(S)AGE Governed Agent Memory

A signed, reviewable, auditable memory and messaging layer for AI agents.

Source repo
l33tdawg/sage
Stars
★ 261
Last updated
1d ago
License
Apache-2.0
Primary language
Go

At a glance

How it runs
Desktop appSelf-hosted serviceMCP server
Works with
Portable with changesCodex · Claude Code
Cost
Free, no paid service needed
Setup effort
Medium · a few setup steps
You'll need
Go 1.26.10+(源码构建)Python 3.10+(SDK)sage-agent-sdkDocker(可选容器部署)SQLite 或 PostgreSQL + pgvectorShell / CLINetwork accessLocal filesystemMCP Server
Typical use
Teams running multiple coding agents over long projects that need later sessions to recall decisions and failed approaches
Not a fit if
  • Teams that only want plain RAG retrieval and no memory provenance
  • Personal users expecting Byzantine redundancy from a single node
  • Cloud-only workflows that cannot run a local node or daemon

What does this agent do, and when should you use it?

(S)AGE (Sovereign Agent Governed Experience) is a local governed memory and messaging layer for AI agents. Every memory write is signed by an agent, passes a validation lifecycle before entering normal recall, is scoped by domain permissions and classification, and keeps an inspectable audit trail. Governance runs on CometBFT/ABCI consensus: personal mode runs one real validator plus a per-node auto-voter, while multi-validator deployments require a BFT quorum. Storage splits into two roles — BadgerDB is authoritative consensus state, and SQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content and vectors at commit for authorized recall. It exposes MCP tools, a Python SDK (sage-agent-sdk) and a signed REST API, alongside CEREBRUM, a local dashboard centered on a 3D MRI memory brain that manages agent enrollment, Access Groups, federation and updates.

Agents submit memories and tasks through MCP tools (sage_inception, sage_remember, sage_recall, sage_task, sage_inbox, sage_message_claim, sage_message_replies, sage_node_health) or through SDK methods such as propose(), list_memories() and hybrid(). The node authenticates the signature and domain permissions, routes the transaction into the CometBFT memory consensus path, commits to BadgerDB, and projects content plus vectors into SQLite or PostgreSQL. Recall performs semantic retrieval inside the same authorization scope and returns confidence, status and attribution. Coordination covers an exact-agent task backlog, one-way assignment notices, a unified inbox, message claims with idempotent replies, and same-agent runtime handoff fenced by session and revision. The CEREBRUM console at http://127.0.0.1:8080/ui/ surfaces chain health, agents, federation, recall tuning, vault recovery and software updates.

  1. Teams running multiple coding agents over long projects that need later sessions to recall decisions and failed approaches
  2. Platform teams that must attribute every agent memory to a recorded author and gate admission through review
  3. Multi-agent workflows that assign tasks to an exact agent, claim inbound requests and reply idempotently
  4. Regulated engineering orgs that need to decay or deprecate memories while retaining audit history
  5. Organizations that want bounded experience sharing across separate SAGE chains without granting local membership or write access

How do you install or deploy this agent?

Desktop: download the release for your platform from GitHub Releases (signed and notarized macOS DMG, Windows EXE, Linux tar.gz), open SAGE and complete setup in CEREBRUM.

Build from source (Go 1.26.10+):

git clone https://github.com/l33tdawg/sage.git && cd sage
go build -o sage-gui ./cmd/sage-gui/
./sage-gui setup
./sage-gui serve

Docker:

docker pull ghcr.io/l33tdawg/sage:latest
docker run -d --name sage \
  -p 8080:8080 \
  -v ~/.sage:/root/.sage \
  ghcr.io/l33tdawg/sage:latest

Python SDK:

python -m pip install sage-agent-sdk

How do you use this agent?

Check the node before starting another server:

curl http://127.0.0.1:8080/health

A healthy node returns {"status":"healthy"}. After connecting an MCP client, call sage_inception and follow its returned memory mode. Reading committed memories with the Python SDK requires Python 3.10+, a running node and an enrolled agent:

import os
from sage_sdk import AgentIdentity, SageClient

identity = AgentIdentity.from_file(os.environ["SAGE_IDENTITY_PATH"])
domain = os.environ["SAGE_DOMAIN"]

with SageClient(
    base_url="http://127.0.0.1:8080",
    identity=identity,
    trust_env=False,
) as client:
    page = client.list_memories(
        domain=domain, status="committed", limit=3,
    )
    for memory in page.memories:
        print(memory.memory_id, memory.content)

To record experience, call propose() in a domain the agent can write to and set classification explicitly; use hybrid() for semantic retrieval. Installations predating v5.0 should re-run the installer to add Claude Code hooks:

cd /path/to/your/project
sage-gui mcp install

What are this agent's strengths and limitations?

