🧠 GHCP-MEM

You ship features. Your AI shouldn't have to relearn your project every morning.

Every Copilot chat starts from zero — you pay the Context Tax: ten minutes and thousands of tokens re-explaining a project you already explained yesterday. GHCP-MEM ends it. It gives Copilot a local, auditable engineering memory — seeded from your git history in 30 seconds — so every chat starts where the last one ended, and every claim shows its receipts.

Nothing leaves your machine: no cloud memory backend, secrets and cloud identifiers redacted before they hit disk, optional AES-256-GCM encryption at rest. Every stored decision cites the events that produced it. Most "what / why / how" questions route to a millisecond local lookup instead of a fresh Copilot completion — your token budget goes to shipping, not catching up.

Local-first · Copilot chat participant · MCP stdio · Redaction-first

The villain: the Context Tax

Every new Copilot chat is a fresh amnesia. The Context Tax is what it collects from you, every single day:

What it takes from your wallet and your clock

• Copilot re-reads files just to figure out "what is this project?" — 2,000–10,000 tokens before you've asked a real question.
• You re-explain the same architecture decisions, week after week.

What it takes from your head

• The first ten minutes of every chat feel like onboarding the same intern, again.
• You start second-guessing AI suggestions because they might come from a memory layer that's hallucinating context you can't verify.
• You stop trusting the tool — and silently revert to copy-paste prompting.

Why it's simply wrong

• A tool that forgets your work disrespects your work. AI should remember what you've already done — and prove what it remembers. A coding assistant without provenance is a coworker with confident amnesia: the worst kind to work with.

Why we built this

We paid the Context Tax every morning too. We know the exact feeling of typing the same architecture explanation for the fourth Monday in a row — and the quiet distrust when a "memory" tool confidently asserted something we couldn't verify. We shopped the market and found tools that wanted ports, sidecars, vector databases, or cloud sync — and not one of them showing receipts for what they claimed to remember.

GHCP-MEM is what we shipped instead. It's the memory layer we wanted: local-first, evidence-grounded, self-routing. Built specifically for VS Code + Copilot, then extended to every MCP-compatible agent (Cursor, Cline, Windsurf, Claude Desktop, Copilot CLI) through one stdio server.

Why it's worth your trust:

• 570 tests, zero native dependencies, zero open ports — npm install doesn't compile anything. Source is formatted with Prettier (CI-enforced via format:check) so reviewers see real code, not bundle output. Auditable in an afternoon.
• Nine documented engineering phases, each with grounded design rationale in the CHANGELOG. No marketing claims that don't have code behind them.
• An evidence-citation gate in the compressor — the LM cannot emit a decision without pointing at the captured event that produced it. Hallucinated rationale never reaches storage.
• An nDCG@K regression gate runs in CI — if a ranker change regresses retrieval, the build fails.
• /compliance chat command prints a one-shot audit report (grounding coverage, trust distribution, conflict counts, redaction stats) — built for the security reviewers in your org, not just for engineers.

The 30-Second Memory Plan

From then on it just captures as you work — edits, terminals, diagnostics, deploys — and every new chat starts caught up.

Our three promises while it runs: everything stays local (no memory backend, zero open ports) · everything is redacted before it touches disk (26 rules + entropy catch-all + optional encryption at rest) · everything is auditable (every claim cites its evidence; /compliance prints the proof).

That's it. No daemon to keep running. No cloud account to register. No vector DB to provision.

The cost of doing nothing

Ignore it, and the Context Tax doesn't stay flat — it compounds, session by session:

What changes after you install

With GHCP-MEM in place:

• 🟢 Your Copilot resumes where you left off. The auto-injected memory file makes every new session start with context already loaded.
• 🟢 Every decision is cited. @mem /entity src/auth.ts shows you the supersession chain, the evidence, the contributors — in 500 tokens.
• 🟢 Wrong rank? You see why. @mem /why <q> :: <id> breaks down every signal that contributed to a ranking — when the system is wrong, it tells you exactly why.
• 🟢 Contradictions surface before they bite. /conflicts flags "we picked X instead of Y" decisions that overlap with older choices.
• 🟢 Token bill goes down. The startup primer biases Copilot toward MCP queries (~200–500 tokens) over file opens (~2,000–10,000 tokens) for history questions. 5–20× cheaper from message one.
• 🟢 Security review takes 5 minutes. /compliance prints the audit report. You hand it to the reviewer and move on.

