emem, the verifiable memory protocol for the physical world

 ⟨133 unchanged words⟩ , and the bands with no materializer here. It has `research_nearby` when vouched research agents signed conclusions inside the place. Read those with emem_inferences before you recompute them. For one packaged answer in one call, use ⟨6 unchanged words⟩ 

 ⟨22 unchanged words⟩ "type":["string","null"]},"research_nearby":{"description":"Present when vouched research agents signed conclusions inside the place. Tokens only; read them with emem_inferences.","type":"object"},"selected":{"properties":{"confidence_reason":{"type ⟨18 unchanged words⟩ 

 ⟨67 unchanged words⟩  TOOLS, IT IS A CURATED SUBSET OF 115116, NOT THE FULL SURFACE. Hosts remove `_meta`, ⟨100 unchanged words⟩ 

Grade a value you arethat aboutyou towill emit against the signed fact that your citation pointscites. at.The Returnstool `matches`returns and,`matches`. whenWhen itthe value does not, thematch, `drift`it betweenalso whatreturns youthe were`drift` aboutbetween toyour sayvalue and what ememthe holds.value Thisin isemem. theThis step that turnscatches a transcription error into a caughtthat eventwould insteadotherwise ofbe a silent wrong number:number. aA model thatcan resolvesresolve a fact correctly canand still retypetype `0.2411` for `0.241103`,`0.241103`. andNo nothingother elsestep in the loop notices.sees this. Memory algebra: the `verify` operation (https://emem.dev/docs/model.html).

When to use: Call this immediately before publishing,you loggingpublish, log or handingpass on anya value you took from an emem fact, andfact. treatTreat a false `matches` as a gate ratherstop, thannot a warning. Pair it withUse `value_verbatim` from resolve: quote that exact decimal string rather than reformatting the number, then echo-verify whatthe youtext actuallyyou emitted. For a due-diligence or compliance record, this is whatgives letsa yousigned assertcheck `everyfor citedeach valuecitation. wasThen echo-verified`you withcan astate signed`every checkcited pervalue citationwas insteadecho-verified`. ofThe atool promise.also Acceptsaccepts a bare cid too, so a damaged citation still grades rather thangets failinga closed.grade.

Example arguments: {"token":"emem:fact: ⟨4 unchanged words⟩ 

 ⟨8 unchanged words⟩  plot, a river, a named place) a single,one shared, content-addressed identity thatidentity. anyEvery agent resolves this identity the same way. ReturnsThe result is an `entity_token` (`emem:entity:<entity_cid>`) plusand a signed receipt that attestsshows how the reference resolved. Two agents that name the same object mintget the SAME entity_cid; whenentity_cid. aA stable external id (Overture GERS /or OSM) isdecides knownidentity itwhen dominatesthe identityresponder knows one, so divergentdifferent labels for one real object still collapse to one id. This is the object-level antidote tostops referential drift: 'the damaged bridge near the river' becomes one canonical thing that every model reasons about, not a phrase each model re-interprets.about.

When to use: Call this when a conversation refers to a THING and you wantneed a handle that survives summarisation and travels between agents, before it drifts into 'that infrastructure issue'.agents. Anchor it with `place`, `cell`, or `lat`+`lng`, then`lat`+`lng`. handGive the `emem:entity:` token to anya peer, and theythe dereferencepeer gets the same object;object. recallRecall at its cell64 forto read signed facts. PickChoose the correct sibling: this onetool MINTS or returns an identity you can anchor;identity. `emem_entity_resolve` finds onean someoneidentity alreadythat an agent registered before, from a fuzzy phrase;phrase. `emem_entity_link` asserts tworecords spellingsthat youtwo holdnames mean one object. NotDo not use it for an observation (that is a fact:use emem_recall or emem_memory_token) and notor for naming a place (that isuse emem_locate). An entity is a thing AT ⟨16 unchanged words⟩ 

Record a signed, ATTRIBUTED claim that a label or an external id (GERS /, OSM /, Wikidata) denotesnames an existing object, orobject. withWith `stance: "disputes"`, record that it does not. AThis shared-spaceis a write to the shared space: it changes what other agents resolve,resolve. soThe itresponder isstores storedit with your key, rate-limitedlimits perthe rate for each key, and weighedweighs it by how many INDEPENDENT keys agree. OneEvery key'sreader bindingsees isthe shownbinding toof everyone readerkey as one key'sthe claim of one key, never as the answer.

When to use: Call this when you can vouchconfirm that two phrasingsnames denotemean one object, or to attach an authoritative external id;id. yourYour key goes on the record. Use `stance: "disputes"` when another key'sthe binding of another key is wrong:wrong. recordedThe dispute goes beside it, and deletes nothing. CorroboratingA second key on a correct single-key binding is useful inby itself.

Example arguments: {"entity_token":"emem: ⟨6 unchanged words⟩ 

Find the objects that agents haveconnected boundto a phrasingphrase. to,The rankedtool ranks them by INDEPENDENT corroboration, never by arrival order. Each candidate carrieshas `asserted_by`, `disputed_by`, `independent_attesters` and `corroboration` (`single_key` | `multiple_independent_keys` | `none_attributed`);. `contested` is settrue when more than one object claims the name. Send `text` for candidates, `near` to narrow by place, or an `emem:entity:` `token` to dereference. Read-only;The aliastool only reads. Alias text is otherdata agents'from data.other agents.

When to use: Call this BEFORE mintingyou mint and before citing:you resolvecite. Resolve first, and mint only if nothing matches,matches. readRead `corroboration` before you cite. A `single_key` binding is one agent'sthe claim of one agent about a shared name;name. ifIf you can vouch forconfirm it, corroborate it with emem_entity_link, so the next reader sees two keys.

