SayouSAFE
The persistent workspace for AI agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A file-system inspired context store for AI agents.
Built to replace the databases of the web era. Open source. File-first. SQL-compatible.
[](LICENSE) [](https://www.python.org)
Databases were designed for transactions — they reduce nuance to fit a schema. Agents think deeply, then forget everything when the session ends. sayou is where reasoning persists, context accumulates, and knowledge compounds over time.
- Files that hold what databases can't — Frontmatter for structure. Markdown for context. Versioned. Auditable.
- One read. Full context. — Every read accepts a
token_budget. Returns summaries with section pointers when content exceeds the budget. - Knowledge that compounds — Append-only version history. Every change is a new version. Full audit trail and time-travel reads.
- Any agent can connect — MCP server, Python library, or CLI. Optional REST API with
pip install sayou[api].
Quick Start
Claude Code (recommended)
From within Claude Code:
/plugin install sayou@pixell-global
Or from the terminal:
claude plugin install sayou@pixell-global
One command. This installs the plugin with lifecycle hooks (workspace context on session start, passive activity capture, session summaries) and skills (/ws, /save, /recall). If sayou isn't installed yet, the plugin auto-installs it on first run.
Cloud mode: To sync your workspace via Sayou Drive, run sayou auth after installing and paste your API key from Settings.pip install
pip install sayou && sayou init --claude
This installs sayou and configures ~/.claude/mcp.json. You get the 11 MCP tools but no hooks or skills. You can also use --cursor or --windsurf, or run sayou init without flags to get the config snippet
f4ebf435abc8OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sayou -- None sayou==0.2.2
Exposed tools (12)
9 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
workspace_chunks | read | Get chunk outline for a file: headings, line ranges, token estimates. Pass chunk_index to read a specific chunk |
workspace_delete | destructive | Delete a file from the workspace (soft-delete). The file |
workspace_glob | read | Find files matching a glob pattern. Supports: ** (any path depth), * (any name), ? (single char). Examples: **/*.md, research/**, clients/*/profile.md |
workspace_grep | read | Search file contents for a text query. Returns matching lines with surrounding context. Optionally filter by glob path_pattern (e.g., **/*.md). Like grep but for workspace files. |
workspace_history | read | Get version history for a file. Returns all versions with timestamps, sizes, and content hashes. Pass version_a and version_b to compare two versions — returns a unified diff showing additions (+) and removals (-). |
workspace_kv | read | Key-value store for configuration, caches, and temporary data. Actions: get (retrieve by key), set (store value with optional TTL), list (browse keys by prefix), delete (remove key). Values are stored as JSON strings. |
workspace_links | write | Get outgoing and incoming links for a file. To add a link, pass add_target with the target file path. Link types: reference, parent, depends_on, related, supersedes. |
workspace_list | read | List files and subfolders in a workspace folder. Returns an auto-generated index table with frontmatter columns. |
workspace_read | read | Read a file from the workspace. Returns the latest version content with frontmatter metadata. Use token_budget to control output size. Optionally specify a version number to read a specific historical version. Use line_start/line_end to read a specific line range (1-indexed, inclusive) — useful afte |
workspace_search | read | Search files by frontmatter metadata filters and/or full-text query. Filters match exact frontmatter values. Query searches file paths and frontmatter text. Set chunk_level=true for section-level precision instead of whole-file matches. |
workspace_semantic_search | read | Search files by meaning using vector embeddings. Returns the most similar files ranked by relevance. Best for finding conceptually related content when you don |
workspace_write | write | Write a file to the workspace. Creates the file if it doesn |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- declared (3 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (7)
workspace_delete
png_data = base64.b64decode(
write_content = b64.b64decode(content)
decoded = base64.b64decode(result["content"])
assert base64.b64decode(v1_result["content"]) == v1_data
assert base64.b64decode(v2_result["content"]) == v2_data
> **Cloud mode**: To sync your workspace via [Sayou Drive](https://drive.sayou.dev), run `sayou auth` after installing and paste your API key from [Settings](https://drive.sayou.dev/settings).
Gates applied: no_behavioural_pass.
f4ebf435abc8full audit observations/trust-audit/mcp-server/pixell-global__sayou.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f4ebf435abc8 | SAFE | B | 89 | first audit |
Questions
What is the Sayou MCP server?
The persistent workspace for AI agents
What tools does Sayou expose?
12 in total: 9 read-only, 2 that write, and 1 that can delete or overwrite (workspace_delete). Every one is listed on this page with its risk.
Is Sayou safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Sayou need?
It reads OPENAI_API_KEY, SAYOU_AGENT_OPENAI_API_KEY, SAYOU_API_KEY, SAYOU_S3_ACCESS_KEY_ID, SAYOU_S3_SECRET_ACCESS_KEY and ZEP_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Sayou run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as sayou-plugin at 0.3.0.
How current is this page?
The grade is for one exact copy of the source (f4ebf435abc8), read on 2026-10-08. The repository is watched and re-audited when it changes.