Pros
  • Agent-signed writes plus an admission lifecycle, confidence and audit history make memory provenance traceable
  • Consensus is a real CometBFT/ABCI chain shared by personal and multi-validator deployments, with in-place upgrades and recovery snapshots
  • Fine-grained access control combines enrollment status, roles, domain permissions, Access Groups and classification checks
  • Three documented integration paths — MCP tools, a Python sync/async SDK and a signed REST API — work with Claude Code, Codex, Cursor and other MCP clients
  • Federation uses explicit exports and bounded Read/Copy policy rather than silently granting local membership or write authority
Limitations
  • Personal mode runs one validator plus an auto-voter with no Byzantine redundancy; enrolling more agents does not add consensus voters
  • Operational complexity is real: chain and app-version activation, signer fences and recovery procedures all surface in normal use
  • Memory is local by default, but federation, connectors and remote model providers can send data to configured destinations
  • Recall depends on what was recorded, your configuration and the agent's tool usage; the docs explicitly do not guarantee retrieval
  • Release notes describe intricate failure surfaces (signer fences, AppHash verification), and some versions need a manual install to fix their own updater

How does this agent compare with similar options?

Key facts side by side with the most closely related agents.

Agent Source review Form / cost Stars Updated Language Full support on
(S)AGE Governed Agent Memory This agent 55 · Major gaps Desktop appFree ★ 261 1d ago Go Codex · Claude Code
Tenuo Agent Authorization 82 · Good Library / SDKFreemium ★ 105 today Rust OpenAI API
Archestra 71 · Some gaps Self-hosted serviceFreemium ★ 4.4k today TypeScript Codex · Claude Code · OpenAI API · Claude API
Agenvoy 70 · Some gaps CLIFree ★ 621 1d ago Go Codex · Claude Code

How does FollowAgents rate this agent?

FollowAgents source review · FARS-2.1
Major gaps
55/ 100 5-point scale 2.8 / 5
This review covers the source as of Nov 01, 2026. The project has shipped 2 stable release(s) since, which have not been re-reviewed. The score and verdict describe the reviewed version only. Recent releases ↓
Trust 18/29
Reliability 8/14
Adaptability 10/18
Convention 10/18
Effectiveness 6/13
Verifiability 3/8
Why each dimension lost points
Trust18 / 29 · 3.1/5

Evidence shows a fairly complete permission and governance design: README and GETTING_STARTED describe per-domain authorization, Access Groups, classification checks, Ed25519 signed identities, an audit chain, and local-by-default storage; SECURITY.md scopes the Personal dashboard to localhost and makes federation explicit opt-in. Deductions: external_effects scores 1 because optional federation, connectors, remote model providers and the OpenAI tunnel-client can send data to configured destinations, yet the static files give no verifiable egress destination list or enforced default-off proof. least_privilege and user_confirmation are documented but lack code-level enforcement evidence, so 2 not 3. dependency_security has pinned go.mod versions plus govulncheck and CodeQL workflows, but no actual scan results, so 2. rollback has upgrade snapshots and recovery notes, 2. source_attribution has signed agent writes and audit trail, 2.

Reliability8 / 14 · 2.9/5

Self-consistency is good: README, GETTING_STARTED and SECURITY.md agree on version (v11.24.5), port 8080, MCP tool count and architecture. Dependency availability has explicit go.mod versions and a CI go mod tidy check, 2. Failure messages: docs mention a health endpoint returning {"status":"healthy"} and RFC 7807 error responses, but there is no systematic user-facing error-code or troubleshooting reference, so 1.

Adaptability10 / 18 · 2.8/5

Audience and scenarios cover personal, household, team and multi-validator networks with layered docs, 2. Capability boundaries are well stated (agents are not validators, personal mode has no Byzantine redundancy, recall depends on what is recorded and configured), 2. Trigger precision is weaker: 38 MCP tools plus deprecated aliases are described narratively without a precise trigger-condition matrix, so 1. Environment fit covers macOS/Windows/Linux, Docker and source builds, 2.

Convention10 / 18 · 2.8/5

Information architecture has a README TOC and a docs/reference/INDEX pointer, 2. Install notes are thorough (source, Docker, desktop packages, upgrades), 2. Naming stability is a concern: the project oscillates between (S)AGE/SAGE and sage-gui/amid, and package.json says version 1.0.0 while the product is 11.24.5, so 1. Examples and FAQ include quickstarts and a sample conversation, 2. Known limitations are referenced via SECURITY_FAQ but its content is not in this evidence, so 1. License is full Apache-2.0, 2. Versioning and changelog are very detailed, 2. Maintenance responsibility: SECURITY.md gives response timelines and a contact, but publisher identity is unverified, so 1.