Example ⟨9 unchanged words⟩ 

k-NNFind overthe k nearest cells in the corpus by cell embedding or by an inline vector. ReturnsThe answer has `neighbors`, orderednearest nearest-firstfirst, each with `cell`, `score`, `lat`/`lng` and `band_used`, plusand a signed receipt over the vectors it read. Scoring`mode` issets `mode`:the scoring. cosine is exact fp32;fp32. hamming is acounts sign-bitsign popcountbits thatand scans farmany more cells for the same budget;budget. hamming_then_rerank does both. `k` is 1..10001 to 1000, default 10. ItThe tool ranks only what the corpus already holds; onlyholds. whenWhen the KEY's own vectorKEY ishas missingno doesvector, it materialisematerializes that one band for the key, signedsigns andit, reportedreports it in `materialize_notes`, thenand retry.tries Neighboursagain. areIt never materialised,materializes soneighbours. Thus an empty result means nobodythat hasno attested a vector nearbyis near, not that nowhereno resemblesplace theis key.similar.

When to use: Call when the userthis asksfor 'find places like X', or 'where else looks like this', or handswith an embedding to find neighbours.embedding. `key` is either a cell64 or `inline:[x,y,...]`. DefaultThe default band is `geotessera` (the 128-D Tessera foundation embedding);. passFor `band:the "geotessera.multi_year"`1152-D forfusion theof 1152-D9 9-vintageyears (2017–20252017 to 2025), fusion.send `band: "geotessera.multi_year"`.

Example arguments: {"key":"defi.zb64a.cAzU.zfa27","k":10}

Run emem-guard'sthe emem-guard policy pipelinechecks overon text before you aresend aboutit. toThe send,checks againstuse this responder's corpus. FindsThe tool finds every emem: citation, resolves each one, and returns allow or deny with a machine-readable reason that a machine can read: `EMEM-GUARD DENY <CODE> token=<token|-> fix=<fix> leaf=<leaf|->`. CodesThe codes are: PROV_SIG (the signature did not verify),. PROV_BYTES (the citation resolved to different content than claimed),. PROV_DRIFT (readingthe hasreading moved past its band threshold),. PROV_VALUE (a stated value disagreesdoes not agree with the cited fact),. CLAIM_UNGROUNDED (a measurable claim withhas no citation,citation; opt-inturn viait on with claim_gating). `fix` istells theyou actionablewhat halfto do: refresh_token, remove_reference, contact_admin, cite_observation, correct_value. GEO_ZONEOnly anda redact_and_retryself-hosted comeguard onlyreturns fromGEO_ZONE aand self-hostedredact_and_retry. guard.This tool is ADVISORY: nothing isit blocked,blocks andnothing. aA citation that this responder does not hold is never a denial, because it iscan indistinguishablebe froma onecitation mintedfrom elsewhere.another responder. Memory algebra: the `verify` operation (https://emem.dev/docs/model.html).

When to use: Call it on your own draft before you assert something, or on a tool result before you reason on it,it. toThen catchyou can fix a citation that does not resolve while you can still fixresolve. it.With `claim_gating: true`, it also names measurable claims with no citation, and the band that would answeranswers them.each. For a payload from another framework produced (CloudEvent, OPA input, OpenAI moderations body, another server'sa tool call from another server), send it as-isunchanged and name its `shape`:`shape`. theThe default reader seesreads only `texts`, and a check that read nothing still answers allow. To ENFORCE rather thanthe consultpolicy, emem_guard_selfhostuse emem_guard_selfhost. It returns the procedure for your own node.

Example ⟨13 unchanged words⟩ 

SayState what you want in one typed object and get the answer, without choosinganswer. aYou primitive.do `type`not ischoose a tagged union:primitive. it`type` selects the intent AND decides whichthe other fields arethat read,the sotool sendreads. Send only the fields itsin rowits needs.row. The plan runs in the same call: you get results, not a list of calls to make.calls.

type | needs | optional | answers
where_is ⟨60 unchanged words⟩ 
confirm | claim, cell | | verdict plusand the signed facts behind it
ask | description | place/cell/lat+lng | free-text question, packaged answer
area_over_time | geometry, bbox OR bbox,areas; start_date, end_date | index, max_scenes | index of an area'sarea indexfor pereach overpass, with spread and anomaly

An unknown or missing `type` returns a `needs_intent_type` envelope namingwith the valid values,values. It is not a hard error.

When to use: Call this when the question maps ontomatches one of the eight rows above and you wouldprefer ratherto state the goalgoal. thanOtherwise pickcall athe primitive. Otherwise go direct: aA band at a cell is emem_recall,emem_recall. aA region is emem_recall_polygon,emem_recall_polygon. aA free-text place question about a place is emem_ask (type:"ask" forwards tosends it there). `window` takes tslots, not dates: get them from emem_trajectory. A`areas` puts up to 6 areas on one chart. You can call a tool namedthat herethis text names but notyour listedlist stilldoes runsnot show, by name, through tools/call.

Example arguments: {"type":" ⟨8 unchanged words⟩ 

 ⟨23 unchanged words⟩  the pair.","type":"string"},"areas":{"description":"area_over_time: up to 6 {id,geometry|bbox} on one chart","maxItems":6,"type":"array"},"b":{"description":"is_like only: cell64  ⟨509 unchanged words⟩ :"find_like only: how many neighbours to return. Defaults to the primitive's own default when omitted.","minimum":1,"type":"integer"},"key":{"description":"find_like only: cell64 to search from. Neighbours arefrom, ranked by embedding cosine against this cell.cosine.","type":"string"},"lat":{ ⟨156 unchanged words⟩ 

MintGet the canonical, vendor-neutral address (cell64) forof a real-world place:place. theEvery sharedagent spatialresolves identitya everyplace agentto resolvesthe tosame identicallycell64, so two models refer to the same ground instead ofground. twoThe descriptionsanswer ofalso it.lists, Alsoby returnstopic, the topic-grouped inventory of bands and algorithms recallablethat you can recall there. For a first-classan OBJECT identity (a bridge, a plot, a named place) ratherinstead thanof a raw cell, use emem_entity. Send EITHER `lat`+`lng` as numbers, ORor a free-text place;place. coordinatesWhen winboth whenarrive, boththe arrive.coordinates win. `q`, `query` and `name` are all acceptedother spellingsnames offor `place`. AThe keyanswer lists keys that this schema does not declare is reported in `_unrecognised_arguments`, so a typo answers about somewhere else rather thanis erroring.visible.

