The third interoperability layer #
Section titled “The third interoperability layer” Agents can already call tools (MCP) and talk to each other (** A2A**). What they can’t do is carry memory across sessions, agents, and vendors. Every harness reinvents memory privately and non-portably. UMP fixes that.
In simple terms: you already have useful memories scattered across agent files, Claude/Codex project notes, Recall exports, Obsidian folders, Postgres, Redis, SQLite, and vector databases. UMP turns those into one portable memory shape and one small operation set, so new agents and new stores can extend the same memory instead of starting over.
Tools - MCP
Model Context Protocol standardized how agents call functions and read resources.
Coordination - A2A
Agent2Agent standardized how agents discover and invoke one another.
Memory - UMP
Universal Memory Protocol standardizes how agents remember - portable knowledge across sessions, agents, and vendors.
Implement it #
[Section titled “Implement it”](#implement-it)
Use the MCP server when you want agent memory immediately. Use the TypeScript SDK when you are building a memory-aware app or agent runtime. Use HTTP when the client is Python, Go, Swift, a browser, or anything else that can send JSON.
Why it’s shaped like this #
Section titled “Why it’s shaped like this” UMP is not a new transport protocol. It is an application-level memory protocol that rides existing transports. The lesson of MCP is *minimal primitives
- existing rails + great SDKs + neutral governance*.
Rides MCP
The primary binding is an MCP profile (ump.*
tools). Any MCP host - Claude Code, Codex - can use UMP today, with zero new transport.
Six operations
capabilities · recall · remember · revise · forget · get
(+ optional
feedback
/subscribe
). A conforming client is ~100 lines.
One portable record
Typed, scoped, bi-temporal, signed JSON. Reuses W3C PROV + DID - no new vocabulary.
Adopt incrementally
Four conformance levels. Ship an *.ump.json
export (L0) today; wire the full
runtime (L3) when ready.
Any store can serve it #
Section titled “Any store can serve it” UMP is a protocol surface, not a database bet. @universalmemoryprotocol/core ships practical implementations for local files, SQL databases, Redis, Recall, and vector engines so teams can adopt UMP where they already store memory.
Files first
JsonFileStore
writes portable memory.ump.json
; MarkdownDirectoryStore
writes human-editable *.ump.md
records for repos and Obsidian-style vaults.
SQL + cache
PostgresStore
, SqliteStore
, and RedisStore
accept your existing client. No native database driver is bundled into the core package.
Vector databases
VectorStore
plus QdrantStore
, PineconeStore
, and WeaviateStore
wrappers
let embedding-backed engines keep their own retrieval quality.
Recall engine adapter
Recall is one implementation: a richer memory engine behind the same UMP interface, not a dependency or lock-in.
Bring existing memory with you #
Section titled “Bring existing memory with you”
People already have memory scattered through AGENTS.md
, CLAUDE.md
, Recall exports, Obsidian notes, and project Markdown. UMP keeps those formats separate, but ships import bridges that turn them into portable UMP drafts with provenance.
Agent files
ump-import
reads AGENTS.md
(the open standard) and CLAUDE.md
as
procedural candidate memories, preserving the source path in provenance.
Vaults and folders
Point it at Markdown directories or Obsidian-style vaults to bootstrap a local UMP store without changing your notes.
Bridge, not lock-in
Importers are adoption helpers. UMP remains the common record and runtime interface after the data is translated.
What’s standardized - and what isn’t #
Section titled “What’s standardized - and what isn’t” UMP standardizes structure, provenance, access, and trust. It deliberately leaves intelligence - extraction, ranking, decay, consolidation - to the engine underneath, so implementations compete on quality while staying interoperable.
Bi-temporal, supersede-never-delete
Valid-time + transaction-time. A fact that changes is closed and linked to its successor - not overwritten. The credible answer to staleness.
User-owned & signed
The operator - not the model vendor - holds the key. Records are content-addressed and signed with a DID. Portable, verifiable, no lock-in.
Injection-resistant by mandate
Memory is attacker-controllable input. The spec requires a verify, filter, frame rehydration pipeline. Never string-interpolated into the prompt.
Consent in the record
Retention, exportability, and redaction travel with the data and are enforced at every boundary.
Read the specification →Record format, the six operations, three bindings, conformance levels, and the trust model.