with access control on every call and real-time coordination: what one agent writes, the others read on their next call. Each agent holds its own scoped, expiring token; its memory reads and writes pass one check and land in the audit log; revoke a token and its next call is refused. Connect your Claude Code or Cursor agent over MCP in five minutes. Website https://willder.ai · Docs https://github.com/willderai/willder-core/blob/main/docs/README.md · Architecture https://github.com/willderai/willder-core/blob/main/docs/architecture.md · Connect a client https://github.com/willderai/willder-core/blob/main/docs/connect/README.md · Discussions https://github.com/willderai/willder-core/discussions 1. The right context, unasked. At the start of a task an agent gets a short brief of what matters for it: the scope's rules, decisions and recent writes, ranked by the task's words. Queries search by words, by meaning and by links in the graph. Task-start briefs https://github.com/willderai/willder-core/blob/main/docs/architecture.md change-notices-and-task-start-briefs , hybrid retrieval https://github.com/willderai/willder-core/blob/main/docs/architecture.md hybrid-retrieval . 2. One memory across every agent. What Claude Code saves, Codex reads on its next call, with who wrote it. Change a fact once and every agent reads the new version. Versions and conflicts https://github.com/willderai/willder-core/blob/main/docs/architecture.md versions-and-conflicts . 3. Connectors into scopes. GitHub, Google Drive, Slack, Figma and PostHog sync into a scope you choose, under that scope's rules. services/connectors/ https://github.com/willderai/willder-core/blob/main/services/connectors . 4. Access control. Each agent holds its own scoped, expiring token. Its memory reads and writes pass one check and land in the audit log; a revoked token is refused on its next call. What the check does not cover is listed under Limits limits . The single check https://github.com/willderai/willder-core/blob/main/docs/architecture.md access-model-and-the-single-check . 5. Set up in minutes. One command connects Claude Code; Codex, Cursor and other clients have a page each. Connect a client https://github.com/willderai/willder-core/blob/main/docs/connect/README.md . 6. Memory you can see. Every fact keeps who wrote it, where it came from, what it replaced and which agents first read it. Audit and provenance https://github.com/willderai/willder-core/blob/main/docs/architecture.md audit-and-provenance . flowchart LR accTitle: The parts of Willder and how a request moves through them. accDescr: An MCP client with a capability token and a person in the web app both reach the memory operations. check decides each guarded operation against Postgres and writes an audit row. Allowed operations read and write the Postgres stores, including pgvector, and the graph through the memory service, which owns Neo4j and the embedding model. mcp "MCP client: agent token" -- ops "Memory operations" web "Web app: signed-in person" -- ops ops -- chk{"check "} chk -- pg "Postgres: scopes, grants, tokens, audit log, versions, pgvector chunks" chk -- allow -- pg chk -- allow -- ms "Memory service: FastAPI, BGE-384 embeddings" ms -- neo "Neo4j via Graphiti: facts and relations" Deep dives: architecture https://github.com/willderai/willder-core/blob/main/docs/architecture.md , hybrid retrieval https://github.com/willderai/willder-core/blob/main/docs/willder memory hybrid.md , conflict resolution https://github.com/willderai/willder-core/blob/main/docs/willder conflict resolution.md , database https://github.com/willderai/willder-core/blob/main/docs/willder database.md , API https://github.com/willderai/willder-core/blob/main/docs/willder api.md , export format https://github.com/willderai/willder-core/blob/main/docs/export-format.md , self-hosting https://github.com/willderai/willder-core/blob/main/docs/self-host.md . You run several agents on real work: a coding agent in the repo, a research agent on a schedule, a side project's agent. Nothing decides what each may see, tells the others when one changes something, or records what was read. Willder is the memory they share and the fence between them: scopes, per-agent tokens, a change feed and an audit, with no model in any access decision. This repository is the engine: Postgres with pgvector, Neo4j, the memory service and the MCP server. It runs on your own machine with no willder.ai account and no call to willder.ai. You need Docker with Compose v2, Node 20.19+, 22.12+ or 24+, and a few GB of disk. Without Docker, docs/self-host.md https://github.com/willderai/willder-core/blob/main/docs/self-host.md without-docker says what to run instead. git clone https://github.com/willderai/willder-core.git && cd willder-core npm install cp .env.selfhost.example .env then set GRAPHITI SERVICE API KEY to