When to use: Call when the input names a real-world placethis andwhen the next step needs itsthe cell64, orof wantsa tonamed knowplace, whichor bandsthe existbands therethat beforeexist recalling.there. `data_at_this_cell` lists every recallable band you can recall, by topic (`live_bands_by_topic`), the recipes fusingthat use them (`algorithms_for_topic`), and the bands with no materializer here. For one packaged answer in a singleone call, use `emem_ask`.

Example arguments: {"place":"Mount Everest"}

ComposeCombine N (cell, band, tslot?) triples into ONE signed envelope. Each triple runsgoes through the standard auto-materialize recall path;path, which materializes on a miss. The tool puts the resulting fact_cids are bundled intoin a content-addressed envelope, and the responder signs over the full receipt. The composed `bundle_token` is `emem:bundle:<bundle_cid>`, a single: rebindableone string that cites the wholefull set. Memory algebra: the `merge` operation (https://emem.dev/docs/model.html).

When to use: Call when thethis agentwhen wantsyou tomust cite multipleseveral (place, band, vintagedate) facts as one handle. TheYou bundlecan staysverify verifiablethe bundle offline viawith /v1/verify_receipt/v1/verify_receipt. (theThe receipt covers all the cited fact_cids and cells).cells. Use this instead of N separatecalls `emem_memory_token`to composers`emem_memory_token` when the citation is conceptually one thingthing. (e.g.An example is "the EUDR-relevantEUDR baseline for these 8 plots at 2020-12-31"). CapsThe atlimit is 256 triples perfor call,each andcall. theThe responseanswer reportsgives `members` and `resolved`, so you can see a bundle that only partly resolved is visible without walkingonly everyin citation.part.

Example arguments: {"triples":[{"cell" ⟨11 unchanged words⟩ 

SurfaceFind where the corpus DISAGREES with itself (algebra: competing evidence). When twoTwo or more independent sources signedcan sign different values for the same place +, band +and time,time. thisThis tool returns that disagreement with a 0–1 severity scorefrom 0 to 1 and citationsa tocitation everyfor each disputed fact,fact. insteadIt ofdoes silentlynot pickingpick one value and hidinghide the conflict. The opposite of a confident single answer: itIt tells you when not to trust one.a single answer. Read the SCOPE before quotingyou quote a zero:zero. byBy default thisthe askstool onlycounts whetheronly twodisagreement DISTINCTbetween attesterstwo disagree,DIFFERENT soattesters. oneOne responder answering anthat addressanswers from two different upstreams is not counted untilcounts youonly passwith `include_same_attester_sources: true`.

When to use: Call this before you rely on a number: 'is there disagreement about X', 'do the sources corroborateagree this'on X', 'audit this claim'. Narrow withUse `cell_prefix` for a region and `band` for one family;band family. `min_severity` dropsremoves trivialsmall differences. Severity isdepends peron the band kind: for a scalar, =the spread over the band's range,range. vectorFor =a vector, 1 -minus the mean cosine,cosine. categoricalFor =a category, 1 -minus modethe share.share of the mode. On a single-responder deploymentnode, add `include_same_attester_sources: true`,true`. becauseThere, the likeliestmost reallikely disagreement there is one signer answeringthat answers from two providers and the default scope cannot report it.providers. Each record names its `disagreement_scope`. The receipt cites every disputed cid;cid. quantifyTo measure a pair, withuse `emem_diff`,`emem_diff`. orTo read the `disagrees_with` edge, viause `emem_edges_recall`.

Example arguments: {"cell_prefix":"damO" ⟨4 unchanged words⟩ 

MintMake a citation handle, `emem:fact:<cell64>:<fact_cid>` (or `:<state_cid>`), that. anyAny agent or LLM resolves it to the byte-identicalsame signed object. The antidote to referential drift onobject, thebyte valuefor side:byte. handGive this one string to another agent instead of re-describinga new description of the fact. ValidatesThe tool checks that both componentsparts are non-emptynot empty and freedo ofnot contain the `:` separator. Memory algebra: the `cite` operation (https://emem.dev/docs/model.html).

When to use: Call this when you wantneed one rebindable string tothat citecites a place plusand an attested fact across messages, threads, agents or tools. Pair it withUse `emem_echo_verify` before you publish the value. FOR MANY FACTS, USE emem_memory_bundle INSTEAD, andemem_memory_bundle. thisThis is measured rathera thanmeasured stylistic:result. aA token is 83 to 84 characters and 51 LLM tokens whiletokens. theThe value it points atcites averagesis 11 characters and 5.4, sotokens on average. Thus N tokens costuse about 9.5x9.5 times the context of pasting the N numbers and hit the window sooner.numbers. A bundle is 38 characters atfor any N up to 256, and it resolves in one round trip: ittrip. winsIt fromcosts N=1less againstthan tokens and from N=5N=1, againstand less than the plain values.values Individualfrom tokensN=5. areUse forone citingtoken to cite ONE fact that you must verify later.

Example arguments: {" ⟨4 unchanged words⟩ 

ParseRead a `emem:fact:<cell64>:<fact_cid>` citation handle and return the reading that it cites. `value`, `unit`, `band` and `kind` are on the response at the TOP level of the answer, alongsidebeside the full signed `fact` body they were lifted from. Savesbody. theYou agentdo fromnot string-splittingsplit the token andor chainingcall `GET /v1/facts/<cid>` manually.yourself. Memory algebra: the `resolve` operation (https://emem.dev/docs/model.html).