Tokens go to building. Decisions stay grounded. Trust holds.

How it surfaces (4 pillars at a glance)

It surfaces memory through:

• the @mem chat participant (41 commands including /savings, /entity, /snippet, /why, /graph, /compliance, /route, /lessons, /rules)
• native Copilot agent tools (#ghcpMemSearch, #ghcpMemStore, #ghcpMemAudit, #ghcpMemLessons)
• a bundled stdio MCP server with 14 tools for Cursor, Cline, Windsurf, Claude Desktop, and GitHub Copilot CLI

Why engineers trust it (deeper guarantees)

How it works

Step 1: Install it

Live on the VS Code Marketplace — one-click install, auto-updates included.

Verify the installed extension (security-conscious teams)

Every release from v1.6.1 onward uploads four artifacts to its GitHub Release page:

Backfilled v1.5.0–v1.6.0 releases include .vsix + .sha256 + sbom.json + a manifest, but not the SLSA L3 attestation — those tags predate the workflow fix that lets the attestor run successfully. Verify them via the SHA-256 + SBOM only. v1.6.1+ has the full L3 trail.

End-to-end verification script you can paste into a terminal:

# Discover the installed version and the matching tag.
VERSION=$(code --list-extensions --show-versions | grep -i 'ITcredibl.ghcp-mem' | cut -d@ -f2)
TAG="v${VERSION}"
test -n "$VERSION" || { echo "GHCP-MEM not installed"; exit 1; }

# 1. Pull the public release artifacts.
BASE="https://github.com/ITcredibl/ghcp-mem/releases/download/${TAG}"
curl -sfLO "${BASE}/ghcp-mem.vsix"            || { echo "no .vsix for ${TAG}"; exit 1; }
curl -sfLO "${BASE}/ghcp-mem.vsix.sha256"     || { echo "no checksum for ${TAG}"; exit 1; }
curl -sfLO "${BASE}/sbom.json"                || echo "(no SBOM for ${TAG} — backfilled release)"

# 2. Verify the .vsix matches its published checksum.
shasum -a 256 -c ghcp-mem.vsix.sha256

# 3. Verify your locally-installed bundle byte-for-byte against the .vsix.
EXT_DIR="$HOME/.vscode/extensions/itcredibl.ghcp-mem-${VERSION}"
test -d "$EXT_DIR" || { echo "expected $EXT_DIR — is the extension installed?"; exit 1; }
unzip -p ghcp-mem.vsix 'extension/out/extension.js' \
  | shasum -a 256 \
  | awk '{print $1}' > /tmp/release-extension.sha256
shasum -a 256 "$EXT_DIR/out/extension.js" \
  | awk '{print $1}' > /tmp/installed-extension.sha256
diff /tmp/release-extension.sha256 /tmp/installed-extension.sha256 \
  && echo "✅ installed bundle SHA matches the public release"

# 4. (v1.6.1+ only) Verify the SLSA L3 provenance attestation.
gh attestation verify ghcp-mem.vsix --owner ITcredibl

Step 3 catches the only attack that step 2 can't: a tampered Marketplace artifact that wasn't built from the public source. If step 3's diff shows a mismatch on a v1.6.1+ install, don't trust the install — open an issue with the diff and the installed-extension manifest.

Step 2: Let it capture your work

GHCP-MEM records the signals that matter in a coding session:

• file edits, creates, deletes, renames, opens, closes
• diagnostics transitions
• git changes
• debug session start and stop
• task runs with exit codes
• terminal commands through VS Code shell integration

Then it debounces, redacts, classifies, and compresses those events into structured memory.

Step 3: Ask for the right memory at the right time

Use:

• @mem /recent
• @mem /search
• @mem /timeline
• @mem /detail
• #ghcpMemSearch
• #ghcpMemStore

Or connect the bundled MCP server from clients like Cursor, Cline, Windsurf, Claude Desktop, or GitHub Copilot CLI.

Get started

Stop paying the Context Tax. Five minutes from install to proof:

1. Install GHCP-MEM
2. Open any workspace with git history and accept the Seed from Git History prompt (~30s)
3. Open Copilot Chat and try @mem /search <something you shipped last month>
4. Run GHCP-MEM: Capture Session Snapshot Now to capture today's work too
5. Run @mem /savings after a few sessions to see session-by-session and lifetime token-savings estimates

Who it is built for

GHCP-MEM is the local, auditable session-memory layer for engineers who live in VS Code, use Copilot, work in Azure-heavy enterprise environments, and cannot run cloud memory services, sidecars, local HTTP workers, or native dependencies.

