A 9-package monorepo that adds a code knowledge graph, persistent memory, a picker and standing agent teams to the AI coding tools you already use. Every number below was checked against the v2.24.3 source and its generated doc counts, not carried over from an old design.
Architecture
Your coding tool talks to the CLI package over MCP, a hand-rolled stdio JSON-RPC loop. The CLI loads the other packages as it needs them. Most are libraries, not always-running services.
Modules
Six live under packages/@monomind/ (cli, hooks, mcp, memory, monograph, routing) and publish under the @monoes/ npm scope. Two live under packages/@monoes/ (monobrowse, monodesign), and monofence-ai is unscoped. Users install the monomind umbrella.
CLI Entry Point
packages/@monomind/cli/
The published CLI engine, installed through the monomind umbrella. 38 top-level commands, the MCP server, init, doctor, the org runtime and the local dashboard. Its stdio JSON-RPC loop is hand-rolled, so the default transport needs no separate MCP process.
Hooks & Workers
packages/@monomind/hooks/
Typed HookEvent registry and executor plus a WorkerManager for 9 on-demand workers. Claude Code reaches it through the .claude/helpers handlers; if the package is not built, the hook quietly does nothing.
MCP Framework
packages/@monomind/mcp/
Standalone MCP framework for the http and websocket transports, with a connection pool and tool registry. It is an optional peer: the default stdio server inside the CLI does not need it.
Memory Backend
packages/@monomind/memory/
SQLite memory store (better-sqlite3, sql.js WASM fallback) with embeddings, a pure-JS HNSW index and the JSON pattern store. The CLI's memory bridge calls it. LanceDB was removed in v2.3.1, dropping about 600 MB of native dependencies.
Knowledge Graph
packages/@monomind/monograph/
Tree-sitter and SQLite code graph in .monomind/monograph.db. 14 grammar modules cover 25 file extensions, 5 regex extractors cover Scala, Lua, Zig, PowerShell and Elixir. FTS5 search, Louvain communities and incremental builds. 19 default tools, 27 more behind MONOGRAPH_MCP_ADVANCED=1.
Legacy Routing
packages/@monomind/routing/
The older semantic RouteLayer behind route semantic, now deprecated in favour of pick. Jev picker, keyword rules, embeddings in an isolated worker, then a Haiku fallback.
Browser Automation
packages/@monoes/monobrowse/
Chrome DevTools Protocol client with no Playwright, Puppeteer or Selenium dependency. Powers monomind browse and the agent-browser-testing workflow.
Design Intelligence
packages/@monoes/monodesign/
Design tokens, antipattern detection and the monodesign skill, exposed over MCP as monodesign_detect, monodesign_fix and monodesign_palette.
Manipulation Defense
packages/monofence-ai/
Local defense against prompt manipulation: an input cap, an evasion normaliser, 50+ patterns across 9 threat categories, multi-turn escalation tracking and an output scanner. Loads on first use from ~/.monomind/deps, pinned and hash-checked.
Memory
Several mechanisms share the word memory in this codebase. Here is what each one actually is, and where the Second Brain fits.
better-sqlite3 is primary, sql.js WASM is the fallback. The file is memory.db under ~/.monomind/projects/<name>-<hash>/ (the folder keeps its old lancedb name for path compatibility). Embeddings run locally with gte-modernbert-base (768 dimensions, about 90 MB, downloaded once). LanceDB was removed in v2.3.1.
Document chunks are rows in knowledge:<scope> namespaces: 22 file types, chunked at 3,200 characters with 400 overlap, deduplicated by SHA-256. knowledge_search fuses chunks, the knowledge graph, rules and memory with reciprocal-rank fusion over dense and BM25 retrieval. A personal global brain at ~/.monomind/global-brain is merged into every search.
memory_kg_ingest, memory_kg_search, memory_kg_stats and memory_kg_rollback keep entities and relations in the same database, and memory_feedback records whether a recalled item helped. Ingesting a document does not add it to the graph.
Search is brute-force cosine similarity below 100,000 embedded entries (MONOMIND_HNSW_THRESHOLD). Above that an HNSW index builds automatically, is cached next to the SQLite file and is reused until entries change. --build-hnsw forces an early build.
Hook learning keeps auto-memory-store.json (capped at 200 entries) and episodic/episodes.jsonl for episodic recall. These are separate from the SQLite store, so the word memory covers SQLite, the memory graph, these JSON files and Monograph.
Picking
Choosing the right specialist is a ranking problem, not a model call. The picker does it locally, and the older semantic router is deprecated.
monomind pick ranks agents and skillsOne index of 83 agents, 82 skills and 560 Org skills, scored with BM25 keyword ranking and an optional Jev decision model. History can re-rank near-ties by at most 15 percent; nothing is learned by reinforcement.
