emem is a machine-maintained external memory of the physical world for AI, officially positioned as a "satellite for AI." Its core goal is to solve a trust problem: today, to trust a piece of data, one usually must first possess it—a satellite downlinks a whole collection, a lab emails a spreadsheet, an enterprise uploads documents to any AI that reads them, and every copy is a place where data may leak or be quietly modified. emem splits this work in two.
Encoding happens at the source and stays private. A file server, lab, camera, or payload computer hashes what it holds into cells and signs a small record with its own key. The bytes do not have to leave. What leaves is a commitment to them: a content ID, a Merkle root, a signature. emem is the decoding half: any model (Claude, ChatGPT, or your own code) can resolve a short token back to that exact record, check who signed it, and prove that a cell belongs to the whole, without trusting the sender and without trusting emem.
Tokens let readers resolve published records and check the content given, but do not leak the parts you keep: a tree token for a private file exposes only the cells you choose to publish, nothing else. What each check can prove is declared along with the record: a hosting record only says the bytes arrived, not that the sensor was calibrated; a tree only proves that a cell is in the signed file, not that the file is true; code_cid only says which piece of code you claim produced a value, and running arbitrary private code in a sandbox is not built in.
Reading requires no account and no API key. Usage includes: connecting an MCP host (such as Claude Code); proving part of a file without disclosing the rest (a repository's LICENSE published as a signed tree of six 2 KB cells, ready to try); reading signed measurements and verifying them offline (curl, jq, Python). Verification uses the public key included with the receipt; to confirm it was signed by emem, you can pin emem's key from /.well-known/emem.json, or verify a token at emem.dev/verify. There is no uniform rule from tool names to REST paths; the authority is /openapi.json, and under MCP you call tools by name.
For agents: connect https://emem.dev/mcp。它在单页中广告核心循环的 18 tools, about 75 KB of context, rather than the entire directory (loading all 115 descriptors takes about 324 KB). The lightest first contact is emem_tools, about 13 KB returning the loop and menu; tools/call dispatches each tool by name, with or without the emem_ prefix. When passing records, prefer bundles: emem_memory_bundle can name up to 256 facts within 38 characters.
Memory changes but history is not lost. The material gives an example demonstrated end-to-end on a live node on 2026-10-10: first name a place once as an identity; the identity stays the same while measurements vary; the two observations each have their own record and content ID, and a later read does not overwrite an earlier one; a result derived from the two is recomputed, because it names both inputs and pins its code by hash; a correction preserves the original record, readers of the old path get superseded_by, the original bytes remain parseable, and anyone can see what was corrected and why; another agent can verify the whole process without trusting anyone, obtaining the value, the two input tokens, and the responder's claim that it reproduced that value under a single offline-verifiable receipt.
Tokon binding: emem:fact: and emem:state: carry the full 32-byte BLAKE3 of the record's canonical CBOR, binding every byte; emem:entity: and emem:bundle: are 16-byte anchors that only co-refer rather than bind, and an entity's anchor does not cover every field of its metadata. A token occupies more context than the number it represents (84 characters, 51 LLM tokens, versus about 5.4 for the value), and is worthwhile only when the value needs to survive a summarizer, needs to be verified by someone who does not trust you, or is passed bundled with others.
When the world has no answer, emem also signs that, neither guessing nor staying silent: it signs an Absence, stating what it looked at and why there was no qualifying result. Sources of trust include: the record ID is the BLAKE3 hash of the canonical bytes; every answer carries an ed25519 receipt that can be verified offline against the responder's public key; every record states how it was produced (sensor read, formula recomputed from cited sources, model-generated, or human input, the four look different, and model_output and human_curated carry warnings in the same payload); a missing value is never a bare 404; no content is overwritten, and subsequent records takegeneration, disagreements between writers are preserved and scored as evidence; the history is auditable, all signatures enter an append-only RFC 6962 Merkle log (2,811,200 entries as of 2026-10-10); derivations can be recomputed; what the facts can accommodate is measured with /v1/plane/conformance; emem-guard can check emem: references in a draft before a number is stated and give allow/deny with a machine-readable reason.
emem is not a vector database, nor does it replace an agent's own memory; it is the shared part that multiple agents, models, and organizations need to agree on. The material also gives comparison results and limitations: when retrieval is missing, the model lies plausibly; consistency is not evidence; when a value fits in context, pasting the value ties with addressed memory, BM25 also matches on these corpora, and what truly saves context is the bundle rather than a single token; when drift occurs online, previously published tokens still resolve to the old value and remain verifiable; independent verifiers have already written clean-room verifiers from /v1/verifier_spec and reproduced the signatures.
Earth is the first corpus rather than a limitation. The protocol does not care what records are about; Earth comes first because its sources are public archives, anyone can take the same input and recompute the answer, and this is the hardest scenario to cheat in. Open data from ESA, NASA, USGS, and EU JRC populates memory on demand: 115 wired measurements come from 46 declared source schemes. A file tree can commit to anything, but committing bytes does not make it a measured fact; only emem's own reader, registered devices, and keys listed by the operator can write the fact plane.
The figures given by the material: 115 MCP tools (default 18-tool core loop), 179 paths under /v1/*, transparent log with 2,811,200 signed entries (2026-10-10). Production node measurements: hot recall p50 2.5 ms, offline receipt verification p50 0.13 ms, single node 632 requests/second. You can run it yourself: run this repository's binary on a host node, and a receipt minted in one place can be verified in another. The EMEM_DATA mounted volume stores the node signing key; for long-term use, pin the image digest. For machines without external connectivity (such as an in-orbit payload computer), emem-airgap hosts files in one directory and writes signed records to another directory, and emem-encode captures the execution evidence it can capture, with each record stating which of the two guarantees it carries; the image FROM scratch, a single static binary, linking no network or database crate; quickstart.sh can start from zero.