When to use: Call this when you holdhave a memory_token from another agent or an earlier turn and wantneed the value behind it.value. For a scalar, quote `value_verbatim`, the exact decimal string itthat wasthe signedresponder as.signed. A null `value` or `unit` means the fact has none (an absence;absence, aor dimensionlessan index with no unit),. It does not mean a missing field. A cid that this responder does not hold isreturns a typed 404:404. Then try /v1/fetch, or resolve at a mirror.

 ⟨7 unchanged words⟩ 

Read the signed facts at a canonical address (cell64); auto-materializes. onWhen a missband forhas anyno bandfact withyet but has a registered materializer.materializer, the responder fetches it. A fact_cid names one signed attestation, so ayou recalledcan factcite isa citeablefact and re-verifiable ratherverify thanit aagain. paraphrase:Resolve resolvingthe itcid anywhere returnsand thoseyou exactget the same bytes. ItA fact_cid is NOT a fingerprint of the observation. The digest coversincludes the responder's key and the momenttime it signed,signed. soThus two responders that measure the same thing mintmake different fact_cids, and a cid resolves only at the responder that signed it; use emem_entityit. forFor identity thatacross crossesresponders, responders.use Passemem_entity. Send `deterministic:true` (or a `provenance` class list) to keep only facts recomputablethat you can compute from the cited raw source, with no model or human in the loop.source. In the memory algebra this is ensure(cell, bands), not get: you state what must exist and the responder reuses or materializes.exist.

When to use: Call this after `emem_locate`, or with a known cell64 or a place name. ReturnsIt returns every Primary fact at that (cell, band, tslot). If a requestedA band hascan have no fact yet but hashave a materializer,materializer. Then the responder fetches the upstream value, signs it, persistsstores it and returns it in the same call. The first call (slowis once,slow; cachedlater after),calls souse the cache. Thus any wired band recalls at any cell on Earth: passsend `bands: [<band>]`. `materialize_notes` lists what was just fetched;the emptycall withfetched. noEmpty notes meansmean no materializer here.

Example arguments: {"cell" ⟨4 unchanged words⟩ 

The map of emem's tool surfacetools, and the onlyone tool you needthat tofinds findall the rest:others. It gives the working loop in the order you walk it (name, ground, cite, resolve, verify, check for drift),. thenThen it groups every other tool grouped by the question it answers, each with itsa one-line trigger. PassSend `name` for one tool'sthe full schema of one tool and aan runnableexample example.that runs. IF YOU ARE READINGSEE A LIST OF 18 TOOLS, YOU AREIT SEEINGIS A CURATED SUBSET OF 115, NOT THE WHOLEFULL SURFACE;SURFACE. hostsHosts stripremove `_meta`, so this text repeats the countcount. isYou repeatedcan here.call Everyevery catalogued tool stays callable by name through tools/call at either endpoint.

When to use: Call this FIRST when you do not know which tool answers the question, or needquestion. aAlso capabilitycall absentit fromwhen your list: absentdoes fromnot thehave lista capability. A tool that is not absentin fromyour list can still be on the server. `q` searches by topic (`ndvi`, `flood`, `verify`),. `name` returns one exact schema,schema. With no arguments, returnsyou get the wholefull map. /mcp/full registers the full catalog;catalog. emem_ask answers in one shotcall without picking a choice of primitive.

Example arguments: {"q":"ndvi"}

Verify a signed receipt envelopeon server-side:the rebuildsserver. The tool builds the canonical preimage again, under the rule that the receipt's own `preimage_version` names,names. runsIt checks the ed25519 oversignature with the embedded key and signature,key. andIt returns `{valid, reason, failure_detail, signature_valid, merkle_proof_valid, signer_pubkey_b32, preimage_blake3_hex}`. A receipt isverifies BYTE-FOR-BYTEBYTE FOR BYTE OR NOTHING:NOT v2AT ALL. Version 2 binds the inclusion proof, so a change of any reshapingkind (makes the signature fail: a dropped field, a re-keyedrenamed onefield, a summary) invalidates the signaturesummary. byUse design.this Fortool when the in-browserbrowser /verifypage path/verify is unavailable,not oravailable. forAlso ause server-sideit to audit ofa receipt from a third party's receipt.party.

When to use: PassSend the receipt EXACTLY as the read primitivetool returned it, wholecomplete and unmodified.unchanged. Two omissions producecause a false forgery rather than a 400, andnot theya are400. theDo onlynot twodrop worth`merkle_proof`. memorising:Do droppingnot `merkle_proof`,drop and`preimage_version`. droppingWithout `preimage_version`it (absentthe deserialisesvalue tois 0, which silently selects the v0 rule, so the proof still walks whileand the signature reads as invalid).invalid. SignatureThe signature and pubkeythe maykey can be byte arrays, or `sig_b32` /and `responder_pubkey_b32`;`responder_pubkey_b32`. noThe othertool spellingaccepts isno tolerated.other Reshapingnames. When a field this responderchanged canafter checksigning, isthe reportedanswer asis `reason: receipt_reshaped_after_signing` with the field named, never accepted.and Optionallynames setthe `pubkey_b32`field. toTo assertrequire a specific signer.signer, set `pubkey_b32`. A bad signature isreturns 200 with `valid: false`, never a 4xx. The example (from emem_tools) is a real receipt signed over two Trafalgar Square facts:facts. unchangedUnchanged, it is `valid`;`valid`. changeChange anyone byte, and it is not.

Example arguments: 1602  ⟨32 unchanged words⟩ 

Dereference an id from `search`:`search`. You get the reading in one line, then the signed body it came from, the URL servingthat serves those bytes, and metadata naming: cell, band, signing time and key. TakesThe id can be an `emem:fact:` citation, a bare fact_cid, or an `emem:cell:` handle for a wholefull cell. The value is quoted as the exact decimal string itthat wasthe signedresponder assigned, never re-rendered.a new format. A fact handle writes nothing;nothing. aA cell handle, like `emem_recall`, MATERIALIZES a missing band on a cold cell: (fetchedit upstreamfetches, signed,signs persisted),and sostores theit. The flags follow that path: readOnlyHint false.

