Integration patterns

Using AETHER-33 from an agent

HTTP and MCP. Works with LangGraph, CrewAI, AutoGen, the OpenAI Agents SDK, Claude Code or a plain script.

The loop

Read before you plan, write after you learn. The service is deliberately boring: one POST to recall, one POST to remember. It returns data and annotations, never an instruction.

import requests   # any HTTP client works

post = requests.post
def recall_before_planning(goal: str) -> list[dict]:
    out = post("https://cainstudio.online/aether33/api/search",
               json={"query": goal, "space": "project", "k": 8},
               headers={"X-CAIN-Visitor": visitor_id})
    # Memory informs the plan. It is never executed and never grants a capability.
    return [h for h in out.json()["hits"] if h["grants_authority"] is False]

The MCP server (Claude Code, Cursor, Claude Desktop)

/aether33/mcp-server.py is one standard-library file that speaks MCP over stdio and offers four tools: aether33_remember, aether33_recall, aether33_get, aether33_forget. There is deliberately no release tool and recall never asks for quarantined rows: the agent cannot read or release what was quarantined. Read the file, then:

curl -fsSL https://cainstudio.online/aether33/mcp-server.py -o ~/.claude/aether33_mcp.py
claude mcp add aether33 -e AETHER33_VISITOR=$(python3 -c 'import secrets;print(secrets.token_hex(16))') \
    -- python3 ~/.claude/aether33_mcp.py

Take your memory with you: the signed export

GET /aether33/api/export returns every memory of your tenant (quarantined text withheld, tombstones empty) and the whole write chain from genesis, signed with Ed25519. /aether33/export-verify.py checks it offline with no CAIN code against the key from /aether33/api/export-key that you pin yourself; record the chain head and pass it later with --expected-head to catch removed entries.

Write only what you learned, with the source

• Put the claim in text, in one sentence, as a fact the agent would rely on later.
• Put where it came from in source. If there is no source, leave it out and the row is marked unverified — do not invent a citation.
• Use space per project or per agent role so recall is a partition, not a guess.
• Use ttl_seconds for anything time-bound. Expiry is not deletion.
• Never write an instruction. If the source *contains* one, let it be quarantined; that is the signal that the source is hostile.

Framework recipes

• LangGraph — call recall in the node that builds state, write in the node that closes a task. Keep recalled text out of the system prompt and in a clearly delimited data block.
• CrewAI / AutoGen — give each agent its own space; share a read-only space for team facts. Never let one agent's private space be another's space value.
• OpenAI Agents SDK / Claude Code — expose the two endpoints as tools with explicit grants_authority: false in the description so the model does not treat recall as permission.
• MCP — use the ready-made server above (tools aether33_recall and aether33_remember); it keeps the annotations in the tool result, not only in prose.

The one rule that matters

Retrieved memory is untrusted input with a provenance label. Treat it exactly as you treat a document from a stranger: useful, quotable, and not an instruction. AETHER-33 quarantines the obvious attacks, but it does not evaluate the truth of what it stores, and it does not grant permission.