Hive Vault

hive-vault

Your AI coding assistant forgets everything between sessions. Hive fixes that.

Hive is an MCP server that connects your AI assistant to an Obsidian vault. Instead of loading everything upfront, it queries only what's needed — on demand.

Metric	Without Hive	With Hive
Context loaded per session	~800 lines (static)	~50 lines (on demand)
Token cost for context	100% every session	0.6% for five project-context queries (real vault, 493K tokens)
Knowledge retained between sessions	0%	100% (in vault)

Only the token-cost row is a measurement (5 project-context queries on a real 493K-token vault; method and numbers in the benchmarks). The line counts and the retention row describe how the two setups work; they are not measured.

Quick Start

Hive runs without a vault — vault tools return a friendly error until VAULT_PATH is set, so you can install first and configure later.

# Minimal — uses default vault path ~/Projects/knowledge
claude mcp add -s user hive -- uvx --upgrade hive-vault

# With a custom vault path
claude mcp add -s user hive -e VAULT_PATH=$HOME/path/to/vault -- uvx --upgrade hive-vault

# Gemini CLI
gemini mcp add -s user -e VAULT_PATH=$HOME/path/to/vault hive-vault uvx -- --upgrade hive-vault

Default vault path: ~/Projects/knowledge. Override with VAULT_PATH (or HIVE_VAULT_PATH) as shown above.

For Codex CLI, GitHub Copilot, Cursor, Windsurf, and other clients, see Getting Started.

Then ask your assistant: "Use vault_list to see my vault"

Requirements

Hive degrades gracefully — every recommended or optional dependency reveals more capability without breaking the baseline.

• Required

  • Python 3.12+ (works on 3.13).
  • A directory of markdown files. The vault structure used by 00_meta / 10_projects / 50_work / 80_agents is optional — without it, vault tools still operate but the scope routing is flat.

• Recommended

  • git initialised inside the vault. Without it, vault_write / vault_patch still write to disk; they just skip the per-write commit (and vault_commit reports the working tree as untracked).
  • The Obsidian desktop app to author the vault by hand.
  • The obsidian-git plugin with auto-commit set to 5–10 minutes. Pair it with vault_write(commit=False) / vault_patch(commit=False) to push the git workload off the synchronous tool path; see Recommended configuration below.

• Optional

  • Any OpenAI-compatible /v1 endpoint as the worker for delegate_task / capture_lesson, set with HIVE_WORKER_BASE_URL, HIVE_WORKER_API_KEY and HIVE_WORKER_MODEL.
  • A backup git remote (e.g. private GitHub repo) so vault history survives a disk loss.

Recommended configuration

Per ADR-006 (commit policy), the recommended pairing for write-heavy flows is:

1. Install and enable the obsidian-git plugin in your vault.
2. Set its auto-commit interval to 5 or 10 minutes.
3. Call vault_write(..., commit=False) and vault_patch(..., commit=False) for all bulk operations.
4. Optionally call vault_commit(message="...") at the end of a session to force a checkpoint sooner than the obsidian-git tick.

vault_health reports a ## external_committer block when it detects obsidian-git in the vault. The commit=False durability contract is explicit: files are persisted to disk regardless; only the commit is deferred. A crash before the next flush loses the commit, not the content.

When a tool call is cancelled mid-flight (slow worker, client timeout), the server may have already mutated the disk before the cancel ack reaches the wire. vault_health surfaces a ## ghost_responses counter and emits a mcp.ghost_response.suppressed_after_cancel_ack WARNING for each event — verify state via vault_query rather than retrying, since the ErrorData ack does not imply rollback (ADR-007).

Daemon mode (optional)

The default uvx hive-vault runs a fresh server per session. Daemon mode instead runs one long-lived hive serve that owns the vault, with each stdio-only session connecting through hive client. The adapter starts without importing the Hive server or FastMCP, then relays JSON-RPC to the daemon's stable loopback endpoint. If the daemon or credential is unavailable, it fails explicitly rather than starting a competing in-process owner.

The default endpoint is a deterministic per-user port in 49152..65535, so an ordinary daemon restart does not invalidate client configuration. Override it with HIVE_DAEMON_PORT in both the daemon and every client environment when the derived port conflicts with another local service. hive serve --port changes only the daemon's bind port; it does not reconfigure hive client or hive delegate. Hive fails closed rather than silently moving to a different port. The owner-only bearer token persists across ordinary restarts in the daemon state directory. daemon.port remains diagnostic migration metadata, not client discovery state. See ADR-022.