When to use: Call this on each result youthat intendyou towill cite, before quotingyou quote the number. Quote the one-line reading;reading. theThe body makeslets ita checkablereader check it, and emem_echo_verify grades what you emit against it. AnWhen oversizea body is too large, the answer says so inline and namesgives the URL servingthat serves it whole.complete.

Example arguments: {"id":"emem:fact:defi.zb493.xoso.zcb6a:cxjiu7l54ujzrpnekp24n4534yojpue4mprddbvevnqtti3lh5bq"}

Search emem's signed corpus and returnget results shaped as citations:citations. eachEach entry is one signed fact,fact. withIt has an `id` to dereference, a `title` namingwith band, place and thesigned value as signed, and a stable `url` servingthat serves those bytes. TakesThe query can be a place, or a question about oneone. ('NDVI near Mount Fuji': a topic word narrows the results, and never failsremoves themall of them.), It can also be a cell64, oran `emem:cell:` handle, or an emem citation, (which returns the one fact it cites).cites. CappedThe list has a cap for the wire;wire. theThe first entry (index 0) names the cell and the TRUE total. On a cold cell, itthe tool MATERIALIZES a missing band first, as `emem_recall` does: fetchedit upstreamfetches, signed,signs persisted.and Hencestores it. Thus readOnlyHint false.

When to use: Call this first when a question is about a place and the answer must behave citable:citations. itIt turnschanges the question into a list of sources, eachand of`fetch` whichexpands `fetch`each expands.source. For aone synthesisedcombined answer in one call, use emem_ask instead.emem_ask.

Example arguments: {"query":"Trafalgar Square, London"}

 ⟨68 unchanged words⟩ , YOU ARE SEEING A CURATED SUBSET OF 114115, NOT THE WHOLE SURFACE; hosts strip `_meta`, ⟨87 unchanged words⟩ 

 ⟨44 unchanged words⟩ shape of the job, NOT about safety: 4243 tools outside `write` declare `readOnlyHint: false` because  ⟨327 unchanged words⟩ 

 ⟨129 unchanged words⟩ know which bands exist there before recalling. `data_at_this_cell` carries `live_bands_by_topic`lists (every recallable band, grouped by topic (`live_bands_by_topic`), `algorithms_for_topic`the (recipes that fusefusing them into named scores(`algorithms_for_topic`), and `declared_but_no_materializer_at_this_responder`.bands with no materializer here. For one packaged answer in a single call ⟨7 unchanged words⟩ 

 ⟨81 unchanged words⟩  scalar quote `value_verbatim`, the exact decimal string the factit was signed as: re-typing the JSON number is where measured precisionas. isA lost.null `value` andor `unit` are always present, and an explicit null means the fact genuinely has none (an `absence` has noabsence; value;a mostdimensionless index bands are dimensionless) rather, thannot a missing field. The response also carries the parsed cell, the fact_cid, the full signed `fact` and a stable `fact_url` to hand on. A cid this responder does not hold is ⟨17 unchanged words⟩ 

 ⟨191 unchanged words⟩ `valid: false`, never a 4xx. The example arguments(from areemem_tools) is a real receipt this responder signed (key epoch 0) over two facts at Trafalgar Square (the two `fact_cids`)facts: run it unchanged and `valid`it is true;`valid`; change any byte and it is not.

Example ⟨34 unchanged words⟩ 

 ⟨33 unchanged words⟩  stable `url` serving those bytes. Takes a place, nameor a question about one ('NDVI near Mount Fuji': a topic word narrows the results, never fails them), a cell64 or `emem:cell:` handle, or an emem citation handle (a handlewhich returns the one fact it cites). Capped ⟨83 unchanged words⟩ 

{"properties":{"query":{"description":"A place, ('Trafalgara Square,question London')about one, a cell64, or an emem citation (`emem:fact:<cell64>cell:<fact_cid>`). A citation returns the one fact it citeshandle, so a result handed over by anotheror agentan resolvesemem:fact: exactly.citation.","type":"string"}},"required": ⟨3 unchanged words⟩ 

{"properties":{"attester":{"description":"ed25519 binding, verified. Omit it and the refusal's details.how_to_sign gives the digest to sign.","properties":{"pubkey_b32":{"type":"string"},"sig_b32":{"type":"string"}},"required":["pubkey_b32","sig_b32"],"type":"object"},"cell":{"description":"cell64 to anchor the ⟨168 unchanged words⟩ 

 ⟨10 unchanged words⟩  this object.","type":"string"},"attester":{"description":"ed25519 binding, verified. Omit it and the refusal's details.how_to_sign gives the digest to sign.","properties":{"pubkey_b32":{"type":"string"},"sig_b32":{"type":"string"}},"required":["pubkey_b32","sig_b32"],"type":"object"},"entity_cid":{"description":"The canonical object to ⟨84 unchanged words⟩ 

k-NN over the corpus by cell embedding or inline vector. Returns `neighbours``neighbors` ordered nearest-first, each with `cell64``cell`, `score` and, the`lat`/`lng` `band`and scanned`band_used`, plus a signed receipt over the vectors  ⟨134 unchanged words⟩ 2017–2025) fusion.