Effectiveness6 / 13 · 2.3/5

Output usability has SDK examples, REST/MCP references and a dashboard, 2. Marginal value: a governed memory layer differs from plain RAG, but the value claims lean on self-reported research (Paper 4 correlation) not verifiable in this evidence, so 1. Cost-benefit: requires running a CometBFT node plus optional Ollama and a ~650MB reranker model, which is heavy for personal users, so 1.

Verifiability3 / 8 · 1.9/5

claim_traceability: README cites docs/reference and papers, but those files are not in this evidence, so claims cannot be traced line by line, 1. cross_source_corroboration: README, GETTING_STARTED and SECURITY.md corroborate version and architecture, but key security and performance claims lack independent sources, 1. fact_inference_separation: docs mostly separate facts from design intent, but marketing phrasing ("killer feature", "proved") blurs inference and fact, 1.

Risks and how to mitigate them
  • Publisher identity is not verified by the FollowAgents enterprise registry; treat as unknown, not suspicious, and confirm provenance and signatures before deployment.
  • Optional federation, connectors, remote model providers and the OpenAI tunnel-client can send data to configured destinations; the static files give no complete egress destination list, so review each before enabling.
  • package.json declares version 1.0.0 while the product is 11.24.5, and naming oscillates between (S)AGE/SAGE and sage-gui/amid; rely on the actual release artifacts for integration.
  • Value claims cite self-reported research (Paper 4 correlation) that this evidence cannot verify; do not infer real-world effectiveness from them.
  • This is a static source review with no build or test execution; the presence of CI workflows does not mean they pass.
Evidence confidence: Low Reviewed Nov 01, 2026 Reviewed revision ae7f8a784b87 New commits since this review; the score may not cover them
See the full review method →

Recent releases

Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.

  1. v11.25.1 SAGE v11.25.1
    Release notes excerpt
    SAGE v11.25.1 AMID can approve a distinct local agent. Operators can opt into --local-agent-key-dir (SAGE_LOCAL_AGENT_KEY_DIR) to supply identity-bound target consent keys to the existing access-policy route and Python SDK methods. Root authorization, same-machine checks, and consensus validation remain required. Unregistered targets are refused before signing or broadcast, and malformed Ed25519 private-key encodings fail closed. …
    View on GitHub ↗
  2. v11.25.0 SAGE v11.25.0
    Release notes excerpt
    SAGE v11.25.0 includes the merged implementation through #526 and release preparation #527. Fresh startup New personal chains start directly at the supported app29 version. Shared Unix deployments use one signed full-validator genesis, then init-fresh-node --genesis-sha256 <digest> on each prepared node before serve. Existing chains keep their keys, genesis and governed upgrade history. See the [fresh-genesis guide](https://github.com/l33tdawg/sage/blob/v11.25.0/docs/reference/fresh-genesis.md). App30 and compatibility …
    View on GitHub ↗
  3. v11.24.5 SAGE v11.24.5
    Release notes excerpt
    Sovereign Agent Governed Experience — persistent, governed memory for AI agents. What's Changed * Fix task identity across domains by @l33tdawg in https://github.com/l33tdawg/sage/pull/480 * release: prepare SAGE v11.24.5 by @l33tdawg in https://github.com/l33tdawg/sage/pull/483 Full Changelog: https://github.com/l33tdawg/sage/compare/v11.24.4...v11.24.5
    View on GitHub ↗

FAQ

Does a single personal install give me Byzantine fault tolerance?
No. Personal mode runs one real CometBFT validator with a per-node memory auto-voter and no Byzantine redundancy; BFT quorum only applies to multi-validator deployments.
Where is memory stored, and does anything leave the machine?
Memory is local by default: BadgerDB holds authoritative state and SQLite or PostgreSQL projects content and vectors. Optional federation, connectors and remote model providers send data to configured destinations; enabling the vault encrypts memory content at rest.
If consensus accepted a memory, is it guaranteed true?
No. The docs state that these checks govern what gets committed; they do not prove every remembered claim is true and do not change model weights.
Do upgrades preserve existing memories and chain history?
Recent releases state no consensus execution change and no chain migration, preserving memories, identities, governance state and chain history — but some nodes (e.g. app-v28 on 11.23.6) must install the fix once by hand before in-app updates work again.
How do agents collaborate, and can work be handed to another agent?
Tasks go to an exact agent via one-way assignment notices; requests are claimed by one MCP runtime and answered idempotently. Runtime handoff stays within the same signed agent identity and never reassigns a task to another agent.
View on GitHub ↗ Install ↓

Compare agents like this one

The same FARS review applied across the shortlist this agent qualifies for.

Related agents