If your machine is locked down, air-gapped, or subject to data residency rules, GHCP-MEM is designed for your constraints — not around them.

Why teams need this

Without persistent session memory, the Context Tax bills every engineer on the team, every session:

• tokens burned re-explaining what the project does
• tokens burned re-establishing architecture and patterns
• tokens burned re-learning why a decision was made
• more tokens spent on the same work, slower progress, worse answers

GHCP-MEM ends that tax. The tokens you stop wasting on catch-up are the tokens that get your work done.

See it in action

What happens: every edit, diagnostic, git op, and terminal command is debounced, scrubbed of secrets, summarized through your existing Copilot LM, and stored locally. Later, GHCP-MEM recalls the most relevant prior context in milliseconds.

Core features

Automatic capture

• File edits, creates, deletes, renames, opens, closes
• Diagnostics transitions
• Git state changes
• Debug sessions
• Task execution with exit codes
• Terminal commands (VS Code 1.93+ shell integration)
• Debounced and rate-limited capture

Observation typing

GHCP-MEM classifies sessions into:

feature · bugfix · refactor · docs · test · chore · research · config · security · deployment · infra · unknown

Azure signals such as azd, az, .bicep, and .tf edits influence deployment and infra inference automatically.

Secret redaction

18 generic patterns including:

• AWS access key and secret
• GitHub PATs
• npm tokens
• OpenAI and Anthropic keys
• Stripe live keys
• Google API keys
• Slack tokens
• JWT and Bearer tokens
• DB URL passwords
• PEM private key blocks
• password= assignments
• emails, IPv4 addresses, and credit cards

8 Azure-specific patterns including:

• Storage, Service Bus, Cosmos, and SQL connection strings
• SAS tokens
• 88-character storage keys
• service principal secrets
• subscription and tenant GUIDs

Also strips user-tagged <private>...</private> blocks before persistence.

Hybrid retrieval

Retrieval blends keyword search, recency, embeddings when available, and deduplication so the right memories surface first.

Progressive disclosure

This keeps memory useful without dumping huge amounts of text into every prompt.

Visual Timeline

GHCP-MEM: Open Visual Timeline (Command Palette) opens a full WebviewPanel timeline — color-coded by observation type, searchable by keyword or branch, with expandable session cards.

Session CodeLens

A 📚 N sessions touched this file lens appears at the top of every opened source file. Click it to open a quick-pick of sessions that edited the same path, pre-sorted by recency.

AI-powered chat commands

Trust + lineage commands (added in 1.6.0)

Lessons & working-set commands (added in 1.8.0)

Project memory rules (team-shared, git-committed)

Durable, team-authored directives — the GHCP-MEM answer to Cursor's .cursorrules / Continue's project context. Unlike pinned lessons (personal, local), project rules live in a git-committed file so they travel with the repo and apply for everyone who clones it. They inject at the top of every Copilot/agent session — ahead of the routing primer, lessons, and session cards — and are never evicted.

• Source of truth: .github/memory/rules.md, grouped under ## Architecture / Conventions / Constraints / Gotchas / General. Commit it to share with your team.
• Always-on: rules inject even before you've captured any sessions, and a hand-edited secret in the file is redacted before it reaches any generated context.

Enterprise & Azure

Built for locked-down machines

• No admin install required
• No outbound service dependency
• No native binaries
• No open ports
• Default glob exclusions for .env*, *.pem, *.key, secrets/**, and node_modules/**
• <private>...</private> content never persists
• Data stored per-user in VS Code state plus ~/.ghcp-mem/sessions.json
• MIT licensed

Built for Azure shops

• 12-subsystem classifier across bicep, Terraform, azd, Functions, App Service, AKS, Container Apps, Storage, Key Vault, OpenAI, az CLI, and more
• Live az snapshot with subscription, tenant, resource group, location, and up to 50 resource IDs
• @mem /azure groups Azure-tagged sessions by subsystem
• Azure-aware observation typing and redaction
• Graceful fallback when az is missing or not signed in

Commands

Agent mode tools

Copilot agent mode can call these without a separate MCP setup:

@mem chat participant

Settings

External MCP clients

GHCP-MEM mirrors memory to ~/.ghcp-mem/sessions.json. MCP-compatible clients can read it through the bundled stdio server.

