Cogni

Overview

Cogni is an open-source memory backend for AI agents, launched September 30, 2026 (156 HN points) as a Mem0 alternative with explicit OWASP Agentic Top 10 v2.1 compliance built into the design. Unlike Mem0, which shipped memory-first and bolted on compliance, Cogni treats memory safety as a first-class concern from day one: every write is signed, every read can be filtered by writer identity, and OWASP category A08 (memory poisoning) is the primary mitigation target.

Cogni sits in the same architectural slot as Mem0, Zep, and agent-memory — a managed memory backend that agent frameworks call through an SDK. What differentiates it: an explicit "writer identity" concept (who wrote this memory?), signed writes (proving the writer), and a compliance layer that maps directly to OWASP v2.1 categories. In production deployments, this maps to the audit-log-plus-provenance pattern that regulators are starting to expect.

Cogni also ships an MCP server so existing MCP 2.2 agents can use memory without adding a new SDK dependency.

Features

• Writer identity — every memory has an associated agent identity; reads can filter by writer
• Signed writes — each memory write is cryptographically signed with the writer's key; tamper-evident
• OWASP A08 mitigation — memory poisoning detection at write time and read time
• Semantic search — vector-backed retrieval, compatible with pgvector, Qdrant, and Pinecone
• Hierarchical memory — session, task, user, and global memory tiers with separate TTLs
• Time-travel queries — query memory as of any past timestamp
• MCP 2.2 server — memory exposed as MCP tools for cross-framework use
• Framework adapters — LangGraph, CrewAI, OpenAI Agents SDK, PydanticAI, and AgentGuard
• Compliance reporting — SOC 2-aligned audit logs; memory access history by agent identity
• Multi-tenant — tenant-scoped memory with cross-tenant isolation
• Local-first option — can run against a local SQLite + sqlite-vec for fully on-prem deployments

Installation

# Python
pip install cogni

# Node.js
npm install @cogni/sdk

# Rust
cargo add cogni

Server (managed storage):

# Docker
docker pull cogni/server:latest
docker run -p 7788:7788 -e COGNI_POSTGRES_URL=postgresql://... cogni/server

# Or via npm
npm install -g @cogni/server

Quick Start

from cogni import Cogni

cogni = Cogni.from_env()  # reads COGNI_API_KEY

# Write a memory as agent A
cogni.write(
    text="User prefers Python over TypeScript for data work",
    agent_id="agent:planner-v1",
    tier="user",
)

# Read memories, filtered to writes by known agents
memories = cogni.query(
    "programming preferences",
    agent_id="agent:planner-v1",  # only memories written by this agent
    top_k=5,
)

Core Concepts

Writer Identity

Every memory in Cogni has an agent_id — the agent that wrote it. This is not optional and cannot be forged without the writer's key. Reads can filter by writer:

• Trust this agent's memories — query(agent_id="trusted-agent-1")
• Trust no one's memories — query(writer_verified=False) (returns unsigned memories with a warning)
• Trust no one, but show provenance — query(include_writer=True) includes the writer ID in every result

This maps directly to OWASP A08: memory poisoning requires an attacker to forge a writer identity, which requires a key compromise.

Signed Writes

Every write is signed with the writer agent's private key. The signature is stored with the memory and verified on every read. Unsigned writes are rejected by default; the rejection rate is surfaced as a metric.

Hierarchical Memory Tiers

Cogni has four built-in tiers, each with different TTL and retrieval semantics:

• session — short-lived, cleared at session end; default TTL 1 hour
• task — scoped to a single task; cleared when the task completes
• user — scoped to a user, persists across sessions; default TTL 30 days
• global — organizational memory shared across all agents and users

Tiers are explicit; agents must specify which tier they're writing to, and the SDK enforces that writers can only access tiers they have permission for.

OWASP Mapping

Cogni maps directly to the OWASP Agentic AI Top 10 v2.1 categories:

• A08 Memory Poisoning — writer identity + signed writes
• A04 Data Leakage — tenant isolation; memory access logged
• A05 Privacy Violations — PII detection at write time, redaction option
• A07 Agent Privilege Escalation — per-agent memory ACLs

Advanced Features

• Writer provenance graphs — visualize the agent-authorship graph across a knowledge base
• Memory replay — reconstruct a knowledge base as of any past timestamp for forensics
• Cross-agent consensus — a memory becomes "consensus" when signed by N agents, boosting its retrieval priority
• Vector + relational hybrid — memories carry both a vector embedding and structured metadata for filtered search
• Time-decay relevance — memories decay in retrieval weight over time unless boosted by access
• Bulk import — migrate from Mem0, Zep, or raw vector databases with format converters

MCP Configuration

{
  "mcpServers": {
    "cogni": {
      "command": "cogni-mcp",
      "args": ["--url", "cogni://localhost:7788"],
      "env": {
        "COGNI_API_KEY": "***"
      }
    }
  }
}

Exposed tools: cogni:write, cogni:query, cogni:forget, cogni:list_writers.

Examples

Building a multi-agent research pipeline with signed memory:

planner = Cogni.from_env().client(agent_id="agent:planner-v1")
researcher = Cogni.from_env().client(agent_id="agent:researcher-v1")

planner.write("Focus on European markets", tier="task")

researcher.write("EU AI Act Article 6 is the key clause", tier="task")

# Planner retrieves only what the researcher wrote (no poisoning risk)
results = planner.query("key regulatory clauses", writer_agent_ids=["agent:researcher-v1"])

Trust-tiered retrieval:

memories = cogni.query(
    "pricing strategy",
    trust_levels=["signed_verified", "signed_unverified"],
    top_k=10,
)
# Results tagged with their trust level
for m in memories:
    print(f"[{m.trust}] {m.text}")

Pros

• First memory backend with explicit OWASP A08 mitigation as the primary design goal
• Writer identity is a real feature, not an audit-log afterthought
• Signed writes are tamper-evident
• MCP 2.2 native for cross-framework use
• Framework adapters for every major agent framework
• Compliance reporting built in for SOC 2

Cons

• Smaller community than Mem0 or Zep
• Signed writes add a small latency cost (~2–5 ms per write)
• Writer identity model requires agents to have keys, which some teams don't yet have
• Newer backend with less provenance at scale

When to Use

• Production agents in regulated industries
• Multi-agent systems where memory poisoning is a real risk
• Teams that need SOC 2 or ISO 27001 compliance evidence
• Migrating from Mem0 or Zep with compliance requirements

Resources

• Website: https://cogni.dev
• GitHub: https://github.com/cogni-labs/cogni
• Docs: https://cogni.dev/docs