The best-fit agent and skill land in the model's context before it answers. The pick MCP tool returns the same ranking on request, and org_skill_show loads an Org skill.
monomind route "task" runs pickThe old keyword-only stub is gone. route and route task now print the output of monomind pick --agents.
route semantic, hooks_route_semantic and agent spawn --task still run Jev, 24 regex rules, keyword ranking, embeddings in an isolated worker (Snowflake arctic-embed-xs, about 88 MB, downloaded only on request, with a hash-encoder fallback) and then a Haiku call. Outcomes go to route-outcomes.jsonl, read by route stats and doctor -c pick.
Hook System
28 CLI subcommands and 20 typed registry events are different mechanisms that share a name, with 9 on-demand workers underneath both.
hooks CLI subcommands.claude/helpers/hook-handler.cjs, which dispatches to handlers (pick, router, session, memory, intelligence) and lazily imports @monoes/hooks..opencode/plugins/monomind-hooks.ts runs the pre-bash and pre-write gates in tool.execute.before.plugin/hooks/monomind-gate.mjs bridges the PreToolUse event to the same gates.Runtimes
Monomind plugs into the coding tool you already use, and its org roles can run on a different set of agent runtimes through one protocol.
Init targets
5 coding tools
monomind init detects Claude Code, Antigravity, OpenCode, Kimi Code and Codex on your machine and sets up only those. MCP entries are pinned to the installed version.
Org role runners
19 runners
Claude and the Vercel AI SDK run in-process. The other 17 are subprocess CLIs: Codex, agy, Kimi Code, OpenCode, Grok, Qwen, Crush, Copilot, Pi, Hermes, Cline, Aider, DSH, Kilo and Freebuff.
Mixed teams
Per-role runtime
A role's runtime beats the org's runtime, which beats MONOMIND_RUNTIME, so one org can mix Claude, Codex and local models.
Agent exec protocol
v1, rev 29
Capability handshake, NDJSON events, --access scoped|read|full, --sandbox modes, --effort off..max, --resume, --budget-usd. Unknown cost is null, not 0.
budget_usd cannot close those roles.Org Runtime
monomind org run replaced the old prompt-orchestrated path. Each role is a live agent session with a budget, a policy and an approval path, not a scripted prompt loop.
Runtime
SDK-backed daemon
monomind org run/serve. Claude roles are live in-process Agent SDK sessions; other runtimes run as subprocess CLIs.
Subcommands
39
run, stop, pause, resume, reload, status, serve, logs, events, costs, inbox, approvals, gates, replay, branch, decisions, create, validate, sign, role and more.
Inter-agent channel
org_send / mailbox
Roles message each other with org:role addresses. ask_human queues a question, and org_recall, org_remember and org_learn keep cross-run memory.
Tasks
Dependency DAG
org_task, org_plan_graph and org_task_done. Ready tasks dispatch on their own, summaries are capped, and typed briefs and context packets are opt-in.
Config
.monomind/orgs/<name>.json
A zod schema: goal, schedule, run_config (1M token budget, 4 concurrent agents, verify_writes and lead_watch on by default) and per-role policy. Sections and documents are generally available.
Signed definitions
org sign
The operator HMAC-signs a definition and it is checked on run, serve, resume and reload. The key lives outside every role's sandbox, and an unsigned change is refused.
Checks and audit
One checklist
validate, run, reload, create and the dashboard share the same caveat checks. Skipped scheduled ticks are written to schedule-audit.jsonl.
Dashboard
monomind ui
Now, Sessions, Projects, Orgs, Monograph and Documents tabs on 127.0.0.1:4242, behind a token. Loopback only.
Security and Trust
Monomind keeps its own state on your machine, but the AI tools it drives talk to their model providers. These are the guarantees as the docs state them, limits included.
monofence-ai sends no user data anywhere. In Claude Code the deterministic destructive-command and secrets gates fail closed, but the monofence layer fails open when the package is missing, slow or errors, so it is a safety net, not a guarantee. MONOMIND_MONOFENCE_GATE=off disables it.
--access full is human-CLI-only, refuses root, needs an explicit --cwd and writes an audit line per turn. The docs state the limits: full access is not a sandbox, fetched web content is not filtered, and background jobs can outlive a stop.
policy.sandbox can deny a role exec (denyExec), reads (denyRead) and writes to $HOME (homeWriteAllow) inside a bubblewrap layer that fails closed without bubblewrap. Claude roles also get a hard budget_usd stop. A plain agent exec is not sandboxed by default.
Memory, the code graph, the document index and org state stay on your machine. The AI tools Monomind drives send prompts and code, including recalled memory, to their model providers. Monomind's own calls are the embedding download, first-use installs of the Claude SDK and Chrome, update checks and dashboard CDNs. MONOMIND_NO_AUTO_INSTALL=1 stops the installs.
Ollama, llama.cpp and LM Studio work for org roles through an OpenAI-compatible endpoint. That is not the same as fully offline: embeddings need a one-time download, the Claude SDK installs on first use, tool calling is weaker on small models and cost shows as $0.
Honesty Notes
A short list of things that are easy to overstate. We would rather say them plainly here than have you find out later.
monomind org run.monomind route now runs pick. New routing work goes through the picker.--access full) is not a sandbox, and a signing key can be read by a role that has no sandbox and no bubblewrap mask.