{
  "mcpServers": {
    "ghcp-mem": {
      "command": "node",
      "args": ["/path/to/extension/out/mcpServer.js"]
    }
  }
}

Use GHCP-MEM: Show External MCP Client Config to get the resolved path on your machine.

Exposed MCP tools (14 total):

• ghcpMem_search(query, type?, sinceDays?, tag?, workspaceName?, limit?) — keyword + RRF search
• ghcpMem_recent(limit?, workspaceName?) — most recent sessions
• ghcpMem_timeline(days?, limit?) — sessions by time window
• ghcpMem_get(id) — full session by ID prefix
• ghcpMem_store(summary, tags?, observationType?) — write a new session from an external client
• ghcpMem_delete(id) — delete a session by ID prefix
• ghcpMem_entity(path) — aggregate every session touching a file/symbol
• ghcpMem_snippets(query, limit?) — chunk-level decision/problem retrieval
• ghcpMem_conflicts() — pending heuristic conflict warnings
• ghcpMem_lineage(id) — cross-session causal chain
• ghcpMem_explain(query, id) — score decomposition for a session
• ghcpMem_graph(file?) — Mermaid decision graph
• ghcpMem_route(query, fileSizes?) — cheapest-path context recommender
• ghcpMem_lessons(kind?, limit?) — consolidated semantic + procedural lessons

CI/CD Integration: Memory Seeding

GHCP-MEM ships a headless CLI seeder for pre-populating memory from CI/CD pipelines. When a developer checks out a feature branch, the pipeline can generate a condensed summary of recent production alerts, infrastructure changes, or staging test results, and pre-seed the local store.

The next time they open VS Code, their AI assistant already has live-environment context without the developer having to ask.

Usage

# Seed from a JSON payload
echo '{"sessions": [{"summary": "Prod API at 50% error rate", "observationType": "bugfix", "keyTopics": ["api", "reliability"]}]}' | \
  npx ghcp-mem-ci-seed

# Or via npm
npm install --save-dev @ghcp-mem/cli
echo '...' | npx ghcp-mem-ci-seed --seed-label=prod-alert

Payload format

{
  "sessions": [
    {
      "id": "optional-uuid",
      "summary": "What happened",
      "observationType": "deployment|bugfix|feature|etc",
      "keyTopics": ["tag1", "tag2"],
      "keyFiles": ["path/to/file1.ts"],
      "decisions": ["ADR-style decision"],
      "problemsSolved": ["What we fixed"]
    }
  ],
  "observations": ["Free-form observation text"],
  "seedLabel": "prod-alert"  // tagged for easy filtering later
}

All secrets are automatically redacted using the 26-rule set + any custom rules defined in settings.

Architecture

Key modules:

More detail: docs/diagrams/pipeline.mmd

Privacy & security

All GHCP-MEM data stays on your machine. GHCP-MEM has no backend, opens no ports, and sends no telemetry to any third party.

Note: LM compression uses vscode.lm — your existing GitHub Copilot subscription — meaning compressed session summaries pass through Copilot's LM. No GHCP-MEM service is involved.

• Storage: VS Code globalState plus atomic mirror to ~/.ghcp-mem/sessions.json
• LM traffic: your existing Copilot subscription only
• Redaction: dual-pass redaction at capture and LM output time, plus redact-on-import
• Workspace artifact: .github/instructions/session-memory.instructions.md, automatically added to .gitignore
• Attack surface: VS Code extension host only

Troubleshooting

Uninstall

To remove GHCP-MEM completely — extension, stored sessions, workspace artifact, and any MCP/cross-editor injections — follow the step-by-step guide:

docs/UNINSTALL.md

Quick summary:

1. (Optional) Export your memory: GHCP-MEM: Export Memory to JSON...
2. Clear stored data: GHCP-MEM: Clear All Stored Context
3. Uninstall the extension: Extensions sidebar → gear → Uninstall (or code --uninstall-extension ITcredibl.ghcp-mem)
4. Delete ~/.ghcp-mem/ (the MCP mirror file)
5. Remove .github/instructions/session-memory.instructions.md from your workspace
6. Remove any cross-editor files (CLAUDE.md block / .cursor/rules) if injected

License

MIT — see LICENSE.

Report a bug · Request a feature · Live demo · Compare memory tools · Uninstall guide · Configuration reference · Contributing · Security policy

_{v1.17.1 · local-first memory for Copilot}