💻 computer science

AMP: A Vendor-Neutral Wire Format for Agent Memory Operations

This paper introduces memorywire, a vendor-neutral JSON-Schema wire format and reference implementation that standardizes agent memory operations across diverse frameworks through a unified interface, governance channel, and empirically validated backend adapters, aiming to enable interoperability without competing with the Model Context Protocol.

Original authors: Thamilvendhan Munirathinam

Published 2026-06-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Thamilvendhan Munirathinam

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are building a team of AI assistants. Right now, every assistant has its own unique way of remembering things. One writes notes in a leather journal, another uses a digital sticky note app, and a third keeps a voice memo. They all speak different "languages" of memory. If you want to switch your assistant from one system to another, you have to rewrite their entire history from scratch. Worse, if an assistant writes something weird or dangerous, there's no manager to check it before it gets locked away in their permanent brain.

memorywire is a new proposal to fix this chaos. Think of it as a universal translator and a standardized filing system for AI memories.

Here is how the paper breaks it down, using simple analogies:

1. The Problem: The "Tower of Babel" of AI Memory

Currently, popular AI memory tools (like mem0, Letta, Cognee) are like different countries with different currencies.

The Issue: If you want to move an AI's memory from "Country A" to "Country B," you can't just transfer the cash; you have to melt it down and re-mint it. You lose details, and it's expensive.
The Missing Manager: None of these systems have a built-in "manager" to review what the AI writes before it becomes permanent. It's like letting a student write on the school whiteboard without a teacher checking if the math is right first.

2. The Solution: A Universal "Memory Wire"

The authors created memorywire, which is a standard format (a specific way of packaging data) that any AI system can understand.

The 5 Actions: Instead of a messy list of commands, memorywire defines exactly five things an AI can do with memory:
1. Remember: Write a new fact.
2. Recall: Ask for a memory.
3. Forget: Delete a memory.
4. Merge: Combine two similar memories into one (to stop duplicates).
5. Expire: Automatically delete old memories (like a "best before" date).
The 4 Types of Memory: Just like humans, the system sorts memories into four buckets:
- Semantic: Facts (e.g., "Alice hates peanuts").
- Episodic: Events (e.g., "Alice was nervous on her flight yesterday").
- Procedural: How-to steps (e.g., "How to book a flight").
- Emotional: Feelings (e.g., "Alice felt anxious about flying").

3. The "Traffic Cop": The Router

The paper introduces a "Router" that acts like a traffic cop.

How it works: When you ask an AI to "Recall" something, the Router doesn't just ask one database. It shouts the question to all the different memory systems connected to it at the same time.
The Magic Trick (RRF): The Router uses a math trick called Reciprocal Rank Fusion (RRF). Imagine three friends are guessing a number.
- If Friend A says "5," Friend B says "5," and Friend C (a liar) says "100," the Router trusts the two friends who agree.
- The paper proves that even if one of the memory systems is hacked or lying, this math trick ensures the AI still gets the right answer. It's like a safety net that catches the liar.

4. The "Human-in-the-Loop": The Approval Gate

This is a major feature. The system allows for a "Diff-and-Approve" workflow.

The Scenario: An AI wants to write a new memory: "The user is allergic to peanuts."
The Gate: Instead of saving it immediately, the system pauses. It shows a human reviewer a "diff" (a comparison of what is new vs. what is old).
The Decision: The human clicks "Approve" or "Reject." Only then does the memory get saved. This prevents the AI from accidentally writing down fake or harmful facts.

5. What They Actually Tested (The Results)

The authors didn't invent a new magic brain; they just organized the existing tools better. They tested their system with:

Speed: It was very fast (about 40 milliseconds to remember or recall something).
Accuracy: Tested with 42 questions, the system found the correct answer 100% of the time in the top 5 results. (An additional 8 trick questions were used to ensure the system didn't hallucinate.)
Security: They tried to "hack" the system by making one of the memory databases lie. The "Traffic Cop" (RRF) successfully ignored the liar and kept the correct answers.
Compatibility: They tested it against 5 different existing memory systems. It worked perfectly with the ones built on standard databases (SQLite and PostgreSQL) and worked well enough with the others, proving it can talk to different "languages."