Security hold: Until #456 is resolved, do not deploy daemon mode on untrusted multi-user hosts. The endpoint serves TLS with a per-user certificate that Hive's clients pin, so an impostor on the fixed port fails the handshake before any bearer is sent; the hold stays until the Linux and Windows evidence, including the cross-user check, is recorded.

uv tool install --upgrade hive-vault   # >= 1.32.0
hive service install                   # supervise hive serve (systemd --user / Task Scheduler)
hive service status                    # exit 0 only if the listener proves the daemon's certificate

Run hive client from your MCP host. A host that can verify the daemon's certificate may connect directly to https://127.0.0.1:<derived-or-overridden-port>/mcp (for Node-based hosts, NODE_EXTRA_CA_CERTS pointing at daemon.crt in the state directory); never disable verification, and note that http:// no longer works. Never print or copy the token into logs or shell history.

To install a newer release, use the platform-specific command:

# Linux / macOS
uv tool upgrade hive-vault

# Windows (the version is optional; omitted selects the latest PyPI release)
hive self-upgrade [version]

On Windows, self-upgrade builds the release beside the running files and atomically switches the managed runtime, avoiding in-use-file conflicts. Open a new terminal after the first managed upgrade so its PATH change is available. Once supervised, the daemon detects the new installed version, exits 75, and the supervisor restarts it into the new code. See the daemon mode guide and the activation runbook.

Tools

Tool	What it does
vault_query	Load project context, tasks, roadmap, lessons — or any file by path
vault_search	Full-text search with metadata filters, regex, ranked results, recent changes, lesson-usage ranking (rank_by)
vault_list	Browse projects and files with glob filtering
vault_ask	Optional semantic Q&A with source citations; disabled until an embeddings backend is configured ([semantic] extra)
vault_health	Server identity (version, vault path, backends), health metrics, drift detection, usage stats, opt-in runtime block
vault_write	Create, append, or replace vault files. commit=False defers the git commit for batching
vault_patch	Surgical find-and-replace. commit=False defers the git commit for batching
vault_commit	Flush pending commit=False writes into one git commit
vault_delete	Delete one file, committed synchronously so it stays recoverable from git history
capture_lesson	Capture lessons inline / batch-extract from text / look up existing lessons by keyword (find=)
session_briefing	Tasks + lessons + git log + health in one call
delegate_task	Route tasks to cheaper models or summarize vault files
worker_status	Budget, connectivity, available models

Plus 5 resources and 4 prompts for guided workflows.

Lesson reinforcement

Every read of a lesson via vault_query, vault_search, or capture_lesson(find=…) increments a counter and grows that lesson's confidence asymptotically toward 1.0. Validated lessons rank higher than one-shot captures over time.

# Surface the top-ranked lessons matching a keyword
capture_lesson(project="hive", find="multi-process")

# Search lessons ranked by usage signal (not BM25)
vault_search(query="timeout", rank_by="reinforcements")    # most-reinforced first
vault_search(query="timeout", rank_by="confidence")        # highest decayed confidence
vault_search(query="timeout", rank_by="hybrid")            # α=0.7 BM25 + 0.3 confidence

Storage: SQLite side-table at HIVE_LESSON_DB_PATH (default ~/.local/share/hive/lesson_reinforcement.db). WAL mode + busy_timeout make it cross-process safe.

Architecture

MCP Host (Claude Code, Gemini CLI, Codex CLI, Cursor, ...)
    └── hive-vault (MCP server, stdio)
            ├── Vault Tools (9) ── Obsidian vault (Markdown + YAML frontmatter)
            ├── Session Tools (1) ── Adaptive context assembly
            └── Worker Tools (3) ── one OpenAI-compatible endpoint, no internal fallback

Documentation

Full documentation at mlorentedev.github.io/hive:

• Getting Started — install for all MCP clients
• Configuration — all 19 environment variables
• Vault Structure — how to organize your vault
• Use Cases — real-world workflows
• Architecture — module map and design decisions
• Troubleshooting — common issues and fixes

Project-bound knowledge (docs-as-code) lives in docs/:

• docs/adr/ — Architecture Decision Records
• docs/runbooks/ — operational procedures
• docs/troubleshooting/ — known issues and root-cause write-ups
• docs/lessons.md — accumulated gotchas and post-mortems

Contributing

See CONTRIBUTING.md for setup and PR workflow.

git clone https://github.com/mlorentedev/hive.git && cd hive
make install   # create venv + install deps
make check     # lint + typecheck + test (478 tests, 90% coverage)

License

MIT