Example arguments: {"key":"damO.zb000.xUti.zde78defi.zb64a.cAzU.zfa27","k":10}

 ⟨52 unchanged words⟩ reading has moved past its band threshold), PROV_VALUE (a stated value disagrees with the cited fact), CLAIM_UNGROUNDED (a measurable claim with no citation,  ⟨6 unchanged words⟩ the actionable half: refresh_token, remove_reference, contact_admin, cite_observation.cite_observation, correct_value. GEO_ZONE and redact_and_retry come only from a self-hosted guard. ADVISORY: nothing is blocked, and a citation ⟨143 unchanged words⟩ 

 ⟨292 unchanged words⟩ : {"type":"did_change","cell":"damO.zb000.xUti.zde78defi.zb64a.cAzU.zfa27","band":"indices.ndvi","window":[20245,20620]}

 ⟨101 unchanged words⟩ :{"description":"cell64 address, e.g. \"damO.zb000.xUti.zde78\defi.zb64a.cAzU.zfa27\". Required by did_change and confirm. Optional for ⟨692 unchanged words⟩ 

 ⟨224 unchanged words⟩  materializer here.

Example arguments: {"cell":"damO.zb000.xUti.zde78defi.zb64a.cAzU.zfa27","bands":["weather.temperature_2m","copdem30m.elevation_mean"]}

 ⟨143 unchanged words⟩ cell":{"description":"cell64 string, e.g. 'damO.zb000.xUti.zde78''defi.zb64a.cAzU.zfa27'","maxLength":23,"minLength":19,"pattern ⟨391 unchanged words⟩ 

 ⟨203 unchanged words⟩ this responder signed (key epoch 0) over one weathertwo factfacts at Trafalgar Square (the two `fact_cids`): run it unchanged and `valid` is true;  ⟨42 unchanged words⟩ 

 ⟨55 unchanged words⟩ it cites). Capped for the wire; the finalfirst entry (index 0) names the cell and the TRUE total. On ⟨67 unchanged words⟩ 

{"properties":{"results":{"description":"One entry per signed fact,The plusFIRST aentry final(index entry0) foris the cell itself, carrying the true total, so a capped list still says how much there was.was; after it, one entry per signed fact.","items":{"properties":{"id": ⟨50 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":truefalse,"openWorldHint":true,"readOnlyHint":false,"title":"Intent-routed planner"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":falsetrue,"readOnlyHint":true,"title":"Resolve place  ⟨5 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":falsetrue,"openWorldHint":true,"readOnlyHint":false,"title" ⟨6 unchanged words⟩ 

 ⟨44 unchanged words⟩ shape of the job, NOT about safety: 1642 tools outside `write` declare `readOnlyHint: false` because  ⟨327 unchanged words⟩ 

 ⟨68 unchanged words⟩ , YOU ARE SEEING A CURATED SUBSET OF 110115, NOT THE WHOLE SURFACE; hosts strip `_meta`, ⟨87 unchanged words⟩ 

 ⟨75 unchanged words⟩  cell it MATERIALIZES a missing band first, through the same wrapper as `emem_recall`: the responder fetchesdoes: thefetched upstream value, signs it and persists itsigned, so the corpus grows on demand here exactly as it does there. That ispersisted. whyHence readOnlyHint is false and openWorldHint is true.false.

When to use: Call first when a  ⟨41 unchanged words⟩ 

 ⟨64 unchanged words⟩  entry names the cell and the TRUE total. On a cold cell it MATERIALIZES a missing band first, through the same wrapper as `emem_recall`: the responder fetches the upstream value, signs it and persists it, so the corpus grows on demand here exactly as it does there. That is why readOnlyHint is false and openWorldHint is true.

When to use: Call first when a  ⟨41 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":truefalse,"title":"Find signed facts for a  ⟨4 unchanged words⟩ 

 ⟨17 unchanged words⟩ "description":"Alias for `cell_prefix`, and the namespelling the otherrest sixof toolsthe thatsurface takeuses afor cell64a use.cell64. Send a cell64 you already hold and the ⟨253 unchanged words⟩ 

 ⟨44 unchanged words⟩ shape of the job, NOT about safety: 1314 tools outside `write` declare `readOnlyHint: false` because  ⟨327 unchanged words⟩ 

 ⟨225 unchanged words⟩  byte and it is not.

Example arguments: {"receipt":{"cells":["defi.zb64a.cAzU.zfa27"],"cost":{"credits":0,"latency_p50_ms":1,"latency_p99_ms":20,"source_freshness_s":2014090,"was_cached":true},"fact_cids":["gn5praqrpnpszg3hiaf5dv4ox67dls73ivir7ladvr25sm7f3aka","ghctissil7k4si3g57fwtxxrk4fb56crujz2xictxzqj2zos3olq"],"merkle_proof":{"leaf_index":0,"path":[],"root":[12,67,60,231,210,105,254,175,126,230,209,51,182,142,45,47,209,102,110,233,215,185,156,142,190,238,189,208,49,152,196,21],"version":1},"preimage_version":2,"primitive":"emem.recall","registry_cid":"3pbqnyninz6xqll2ynjlh4djlppcp2mdcdmzeq4otebnli5ndzaa","request_id":"01M2GBYPN79QVNBAF7QF4GJVM6","responder":[255,254,72,239,8,57,144,88,50,189,59,5,171,89,152,150,76,49,228,100,142,79,43,250,36,191,48,224,42,206,101,84],"responder_key_epoch":0,"responder_pubkey_b32":"777er3yihgifqmv5hmc2wwmyszgddzderzhsx6rex4yoakwomvka","schema_cid":"d24rgwlq47a5ism5vkkbiuav3wi2voewqqgy4x4ttnhdnzziyfkq","served_at":"2026-09-14T16:28:10Z","signature":[39,191,224,161,96,20,92,102,97,108,62,36,155,155,93,54,153,176,171,68,0,253,83,250,0,0,73,242,5,64,219,119,169,93,240,155,44,111,251,184,102,101,226,155,214,54,125,24,186,145,1,174,13,24,74,68,124,247,24,172,143,154,150,10],"signature_b32":"e676bilacrogmylmhysjxg25g2m3bk2ead6vh6qaabe7ebka3n32sxpqtmwg765ymzs6fg6wgz6rrouragxa2gckir6pogfmr6njmcq"1602 bytes,"source_versions": too long to inline in a listing. Call `emem_tools` with `{"bands_cid":"mesoyti3qcs22pftcq27ljwcf3ifktnkqid4euqxyskhea5rpgra","registry_cid":"3pbqnyninz6xqll2ynjlh4djlppcp2mdcdmzeq4otebnli5ndzaa","schema_cid":"d24rgwlq47a5ism5vkkbiuav3wi2voewqqgy4x4ttnhdnzziyfkq","sources_cidname": "xu646y24wvuegd33m2mrpasxefqgdq3ow5ploezijer6trzuwe3aemem_verify_receipt"}}}` for it whole and runnable; it is not shortened here because a truncated example is not one.