any string docker compose up -d --wait Postgres, Neo4j, the memory service; the first build takes minutes npx prisma migrate deploy create the tables npm run selfhost:smoke write, scoped read, refusal, export, no outside calls The smoke ends with 9 of 9 steps passed . docs/self-host.md https://github.com/willderai/willder-core/blob/main/docs/self-host.md describes each line it prints and what to do when one fails. Mint a token for your agent. One per agent, scoped and expiring: npm run selfhost:token -- --scope team --agent claude-code It prints a wcap ... token once. Put it in an environment variable and nowhere else: printf 'Willder token: ' stty -echo; read -r WILLDER TOKEN; stty echo printf '\n' export WILLDER TOKEN Connect Claude Code to the local stdio MCP server, from this directory: claude mcp add -s user willder-local -e WILLDER CAPABILITY TOKEN="$WILLDER TOKEN" \ -- npm --prefix "$PWD" run --silent mcp Then tell the agent: Save this to Willder: we store sessions in Postgres, not Redis, so they survive a restart. Then ask Willder where we store sessions and why. It calls memory ingest with two required arguments, content the fact and name what the fact is about , and gets back the id a later update passes as baseVersion : Stored and readable now; graph extraction continues in the background. Version: <version id . Then it calls memory query , which returns one bullet per fact with when and who wrote it an agent that has only a token is named by it, quoted , notes on what its grant let it read, and the answer's revision: • we store sessions in Postgres, not Redis, so they survive a restart. as of <when it was stored — from: "claude-code" agent token agent · version <version id revision: <16 hex characters A token for another scope npm run selfhost:token -- --scope research --agent second-agent gets No facts found. for the same question. Other clients: docs/connect/ https://github.com/willderai/willder-core/blob/main/docs/connect/README.md ; the stdio server and its tools: mcp/README.md https://github.com/willderai/willder-core/blob/main/mcp/README.md local-stdio-development . The engine calls out to one thing at most, and only if you configure it: an OpenAI-compatible model endpoint that extracts facts on writes a local server works; without one a write is still stored and readable, and only graph extraction is skipped . The web app is optional: it needs a free Clerk development instance to sign people in, and docs/self-host.md https://github.com/willderai/willder-core/blob/main/docs/self-host.md what-it-needs lists the other outside calls it makes. An export is one JSON Lines file in a documented format: docs/export-format.md https://github.com/willderai/willder-core/blob/main/docs/export-format.md . Prefer not to run it? The hosted service at willder.ai https://willder.ai runs the same engine: docs/quickstart.md https://github.com/willderai/willder-core/blob/main/docs/quickstart.md . Two checks, about ten minutes, and neither needs an account. The second revokes the claude-code token from Run it on your machine run-it-on-your-machine any token you are willing to revoke works . 1. Run the leak suite. From a fresh clone, with Node 20.19, 22.12 or 24: git clone https://github.com/willderai/willder-core.git && cd willder-core npm ci npm run test:leaks Installing takes about a minute; the suite runs in seconds with no keys and no network. It is every test file named eval.test.ts , leak.test.ts or leakage.test.ts : check , the guarded memory reads and the MCP tool bodies run for real, and only the database and memory backends are stubbed. A pass ends with no failed file. One file, app/api/briefs/staleness-scope-leak.test.ts , reports as skipped unless QA DATABASE URL names a test Postgres docs/development.md https://github.com/willderai/willder-core/blob/main/docs/development.md . The suite asserts that: - a token scoped to one team never receives a sibling scope's facts, graph nodes, uploaded files or briefs, and the in-scope token still does, so an over-broad filter fails too; - a revoked or expired token is refused on every memory tool over the real MCP endpoint; - a call without a real caller identity is denied, never audited under a stand-in actor; - the account tier can narrow a read and never widen one; - the same holds with thousands of facts and concurrent callers, and a backend failure is reported as a failure, not as an empty answer. A few cases are named GAP: . They pass by pinning a known defect, and each one says what the correct behaviour is. The suite proves the code; step 2 proves the running service. 