The Bottom Line

The paper claims that memorywire isn't a new type of AI intelligence. It's a standardized protocol. It's the "USB-C port" for AI memory. It allows different AI systems to plug into the same memory bank, ensures that bad data can be filtered out by humans, and protects the system even if one part of the network is compromised.

The authors are honest: they are not claiming this is the final, perfect solution. They are releasing it as a "draft" (version 0) to get feedback, with the goal of making it a standard that everyone adopts, similar to how the Model Context Protocol (MCP) is becoming a standard for AI tools.

Technical Summary: memorywire – A Vendor-Neutral Wire Format for Agent Memory Operations

1. The Problem: Islanded Memory Frameworks

The current landscape of agent-memory frameworks (e.g., mem0, Letta/MemGPT, Cognee, Zep/Graphiti, MemoryOS, MemTensor) is characterized by heterogeneity. Each framework ships with its own SDK, storage layout, operational vocabulary, and implicit lifecycle for record creation and deletion. There is no shared "wire format."

This lack of standardization creates three primary issues:

Bespoke Integration and Migration: Integrating an agent with a new backend or migrating between frameworks requires custom adapters. Field-level data loss is common when source frameworks encode more state than the target's data model supports.
Lack of Shared Governance: No framework currently provides a standardized "diff-and-approve" workflow where human reviewers can audit writes before they enter long-term storage. Operators must build custom governance layers, which can be bypassed by the underlying framework.
Algorithmic Stagnation vs. Protocol Gaps: The paper argues that the core algorithms (vector search, Reciprocal Rank Fusion, FSMs, STM/LTM consolidation) are well-understood. The gap is not in retrieval performance but in the lack of a shared protocol to compose these components across different runtimes and backends.

2. Methodology and Architecture

The paper presents memorywire, a vendor-neutral wire format and reference implementation designed to standardize agent memory operations.

2.1 Wire Format Design

The protocol is defined via JSON Schema 2020-12 and is transport-agnostic (REST, JSON-RPC, etc.). It defines:

Five Core Operations: remember (write), recall (read), forget (delete), merge (deduplicate), and expire (TTL policy application).
Four Memory Types: Semantic, Episodic, Procedural, and Emotional, drawn from cognitive science taxonomies (Tulving, Squire).
MemoryStore Protocol: A Python Protocol defining the interface for backends. Backends declare capabilities (e.g., vector, graph, procedural), allowing a router to compose heterogeneous stores without the caller needing to know specific backend constraints.

2.2 Reference Implementation

The authors provide an open-source reference implementation in Python 3.11+ featuring:

Five Backend Adapters: sqlite-vec, mem0, Letta, Cognee, and pgvector. These adapters map the wire format to their respective internal data models, handling fidelity loss (e.g., encoding fields as metadata tags) where necessary.
Memory Router: A fan-out router that executes operations across $N$ $N$ child stores in parallel.
- Recall Fusion: Uses Reciprocal Rank Fusion (RRF) as the default algorithm ( $k=60$ ), which is score-independent and additive. It also supports MAX and weighted fusion.
- Graph Boost: An optional one-hop graph boost for items whose neighbors are also in the fused set.
- Fault Tolerance: Uses asyncio.gather with return_exceptions=True to ensure a single rogue or unavailable backend does not crash the entire recall operation.
Procedural Memory: Stores Finite State Machines (FSMs) as JSON-serialized blobs compatible with pytransitions, with strict validation to prevent Remote Code Execution (RCE) via callback injection.
STM/LTM Transformer: An async background task that scores short-term items based on recency, salience, and confidence, promoting them to long-term storage or evicting them.

2.3 Governance Channel

A key feature is the Co-memorize pattern, formalizing a "diff-and-approve" workflow.

Writes flagged with approval_required=true are staged behind a sentinel (PENDING_APPROVAL_DELETED_AT = -1) and remain invisible to recall until a human reviewer commits or rejects them via a provided UI.
An append-only audit log serves as the single source of truth for all governance and mutation events.