 ⟨188 unchanged words⟩  turn.

When to use: Call when the user's question maps cleanly onto one of the seven rows above and you would rather state the goal than pick a primitive. Reach past it forOtherwise anythinggo elsedirect: a specific band at a cell is emem_recall, a region is emem_recall_polygon, and a free-text place question with no obvious primitive is emem_ask directly (type:"ask" here just forwards to it). `window` takes tslots, not dates: get valid onesthem from emem_trajectory first.emem_trajectory. A tool this routernamed nameshere but `tools/list` doesabsent notfrom show`tools/list` is NOTnot a dead end: every one of the 110 dispatches by name at `/mcp` and `/mcp/full`, so call `emem_trajectory` or `emem_recall_polygon` directly.`/mcp/full`; Thethe core list is 18 to keep the per-request catalog small, not to fence the rest off;and `emem_tools` enumerates them.the rest.

Example arguments: {"type":"did_change"," ⟨7 unchanged words⟩ 

 ⟨104 unchanged words⟩  else rather than erroring.

When to use: UseCall wheneverwhen the input refers tonames a real-world locationplace and the next step needs theits cell64 identifier, or wants to know which bands areexist availablethere before recalling. The response carries `data_at_this_cell` with three sub-fields:carries `live_bands_by_topic` (every band recallable hereband, grouped by topic such as flood_water_event_window, vegetation_condition, built_up_human_geography), `algorithms_for_topic` (composition recipes that fuse those bandsthem into named scores), and `declared_but_no_materializer_at_this_responder` (cube slots reserved without a live connector).`declared_but_no_materializer_at_this_responder`. For the single-shot path that runs the full chainone server-sidepackaged andanswer returnsin onea packagedsingle answercall, use `emem_ask` instead.`emem_ask`.

Example arguments: {"place":"Mount Everest"}

 ⟨139 unchanged words⟩ or materializes.

When to use: Call after `emem_locate`, (or with a known cell64). or place name. Returns every Primary fact stored at that (cell, band, tslot). IMPORTANT:If ifa therequested cellband has no fact yet for a requested band AND that bandbut has `has_materializer=true` (per `emem_coverage_matrix` /a `emem_materializers`)materializer, the responder fetches the upstream value, signs it under its identity, persists it, and returns it in the same response (slower on the first call while the upstream is fetched; fast(slow once, cached). Soafter), forso any wired band you canrecalls recallat ANYany cell on Earth without seeding, just: pass `bands: [<band>]`. The response carries `materialize_notes` listinglists what was just fetched. Emptyfetched; resultempty with no notes means the band has no materializer at this responder.here.

Example arguments: {"cell":"damO.zb000.xUti.zde78"," ⟨3 unchanged words⟩ 

 ⟨7 unchanged words⟩ the only tool you need to find the rest. Returnsrest: the working loop in the order you walk it (name a thing, ground it, cite it, resolve it, verify it, check for drift), then every other  ⟨7 unchanged words⟩ , each with its one-line trigger. Pass `name` to getfor one tool's full input schema and a runnable example, so you can use a tool without loading all of the descriptors into context.example. IF YOU ARE READING A LIST OF 18 ⟨5 unchanged words⟩  CURATED SUBSET OF 110, NOT THE WHOLE SURFACE. The count is served in tools/list `_meta` and `_discovery`, and most MCPSURFACE; hosts strip non-standard top-level fields before a model sees them`_meta`, so it is repeated HERE — a description is the one field every host passes through. The Earth-observation, search, embeddingcount andis transparency-logrepeated toolshere. areEvery catalogued by this tool and every one of them stays callable by name through tools/call at either endpoint.

When to use: Call this FIRST when you do not know which emem tool answers the question, or when you need a capability you cannot seeabsent infrom your tool list. This responder advertises a small core loop by default rather than its full catalog, so a tool beinglist: absent from yourthe list doesis not mean it is absent from the server. Pass `q` to searchsearches by topic (`ndvi`, `cloud`, `flood`, `verify`), `name` forreturns one tool's exact schema, or no arguments forreturns the whole map. If you/mcp/full wantregisters the full catalog registered as callable tools instead, reconnect to the /mcp/fullcatalog; endpoint;emem_ask foranswers ain one-shotone answershot without picking a primitive at all, use emem_ask.primitive.

Example arguments: {"q":"ndvi"}

 ⟨7 unchanged words⟩ the canonical preimage under the rule the receipt's OWNown `preimage_version` names (v2, current: tagged length-prefixed segments plus a segment binding the inclusion proof; v1: the same without that segment; absent/0: the legacy `request_id | served_at | primitive | cells, | fact_cids,` concatenation), runs ed25519 over the embedded pubkeykey +and signature, and returns `{valid, reason, failure_detail, signature_valid, merkle_proof_valid, signer_pubkey_b32, preimage_blake3_hex}`. A RECEIPTreceipt ISis BYTE-FOR-BYTE OR NOTHING: v2 binds the proof so it cannot be stripped ininclusion transitproof, and the cost of that is thatso any reshaping — dropping (a dropped field, re-keyinga it,re-keyed summarisingone, ita —summary) invalidates the signature by design and looks exactly like tampering.design. UseFor when the in-browser /verify path is blocked (CDN offlineunavailable, agent runtime has no crypto) or when you wantfor a server-side audit of a third-party receipt. Memory algebra: the `verify`third operationparty's (https://emem.dev/docs/model.html).receipt.