2. Revoke a token and see its next call refused. Revoke the agent's token from the terminal: npm run selfhost:token -- --revoke claude-code It prints each token it revoked by id, scope, permission and expiry, never the token, and nothing waits for the token to expire. What the agent sees next depends on how it connects: - A stdio MCP server already running , like the claude mcp add connection above: it keeps listing its tools, but every memory call after the revoke is refused and nothing is read or written. Memory tools answer Access denied: no valid capability for agent claude-code granting read or write on the target scope … , and each refusal is a deny row in the audit log under the call's own action memory.read , memory.write or memory.entity . - A stdio MCP server started with the revoked token exits before connecting, with WILLDER CAPABILITY TOKEN is not a live token in this database unknown, expired or revoked , and records a capability.refused row. - Over HTTP , the web app's /api/mcp or https://willder.ai/api/mcp on the hosted service, the next call gets HTTP 401 with Invalid or unknown capability token. and a capability.refused deny row for that agent. npm run selfhost:export holds every one of those refusals as audit lines. Measured with dates: the first three rows on the hosted service at willder.ai, the setup row in a clean container. The harness that produced them is not in this repository. Implementation is not proof, and nothing here is a guaranteed latency. | Claim | Evidence | Status | |---|---|---| | Access control under failure: scoped tokens, default deny, a token revoked mid-sequence denied on its next call, one audit row per read and per refusal | 2026-10-01: held under six concurrent readers and a revoke mid-sequence | Proven in production at failure load | | Connected sources: connect, ask, get a cited answer, disconnect, answer gone | 2026-09-26, GitHub: 5 of 5 steps, sync 177.6 s, cited answer in 0.9 s, answer gone 1.6 s after disconnect. Disconnect mid-sync and credential failures are measured separately | Proven in production at normal load GitHub ; other connectors not individually measured | | Real-time memory: a write is readable by other agents on their next call | 2026-10-02, six concurrent writers: 60 of 60 writes acknowledged, write-to-read p50 575 ms, p95 1025 ms timed from before the write is sent | Proven in production at six concurrent writers | | Setup: clone to first query, following the ten-minute local path in docs/development.md https://github.com/willderai/willder-core/blob/main/docs/development.md ten-minute-path-a-local-mcp-server | 2026-10-07: scripted cold install on a clean Ubuntu 24.04 container, 254.4 s from machine start to the first answer 102.6 s of it after the clone , zero stalls, first answer No facts found. Scripted operator, reading time excluded. | One measured sample, not a promised time | Audit rows are evidence of access decisions, not proof that an answer is correct. The code-level leak claims are reproduced without an account by npm run test:leaks Prove it does not leak prove-it-does-not-leak . Each line names the file that makes it true. - Who can see what is decided by check in the application, not by the database. No row-level security is enabled no migration in prisma/migrations/ creates a policy , so the credentials listed in the next section reach memory without check . - Source permissions do not carry over. A connected source takes the access of the scope it lands in, not its own sharing list. Connecting asks you to acknowledge any widening, people and agents both, before it goes ahead services/access/source-widening.ts . - Conflicting writes are detected and notified, nothing more. When two agents write the same fact in one scope within one second, the version stored first stays current, the later one is recorded as superseded, and its writer is told on its next tool call. Both versions stay readable services/memory/conflict.ts , mcp/README.md . - No cost saving is claimed. No measure of tokens per run has run on a deployed commit. - Connectors read, with one write. GitHub, Google Drive, Slack, Figma, PostHog and websites today SourceType in prisma/schema.prisma ; no Linear connector. The one write into a connected tool is exporting a brief as a new Google Doc in the org's connected Drive POST /api/briefs/ id /export-doc , createGoogleDoc in services/connectors/gdrive.ts . Nothing else writes back to a connected tool services/connectors/source-readers.ts . - The memory service needs Neo4j and a local embedding model about 130 MB , plus an extraction model key to write. Reads work without a model key memory-service/README.md , memory-service/app/config.py . - OAuth-only clients cannot connect yet. claude.ai and ChatGPT sign in with OAuth, which is built but off until MCP OAUTH ENABLED is turned on in production mcp/oauth-discovery.ts ; until then hosted MCP needs a client that sends the bearer header. - MCP has no delete tool. A fact is replaced with memory ingest and baseVersion ; deleting one goes through the app mcp/tools/ , mcp/README.md . - The Starter account tier