intuition-lab-persomeCAUTION
Build your HUMAN.md.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Auto-playing preview · Full-quality demo and v0.3.2 release notes
Build your HUMAN.md — one evidence-linked Personal Model for Claude Code, Codex, Cursor Agent, and other trusted MCP clients.
Personal Model is an open-source, local-first long-term memory Runtime. It learns how you think and work from focused activity captured on your Mac after you grant macOS permission, then gives your AI tools inspectable context to continue work and make grounded decisions.
Runs locally on your Mac. Private by default. Yours to inspect, correct, export, and delete.
[](https://github.com/Intuition-Lab/personal-model/actions/workflows/ci.yml) [](https://github.com/Intuition-Lab/personal-model/releases) [](https://github.com/Intuition-Lab/personal-model) [](LICENSE) [](#1-install-with-your-data) [](MCP.md) [
19 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
attention_trajectory | read | Where the user |
behavior_patterns | read | **CALL FIRST for |
correct_memory | write | Update the user |
current_context | read | **ALWAYS CALL** for present-tense or ambiguous-pronoun questions about the user |
entity_graph | read | **CALL for |
get_model_snapshot | read | Return a bounded projection of the versioned Personal Model. |
get_pending_model_work | read | Return pending semantic session counts without invoking any model. |
get_schema | read | Return the memory organization spec (file naming, what each prefix means). |
list_memories | read | **ALWAYS CALL FIRST** on the first personal-context turn of a conversation. |
process_pending_model_work | read | Process pending Personal Model sessions using this MCP client |
query_health_metrics | read | Query owner-authorized wearable and health observations. |
read_memory | read | Read the full contents of ONE memory file the user has on disk. |
read_receipt | read | Dereference ONE memory receipt — the `⟨entry_id:path⟩` handles that |
read_recent_capture | read | Hydrate ONE raw screen capture — the actual visible_text, focused |
recent_activity | read | **ALWAYS CALL** when the user references yesterday, last week, earlier, or recently. |
related_events | read | **CALL for |
remember | write | Write a durable finding back into Persome memory so later agents |
resolve_evidence | read | Resolve one receipt or model object id through Persome |
search | read | **ALWAYS CALL** before saying |
search_captures | read | **ALWAYS CALL** (usually in parallel with `search`) when the user mentions a keyword they |
verify_fact | read | **CALL BEFORE STATING time-sensitive facts as current** — freshness check |
Trust audit
CAUTIONgrade C · trust 74/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
shrink_ceiling: float = 0.5 # summary must be < Σsource_len × this
"mentoring": ("🧑🏫", "Mentoring"),secret = "zzzzhistoricsnapshotcapturesecretzzzz"
secret = "zzzzlatersnapshotsecretzzzz"
.all-contributorsrc
return hashlib.sha1(_norm_sig(fact_body).encode()).hexdigest()[:16]
face_id = f"face-{hashlib.sha1((_norm_sig(signature) + now).encode()).hexdigest()[:12]}"face_id = f"root-{hashlib.sha1((now + signature).encode()).hexdigest()[:12]}"source_id = "correction:" + hashlib.sha1(signal.encode()).hexdigest()[:16] # noqa: S324
EVENT_PREFIX + hashlib.sha1(title.encode("utf-8")).hexdigest()[:12] # noqa: S324} from "../../resources/model_assets/evidence.mjs";
} from "../../resources/model_assets/explore.mjs";
} from "../../resources/model_assets/layout.mjs";
} from "../../resources/model_assets/palette.mjs";
new URL("../../resources/model_assets/viewer.css", import.meta.url),3. Expected results, got a 500 from http://127.0.0.1:8742/mcp
- Streamable HTTP at http://127.0.0.1:8742/mcp
open http://127.0.0.1:8742/model
if curl --fail --silent http://127.0.0.1:18743/health >/dev/null; then
curl --fail --silent http://127.0.0.1:18743/health >/dev/null
return base64.b64decode(b64)
raw = base64.b64decode(raw, validate=True)
raw = base64.b64decode(payload)
key = bytes.fromhex(raw)
blob = base64.b64decode(body, validate=True)
Gates applied: no_behavioural_pass.
73d978ee217efull audit observations/trust-audit/mcp-server/intuition-lab__personal-model.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 73d978ee217e | CAUTION | C | 74 | first audit |
Questions
What is the intuition-lab-persome MCP server?
Build your HUMAN.md.
What tools does intuition-lab-persome expose?
21 in total: 19 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is intuition-lab-persome safe to connect to an agent?
With care. The audit graded it C (74/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does intuition-lab-persome need?
It reads A_KEY, B_KEY, C_KEY, DEEPSEEK_API_KEY, OK_KEY, OPENAI_API_KEY, PERSOME_BRIDGE_KEY, PERSOME_LLM_API_KEY, PERSOME_LOCAL_API_TOKEN and SAFE_OWNER_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does intuition-lab-persome run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as persome-companion at 0.3.2.
How current is this page?
The grade is for one exact copy of the source (73d978ee217e), read on 2026-10-11. The repository is watched and re-audited when it changes.