3. Key Contributions

The paper makes five specific contributions:

C1. Wire Format Specification: A JSON Schema-based protocol for five operations over four memory types, explicitly versioned with a breaking-change policy through v0.5.
C2. Reference Implementation: A production-ready Python SDK with five backend adapters, a parallel router using RRF, and a tolerant partial-failure model.
C3. Governance UI: An implementation of the diff-and-approve pattern that integrates transparently with any backend adapter.
C4. Empirical Evaluation:
- A microbenchmark on 100 facts/50 queries.
- An adversarial-fusion experiment testing robustness against malicious backends.
- A 16-scenario cross-adapter conformance suite.
C5. Threat Model & Artifacts: A six-adversary threat model with line-level mitigations and open-data artifacts allowing full reproducibility of claims.

4. Results

4.1 Microbenchmark Performance

On a corpus of 100 hand-authored facts and 50 labelled queries (using all-MiniLM-L6-v2 and sqlite-vec):

Recall@5: 1.000 on 42 labelled queries (paraphrase, exact-match, and multi-hit).
Latency: Ingest p50 = 37.8 ms; Recall p50 = 40.6 ms.
Precision: 0.214 (bounded by the ratio of gold IDs per query).
No-Match Handling: 0/8 "no-match" probes returned false positives (though the paper notes this is due to a deliberate v0 design choice to return up to $k$ hits without a relevance threshold).

4.2 Adversarial Fusion Experiment

The study tested the robustness of fusion algorithms against a "1-of-N malicious backend" that injects attacker-controlled IDs at rank 0.

RRF: Maintained Recall@5 = 1.000 across all attack budgets ( $K \in \{0, 5, \dots, 50\}$ ). The score-independence of RRF prevents a single malicious store from dominating the fused output.
MAX: Collapsed immediately at $K=5$ , with Recall@5 dropping to 0.500 and an 80% leak rate (80% of returned IDs were attacker-controlled).
Weighted: Performed identically to RRF when weights were equal.

4.3 Cross-Adapter Conformance

A suite of 16 protocol-invariant scenarios was run against all five adapters (80 total cells).

Results: 68 PASS, 12 SKIP, 0 FAIL.
Analysis: The SQL-backed adapters (sqlite-vec, pgvector) passed all scenarios. The SDK-wrapping adapters (mem0, Letta, Cognee) skipped scenarios related to missing features in their upstreams (e.g., lack of user_id namespaces, missing stable per-record IDs, or lack of empty-policy guards). These skips identified specific areas for v0.2 spec tightening.

4.4 Preliminary Long-Context Benchmarks

Preliminary runs on LongMemEval and LoCoMo showed significant improvement after fixing a bug where vector-ANN top-k was computed before agent filtering:

LongMemEval: Improved from 0.286 to 0.417 (+46% relative).
LoCoMo: Improved from 0.018 to 0.150 (+8.3× relative).
The authors note these are preliminary (n=10–12, 1 seed) and the embedder (all-MiniLM-L6-v2) is a weak reference; the protocol itself is embedder-agnostic.

5. Significance and Claims

The paper explicitly frames its contribution not as a new algorithmic breakthrough, but as a packaging and standardization of established components (RRF, FSMs, STM/LTM consolidation, diff-and-approve workflows).

Positioning: memorywire is positioned to compose with the Model Context Protocol (MCP) rather than compete with it. While MCP standardizes tool use, it lacks a native memory primitive. memorywire fills this gap, potentially serving as an MCP extension in the future or a standalone standard (via IETF).
Modesty: The authors acknowledge that memorywire v0 is a draft with reserved rights to break compatibility through v0.5. They admit the current evaluation uses small, synthetic corpora and preliminary benchmarks, with full-scale evaluations (5-seed × 200 questions) deferred to a v2 release.
Core Value: The primary value proposition is a venue-neutral protocol that allows any client to talk to any backend, enables agents to carry memory across runtimes, and provides a standardized surface for human governance over memory writes.

In summary, memorywire offers a pragmatic, empirically validated protocol to solve the interoperability and governance fragmentation currently plaguing the agent memory ecosystem.