returns no facts. It allows only the source and files stores, and memory search reads only the graph and vector stores services/memory/account-tiers.ts , services/memory/hybrid-store.ts . Memory in Postgres is read and written through check in services/access/check.ts . The lint gate eslint/eslint.memory-access.mjs enforces this in code: a query against a memory table a model marked @memory in prisma/schema.prisma outside services/access and services/memory fails npm run scope-gate:check in CI, and no eslint-disable comment can silence it there. The gate does not cover the memory graph: a few routes and jobs still write it through the unguarded memory store export rather than guardedMemory , and the gate does not see those calls. The authorizer runs inside the application, so a person holding one of these credentials can reach memory without it. | Credential | What it reaches without check | Read by | |---|---|---| | DATABASE URL , DATABASE URL UNPOOLED | Every Postgres table, memory tables included. No row-level security is enabled. build.sh runs migrations with it, so it can also change the schema. | lib/db.ts , prisma.config.ts , build.sh | | NEO4J URI , NEO4J USERNAME , NEO4J PASSWORD | The memory graph itself: every org's entities, facts and episodes. | memory-service/app/config.py , lib/inngest/scheduled-jobs.ts | | GRAPHITI SERVICE API KEY | The memory service's HTTP API. It trusts whatever group id the caller sends, so the key can read or write any org's graph partition. | memory-service/app/main.py require api key , services/memory/graphiti-store.ts | | INNGEST EVENT KEY , INNGEST SIGNING KEY | Background jobs. The memory-ingest, file-ingest and connector-sync jobs write what their event payload names, because the request that sent the event has already been authorized. A forged event writes memory into any scope. | The Inngest SDK, through lib/inngest/client.ts and app/api/inngest/route.ts | | BLOB READ WRITE TOKEN | Uploaded source files, stored privately under memory/<orgId / , before extraction. | @vercel/blob , through lib/blob-storage.ts ; memory-service/app/config.py | | CLERK WEBHOOK SECRET , CLERK WEBHOOK SECRET 2 | A forged membership event writes an episode naming the member into the org's graph through the unguarded store, and deletes that user's row. | app/api/webhooks/clerk/route.ts | | APP ENCRYPTION KEY | With database access, the sealed connector and mailbox credentials Source.encryptedTokens , Integration.encryptedTokens , mailbox OAuth tokens , and through them the connected sources that memory is built from. | lib/crypto.ts , services/integrations/mailbox.ts | | LANGFUSE SECRET KEY | Agent traces. These record the full prompt, including memory an agent was allowed to read. | services/langfuse.ts | | VERCEL TOKEN , or other access to the Vercel project's environment | Every value above. The QA sandbox reads the token wherever it is set, and uses it with VERCEL TEAM ID and VERCEL PROJECT ID without them, on Vercel, it authenticates by OIDC ; a token with access to the project can read its environment. | services/agents/qa-sandbox.ts ; Vercel | Credentials that act as someone through the authorizer are not on this list, because check still decides what they can do: capability tokens, a Clerk session, and CLERK SECRET KEY which can sign in as any user . Revoking or narrowing those works as described above. Rotating one of the credentials in the table is the only way to cut off whoever holds it. npm run bypass-credentials:check scripts/check-bypass-credentials.mjs keeps this table honest: it fails when the code or .env.example reads a credential that is neither listed here nor recorded there with the reason it does not reach memory. - docs/self-host.md https://github.com/willderai/willder-core/blob/main/docs/self-host.md : every self-host step, tokens, revoking, export, refusals, no Docker. - mcp/README.md https://github.com/willderai/willder-core/blob/main/mcp/README.md : tools, permissions, the local stdio server. - docs/development.md https://github.com/willderai/willder-core/blob/main/docs/development.md : the web app and local development. - docs/willder api.md https://github.com/willderai/willder-core/blob/main/docs/willder api.md : the route map. - docs/architecture.md https://github.com/willderai/willder-core/blob/main/docs/architecture.md : the architecture, with diagrams and measured numbers. - docs/README.md https://github.com/willderai/willder-core/blob/main/docs/README.md : every document in this repository, one line each. CONTRIBUTING.md https://github.com/willderai/willder-core/blob/main/CONTRIBUTING.md covers tests, lint and what a PR needs. Report a vulnerability per SECURITY.md https://github.com/willderai/willder-core/blob/main/SECURITY.md , not in a public issue. MIT, see LICENSE https://github.com/willderai/willder-core/blob/main/LICENSE .