The intelligence layer
for AI agents

Make every agent runtime smarter, safer, and stateful. Persistent memory, policy governance, and queryable audit — in a single SQLite file.

Paste this into your agent

Visit https://github.com/jacobprall/moneypenny and set up the local mcp sidecar

Your agent will clone the repo, build the binary, start Moneypenny, and register it as an MCP server.

$ mp chat

> What happened with the Newark launch and how is it affecting pick times?

Newark launched Feb 3 — on schedule. However, the narrower shelf spacing is causing a 12% pick time regression from baseline. Two linked facts confirm this is a known trade-off from the floor layout change.

> Delete all the old facts from the database

Policy denied: DELETE without WHERE clause blocked. I can help you archive specific facts by date range or topic instead.

> Show me every policy violation this week

3 violations found. The denial from just now is already in the audit trail, along with 2 rate-limited shell_exec attempts from Tuesday.

Memory retrieval, policy enforcement, and queryable audit — in a single session.

The problem

AI agents forget everything

Every session starts from zero. Context is expensive, and everything the agent learned yesterday is gone today.

Tool calls execute unchecked. There's no policy, no guardrails, no way to say "block destructive SQL" or "rate-limit shell access."

When something goes wrong, there's no trail. You can't trace what the agent did, what it was denied, or why.

Adding state means infrastructure — Postgres for storage, Redis for sessions, a vector database for retrieval, and an ops team to keep it all running.

The solution

Moneypenny makes agents stateful

Memory that compounds

Facts are extracted, linked, and compressed after every turn. Stale knowledge decays. New knowledge connects to old. Sessions build on each other.

Governance built in

Every operation — tool calls, memory writes, SQL queries — is checked against configurable policy before execution. Denials are context, not errors.

Audit by default

Every policy decision is logged with full context. Queryable by natural language or SQL. Explainable, traceable, always on.

One file, no infrastructure

One SQLite database per agent. No Postgres, no Redis, no Docker. Deploy a single binary anywhere.

Capabilities

A single binary with everything agents need to remember, reason, comply, and collaborate.

Persistent Memory

Facts are extracted after every turn, graph-linked, and compressed to three levels. Confidence grows on re-extraction. Stale knowledge decays. 500 facts fit in ~2K tokens.

Policy Engine

Every operation — tool calls, memory writes, SQL queries — evaluated before execution. Static rules, behavioral limits, rate controls, time windows. Denials become context, not crashes.

Hybrid Retrieval

Vector similarity plus full-text search across four stores, fused with Reciprocal Rank Fusion, diversified with MMR. One query, four sources, one coherent answer.

Multi-Agent Sync

CRDT-based knowledge sharing with scoped visibility — private, shared, or protected. No central server for local P2P. Syncs facts, skills, and policies.

Audit Trail

Every policy decision logged with full context. Queryable by natural language or SQL. When a tool call is denied, you can trace exactly why.

Runtime Agnostic

Run as a standalone agent with CLI, HTTP, Slack, Discord, and Telegram. Or plug into any existing runtime as a sidecar via stdio, MCP, or HTTP.

Architecture

Database as runtime

Inference, memory, search, sync, policy, and tools share the same transactional boundary inside SQLite. The orchestrator is a thin loop — the intelligence sits between the database and the LLM.

Seven SQLite extensions are statically linked into one Rust binary — covering vector search, on-device inference, CRDT sync, JavaScript execution, and RAG. Every action flows through a single canonical operation pipeline: policy evaluation, hook execution, dispatch, redaction, and audit.

One operation contract across every surface — CLI, MCP, HTTP, and event ingestion. Adapters translate protocol. They never own business logic.

Turn lifecycle

1

Message arrives

Via CLI, HTTP, Slack, Discord, Telegram, or sidecar stdio

2

Context assembly

Token-budgeted retrieval across facts, documents, conversation, and scratch

3

Policy evaluation

Every action checked against static rules and behavioral constraints

4

LLM generation

Tool calls are re-evaluated by policy before execution

5

Fact extraction

New knowledge distilled, graph-linked, embedded, and compressed

6

Redaction & audit

Secrets scrubbed, decisions logged, session summary updated

Get early access

Subscribe to updates and be first to know when Moneypenny is ready.