A brain is the canonical store of what your company knows: the decisions, the numbers, and the reasons behind them. Any AI you already pay for reads it over MCP; you decide per page whether we can read it too. Feed it for years, and the next model starts with all of them on its first day.
Plain markdown on your device either way. This page sits in the secure area, so on our side it is ciphertext, and it was merged here rather than on the server.
Not your documents — you already have somewhere for those. A brain holds what only one person currently knows, written down while they are still here to check it.
The number under which you do not go, and the two people who can approve an exception.
The deal you walked away from, and the reason. The next rep will ask the same question.
The order the services come back up in, and the one step everybody forgets.
The name attached to each surface, so a question reaches a person rather than a channel.
What a thing is called here, and the three synonyms nobody is allowed to use.
The incident, the cause, and the change that made it stop happening.
What this account was promised in 2023, by whom, and whether it shipped.
Who to wake, at what threshold, and what they will ask for first.
/v0A brain has exactly three concepts. Everything the protocol does is built out of them.
One unit of memory. A path, a body in markdown, and a version vector: one counter per device that has touched it. The sync client materializes each one as a file you can open, grep, diff, and commit.
There is no title field and no owner field. The first heading is the title, and the path says where the page belongs.
Who can read the page. In the open area we hold it as markdown, so a surface with no key — an always-on agent, Claude on your phone — can still reach it. In the secure area we hold ciphertext, and only a device holding the scope key opens it.
A secure-area node reaches us as an opaque blob and a few integers. The server has never parsed one.
Who it is shared with. A separate question from the area. In the secure area a scope carries a key, and a device holding it reads that scope and nothing else. In the open area a scope does not narrow the readers: every connection with read access reads every open-area page.
Membership is a signed chain the sync client verifies from genesis before it accepts a key, so the operator cannot add a reader you did not sign for.
Everything else is a node, in an area, in a scope.
The brain speaks MCP. An agent that already speaks MCP — Claude Code, Codex, Cursor, ChatGPT, or anything else you have wired up — needs no adapter and no plugin. These work on the open area, which is what lets a surface holding no key use them at all.
Reading and writing are different risks, so they are different permissions. Approve
writing and five more tools appear: write_node, append_node,
patch_node, move_node and delete_node. A
reader that is wrong shows you something stale; a writer that is wrong replaces
something that was right. Granting one never implies the other.
Three more tools — is_fresh, pull_changes and
push_changes — move encrypted nodes and version vectors for the
sync client to merge. A hosted client never receives them, and would have nothing to
do with them: with no key on hand there is nothing to decrypt. Everything MCP does,
/v0 also does over plain HTTP, authored once in
@instibrain/protocol so the two sides cannot drift apart. The full
record is on how it works.
The model is rented. The memory is yours.
one brain · any agent · you set who reads each page
A brain is fed for years, and its value is those years. So the question that matters is not whether we are around next year. It is what you hold if we are not.
The sync client leaves every page your keys open as a plain file. Copy the folder and you have every page, readable in any editor.
Inside /v0 a change may only add a field, an endpoint or a tool. A breaking change ships as /v1 beside it, and both are served until the old clients are gone.
Every sync client and the protocol package ship open source, signed and reproducible, while the server stays closed. The parts that hold your keys are the parts you can inspect.
Nothing we store opens a secure-area page, so our going away exposes none. The other side of that: lose every device and your backup, and nobody can open it, us included.
Your agents read the brain over MCP. You open it in the cockpit at
my.instibrain.ai: the whole tree, every page as it is now, what changed
since you last looked, and which agent read or wrote what.
Every page in its scope, coloured by area, with how long since each was touched. A page nobody has read in a year shows it.
What your AI distilled from a source waits here until a person accepts it. Two pages that disagree are flagged before an agent reads either.
Which agent read which page, and which one wrote. The trail that makes handing an agent your memory a decision you can audit.
One page every brain ships with. A line, a photo or half a thought goes in from any device; it leaves only by becoming a real page, or by deletion.
Read the mechanism, then decide whether the claim holds.