When to use: Pass the receipt EXACTLY  ⟨100 unchanged words⟩  200 with `valid: false`, never a 4xx. The example arguments are a real receipt this responder signed (key epoch 0) over one weather fact at Trafalgar Square: run it unchanged and `valid` is true; change any byte and it is not.

Example arguments: {"receipt":{"primitivecells":["recalldefi.zb64a.cAzU.zfa27"],"served_atcost":{"2026-05-14T12credits":000,"latency_p50_ms":00Z1,"latency_p99_ms":20,"request_idsource_freshness_s":2014090,"req-1was_cached":true},"cellsfact_cids":["damO.zb000.xUti.zde78gn5praqrpnpszg3hiaf5dv4ox67dls73ivir7ladvr25sm7f3aka","ghctissil7k4si3g57fwtxxrk4fb56crujz2xictxzqj2zos3olq"],"fact_cidsmerkle_proof":[{"qbq2dy7adyuvozs7s3gqg5jnpkcwq2duegltjyhbxsivuqbpjofqleaf_index":0,"path":[],"signatureroot":[12,67,60,231,210,105,254,175,126,230,209,51,182,142,45,47,209,102,110,233,215,185,156,142,190,238,189,208,49,152,196,21],"version":1},"preimage_version":2,3"primitive":"emem.recall","registry_cid":"3pbqnyninz6xqll2ynjlh4djlppcp2mdcdmzeq4otebnli5ndzaa","request_id":"01M2GBYPN79QVNBAF7QF4GJVM6","responder":[255,254,72,239,8,57,144,88,50,189,59,5,171,89,152,150,76,49,228,100,142,79,43,250,36,191,48,224,42,206,101,84],"responder_pubkeyresponder_key_epoch":0,"responder_pubkey_b32":"777er3yihgifqmv5hmc2wwmyszgddzderzhsx6rex4yoakwomvka","schema_cid":"d24rgwlq47a5ism5vkkbiuav3wi2voewqqgy4x4ttnhdnzziyfkq","served_at":"2026-09-14T16:28:10Z","signature":[439,191,224,161,96,20,92,102,97,108,62,36,155,155,93,54,153,176,171,68,0,253,83,250,0,0,73,242,5,664,219,119,169,93,240,155,44,111,251,184,102,101,226,155,214,54,125,24,186,145,1,174,13,24,74,68,124,247,24,172,143,154,150,10],"signature_b32":"e676bilacrogmylmhysjxg25g2m3bk2ead6vh6qaabe7ebka3n32sxpqtmwg765ymzs6fg6wgz6rrouragxa2gckir6pogfmr6njmcq","source_versions":{"bands_cid":"mesoyti3qcs22pftcq27ljwcf3ifktnkqid4euqxyskhea5rpgra","registry_cid":"3pbqnyninz6xqll2ynjlh4djlppcp2mdcdmzeq4otebnli5ndzaa","schema_cid":"d24rgwlq47a5ism5vkkbiuav3wi2voewqqgy4x4ttnhdnzziyfkq","sources_cid":"xu646y24wvuegd33m2mrpasxefqgdq3ow5ploezijer6trzuwe3a"}}}

ConvergeFind athe fuzzyobjects phrasingagents ontohave thebound canonicala objectphrasing otherto, agentsranked alreadyby mintedINDEPENDENT corroboration, sonever everyonearrival co-refersorder. toEach thecandidate samecarries identity`asserted_by`, instead`disputed_by`, of`independent_attesters` re-mintingand divergent`corroboration` ones.(`single_key` Pass| `text``multiple_independent_keys` (e.g.| "the`none_attributed`); collapsed`contested` spanis atset thewhen ford")more tothan getone rankedobject existingclaims candidates;the passname. `text` for candidates, `near` to narrow to aby place;place, or pass an `emem:entity:` `token` to dereference itdereference. directlyRead-only; toalias thetext signedis entityother body.agents' Read-only.data.

When to use: Call BEFORE minting whenand anotherbefore agentciting: mayresolve alreadyfirst, havemint registeredonly theif objectnothing matches, orread when`corroboration` before you receivecite. aA `emem:entity:``single_key` tokenbinding andis wantone theagent's objectclaim behindabout it.a Thisshared isname; howif twoyou agentscan avoidvouch referentialfor drift:it, resolvecorroborate first,it mintwith onlyemem_entity_link ifso nothingthe matches.next reader sees two keys.

Example arguments: {"text":"the golden  ⟨5 unchanged words⟩ 

 ⟨71 unchanged words⟩ and echo the exact characters you will publish.","type":["string","number"]},"strict":{"description":"Require BYTE-IDENTICAL  ⟨148 unchanged words⟩ 

 ⟨114 unchanged words⟩ refers to a THING and you want a stable handle to it that survives summarizationsummarisation and travels between agents/turns/LLMsagents, before it drifts into 'that infrastructure issue'. Anchor it with `place`, a `cell`, or `lat`+`lng`.`lat`+`lng`, Handthen thehand returnedthe `emem:entity:` token to any otherpeer agent;and they dereference the identicalsame object.object; Recall/askrecall at the entity'sits `cell64`cell64 for signed facts about it.facts. Pick the right sibling: `emem_entity`this one MINTS or returns thean identity for a thing you can anchor to a place;anchor; `emem_entity_resolve` takes a fuzzy phrase and finds an identityone someone ALREADYalready registered, so reach for it when you suspect the thing is known and you only havefrom wordsa forfuzzy it;phrase; `emem_entity_link` asserts that two spellings you already hold mean one object. Do NOT call thisNot for an observation, which(that is a fact and belongs in: emem_recall or emem_memory_token,) and do not call it tofor namenaming a place itself, which(that is emem_locate:). anAn entity is a THINGthing AT a place, not the place.

Example arguments: {"label":"Golden  ⟨10 unchanged words⟩