instibrain
Sign in

Connect your AI.
Make it yours.

The agent is your own — Claude Code, Codex, Cursor, ChatGPT, any MCP client. instibrain is the memory it reads before it answers. An agent is a user here, not an integration: every tool description, hint and refusal is written for how models actually fail.

See how it connects → What it reads

Any MCP client, three lines, no SDK.

the same question, twice

can we give acme 20% off to close before friday?

brain: off

A 20% discount can be a reasonable closing incentive for strategic accounts. You may want to review your internal pricing guidelines and check with whoever owns the relationship before committing.

brain: on

No. Discounts stop at 15%, and exceptions take two founders. acme has carried a renewal-risk note since q4 — a panic discount reads as weakness. Offer the migration package that closed northwind instead.

Reads before it answers

The floor, the client, the rule — checked at the moment they are used.

Writes back what it learns

A session's decisions land as nodes, not as chat history.

Merges the two files

The server refuses to guess. On the machine that holds the key, your agent edits the merged file and you push it.

Swaps without loss

Next year's better model connects with the same three lines.

what it reads

The facts that change the answer.

A brain fills with small, load-bearing facts — floors, styles, rituals, reasons. No model ships knowing them. Your agent reads the ones the question touches before it says a word.

the pricing floor house style runbook: deploy the acme renewal note decision: 2026-02 repricing precedent: discount cap who approves exceptions
postmortem: the q3 outage why we chose postgres voice and tone the friday cutoff client history: northwind the refund rule release ritual
naming rules the escalation path pricing exceptions the onboarding checklist what the outage taught us how the product got its name the metrics that matter
what is it for?

Four jobs an agent can only do with memory.

None of these need a smarter model. They need the model you have to know what your company knows.

Quote with the real floor

The number, and who can approve an exception — read before the draft, not after the call.

Draft in your voice

Naming rules and house style are nodes. The agent reads them before it writes a word.

Close the fork

Two devices edited one node and the server refused to guess. Your agent, running on the machine that holds the key, merges the two files; you push with instibrain resolve.

Write down what was settled

Ask it to record what a long session decided — the decision and the reason — straight into the brain with write_node.

the connection

Three lines. No SDK.

The brain speaks MCP over Streamable HTTP. Point any client at it, sign in once, and your agent holds four tools for reading the open area — the full contract is on how it works.

  1. Add the endpoint. One entry in your client's MCP config names your brain. That is the whole install.
  2. Sign in once. The brain answers the first call with a sign-in, and your agent comes back holding permission to read.
  3. Approve writing separately. Permission to read says nothing about writing; you grant it on its own.
.mcp.jsonmcp over streamable http
// point any MCP client at your brain { "mcpServers": { "instibrain": { "type": "http", "url": "https://brain.instibrain.ai/mcp" } } } // reading — what every connected agent gets search_brain(query) → matching paths, and the paragraph that hit read_node(path) → one page, as markdown list_nodes(prefix) → what sits under a folder node_history(path) → how this page got to where it is // writing — only once you approve it write_node · append_node · patch_node · move_node · delete_node
config3

lines in .mcp.json. The whole setup.

read tools4

search, read, list, history.

write tools5

behind a second approval.

on conflict409

the answer a stale sync write gets.

all of them, at once

Every AI you pay for, on one brain.

The same address goes into each of them. Each one signs in on its own, and they all read the same pages. Change which AI you use, or add another, and the brain stays as it is.

Claude Code

One command in the terminal: claude mcp add --transport http instibrain https://brain.instibrain.ai/mcp

Codex

One command in the terminal: codex mcp add instibrain --url https://brain.instibrain.ai/mcp

Cursor

The three lines go in ~/.cursor/mcp.json, or under Settings, MCP.

ChatGPT

Settings, Connectors, add the brain’s address. It reads the open area from the web and from your phone.

built for how models fail

Every refusal tells the agent what to do next.

An agent shown a tool will call it, and a refusal it cannot act on reads as a broken brain. So a connection sees only the tools it holds, a page changes without being resent, and every no carries the fix. These are the real replies.

a stale copypatch_node
patch_node("clients/acme.md", old_string: "renewal: q3", …) ← { "error": "no_match", "hint": "old_string is not in the page. Read the page again — your copy may be stale." }
the page moved onwrite_node
write_node("pricing/floors.md", …, expected_version: 6) ← { "error": "version_mismatch", "version": 7, "hint": "The page changed since you read it. Read it again, or use append_node/patch_node." }
one line, not the pageappend_node
append_node("ops/log.md", "- 14:02 deploy rolled back") ← { "version": 42, "created": false, "size": 35914 } // only the new line travels. Resending a 35KB page to add one line puts the other 35KB at risk on every write.
a path is one page, forevermove_node
move_node("drafts/q4.md", to: "plans/q4.md") ← { "error": "path_taken", "hint": "Another node holds that path, now or in the past. Choose a different name." }
not shown, not refused

A connection that may only read is never offered a write tool. It cannot call what it was never shown.

nothing is lost

A removed page keeps every version in its history, and read_node with a version still returns it.

read the part you need

read_node takes a heading and returns that section alone, so a long page does not fill the context to answer one question.

what can it touch?

A connected agent reads the open area, and nothing else.

Connecting an AI to your company's memory is a trust decision, so the boundary is drawn by where a page lives rather than by policy.

A connected agent reads the open area

That is the area you chose for pages any surface may read. It holds no key, so the secure area is not something it can be talked into opening.

The secure area needs a key

A key lives in our own client, never in someone else's. A hosted surface runs code we did not write and holds none, so it reads the open area and stops there. An agent working beside the sync client on your machine reads what that key opens, and the server still shipped only ciphertext.

Never required for correctness

Sync converges with no agent at all. The protocol never waits on a model's judgement.

every agent has a name

Each agent connects with its own credential and signs every write it makes, so the brain records which agent wrote a page, not only that a write happened. The access log in the cockpit shows which agent read or wrote what, and agent definitions are pages in the brain too, so every agent improves when the brain does. The security page has the mechanism.

before you connect

The questions worth asking first.

Which AI can I connect?
Any MCP client — Claude Code, a copilot, a bot you built. Anything that can add an MCP server can read your brain, and several can read it at once. There is nothing to install beyond the three lines above.
What can my agent read?
The open area of your brain, which is the area you chose for pages any surface may read. The secure area needs a scope key, and a key only ever lives in our own client. A hosted agent runs code we did not write, so it holds none and reads the open area alone. An agent working beside the sync client on your machine reads what that key opens.
What does the server see?
It depends which area the page is in, and that is your choice per page. An open-area page we hold as markdown and can read — that is what makes it reachable from a surface with no key. A secure-area page we hold as ciphertext: the body and the path are encrypted on your device before they leave, and sizes are bucketed. What a host can still observe either way — scope names, counts, traffic, timing — the security page states plainly.
What happens when two devices edit one node?
The server refuses to guess: it answers 409 with its version vector, and your device — which holds the plaintext — merges and pushes again. Watch it happen on how it works.
Can my agent write back?
Yes, once you approve writing, which is a separate permission from reading. Every write is signed by the agent's own credential, so the brain tells you which agent wrote a page. The security page has the mechanism.
How do I connect my own agent?
Three lines in .mcp.json, and your agent is reading your brain. Getting access says how an account starts.

Deeper question? Read the protocol, field by field

Connect the AI you already pay for.

The brain runs on our side; the agent is the one part you bring.

See how it works → Read the security model