v0.1.0

A single-runtime MCP server for a KùzuDB graph memory bank. Components, decisions, rules, context, files and tags, isolated by repository and branch — with a Cognitive Fabric layer on top: in-process tree-sitter AST ingestion, optional LanceDB semantic search, and a "dream" engine that distills episodic memory into the semantic graph. There is no Arrow Flight sidecar and no network data-plane port; the tree-sitter, embedding and LLM work all run in-process. Derived from and extends the Apache-2.0 KuzuMem-MCP project (see NOTICE).

pip install cognitive-fabric

13 MCP tools. Console scripts: cognitive-fabric (CLI) and cognitive-fabric-server.

Requires Python 3.11–3.13; CI runs the suite on all three, on Linux. Python 3.14 is excluded deliberately: kuzu 0.11.3 — the final release, and the version this package pins — ships no 3.14 wheels for macOS or Windows, so on those platforms pip would try to build Kùzu's C++ from source.

Extras — cognitive-fabric[semantic] (LanceDB + fastembed local embeddings, pure ONNX, no torch), cognitive-fabric[vectordb] (LanceDB alone, for an injected embedder), cognitive-fabric[semantic-st] (sentence-transformers, needs torch; no CI job installs it, so it is the one embedding backend with no test behind it), cognitive-fabric[cloud] (OpenAI and Anthropic SDKs, for the dream engine and memory optimizer), cognitive-fabric[dev].

Kùzu. kuzu is pinned ==0.11.3 exactly. Kùzu is archived upstream — 0.11.3 is the final release — and its on-disk format is not stable before 1.0. Treat the pin as a migration boundary, not a floor.

Known limits.

• The security posture is documented in docs/SECURITY.md: the graph, vector store, AST ingestion and dream engine all run in-process against paths you configure. The default stdio transport opens no socket. --transport http is opt-in and binds loopback only (--host is rejected unless it is a loopback address or localhost); it rejects any request whose Host or Origin is not one of this machine's own names, which blocks DNS-rebinding attacks from web pages. The HTTP transport has no authentication; put an authenticated reverse proxy in front if you need it.
• No temperature is sent. There is no setting in this package for one, so no request here carries a sampling value.
• Semantic search needs the [semantic] extra. Without it, it reports itself unavailable rather than raising, so a caller can degrade.
• The dream engine and memory optimizer need the [cloud] extra and an API key; without them they report the missing SDK rather than raising an ImportError.
• lancedb is capped below 0.26.