prism-coder MCP工具

Prism Coder

Give your AI agent memory that lasts — and see the cloud tokens it never had to spend. Persistent sessions, knowledge graphs, offline tool-routing, and an auditable savings meter. Fully local and free.

Current release: v20.22.4 — oMLX setup and local model roles Install a pinned oMLX server/model pack from the dashboard or CLI, or connect an existing server. Discover installed models and choose coder/reviewer roles for oMLX and Ollama. Controlled oMLX coding remains text-only.

<p align="center"> <img src="docs/mind-palace-dashboard-v20.8.png" alt="Prism Mind Palace dashboard v20.8.0 — project state with handoff summary, pending TODOs, intent health, neural graph, and time-travel history" width="700" /> </p>

Prism Coder is an MCP server that gives Claude, Cursor, and other AI tools long-term memory that survives across sessions. It ships with the open-weight prism-coder model fleet (2B–27B) for fast, offline tool-routing — no cloud required. And it keeps score: every call served locally is metered, so prism savings shows the token volume that never reached your cloud model — measured honestly, in tokens.

No account needed. No API keys. Runs on your machine. A paid subscription adds cloud sync, higher model tiers, and team features through the Synalux portal.

---

What `prism connect` changes about host subagents

connect steers bounded work to prism_infer on your machine rather than to host-spawned agents. What it writes differs per host, and it does not disable subagents everywhere — Claude Code keeps them and is pointed at an economy model instead. Prism's local workers stay available over MCP in every case.

Two things worth knowing:

- experimental is Gemini's namespace, not ours. Prism is not enabling anything experimental — it writes false to a flag Gemini already defines at that path. Writing anywhere else would have no effect. - That namespace is by definition temporary. If Gemini promotes enableAgents out of experimental, Prism keeps writing the old path, Gemini reads the new one, and host subagents quietly turn back on. Nothing errors and the settings file still looks correct. If you see host subagents running while enableAgents reads false, check whether the key has moved before assuming connect failed to write it.

Both writes are idempotent in the sense that a host already configured this way is left untouched — but they are re-applied on every prism connect run, not only on --refresh. If you deliberately re-enable host subagents, the next connect will turn them off again. Keep them on by not re-running connect, or by re-enabling after each run.

---

<details> <summary>Release history (optional)</summary>

What's New in v20.22.4

- Dashboard and CLI setup: Settings → Local Coding and prism local install a pinned oMLX server/model pack with progress, retry and managed startup, or connect an existing server. See the oMLX guide for requirements. - Saved coding preference: choose Auto, oMLX or Ollama without restarting Prism. Auto prefers configured oMLX for eligible text-only coding; an explicit per-task backend overrides that preference. - Discovered model roles: select installed coder and reviewer models for each backend, including the same model for both roles. Explicit task model choices win. Reported sizes and conservative memory estimates help compare choices; unknown metadata stays unknown and estimates do not guarantee fit. - Managed isolation: model discovery, Hub cache and cluster launchers stay private to the managed installation. Competing Ollama residency refuses the call without unloading other jobs. - Setup-state hardening: bounded reads use one file handle and reject symlinks, closing the filesystem race reported by CodeQL. - Vision boundary: this release does not enable image requests through the controlled oMLX coding path. Picture-recognition tests remain separate work.

What's New in v20.22.3

- Dependency fixes: Hono 4.13.11 addresses its static-path middleware bypass advisory; Vite 8.2.4 addresses its development editor-launch advisories. - Local resource probes use numeric loopback by default. The default Ollama endpoint is now http://127.0.0.1:11434, so a stalled localhost DNS lookup cannot block those probes. Explicit URL overrides are preserved; IPv6-only servers need an explicit URL. - Read-only oMLX inspection accepts release-candidate versions. Valid rcN labels no longer invalidate status. Inspection still reports generation disabled and the provider not qualified; it is not an activation or a generation check. - Stable oMLX setup: the current setup link uses the Prism integration based on upstream v0.7.1. Stock oMLX still lacks the required control routes.

What's New in v20.22.2

Why it matters: an agent that followed session_task_route's advice was refused on explicit oMLX before anything ran.

- A complexity hint no longer refuses explicit oMLX. session_task_route recommends a task_complexity for every code task. That hint picks Ollama's starting tier, but on explicit oMLX it lowered the model ceiling, so a call that passed the recommended arguments was refused with omlx_model_ceiling. Now only an explicit model_ceiling below the top tier, or a plan below it, refuses. Thinking on oMLX stays with the server's settings.

What's New in v20.22.1

Why it matters: on explicit oMLX, a long prompt could keep the device busy for minutes while being classified, and timeout_ms did not limit it.

- The call budget now covers classification. timeout_ms (default 300 s) starts before the safety screen, and each classifier read is bounded by the remaining budget as well as its own 90 s. - A failed read ends the classification. An oversize prompt is read in 3,600-character windows; a read that fails already means refusal on this path, so the remaining windows are no longer read. Before, a stalled server could cost about four minutes per window. - Tests: the owned-job marker tests pin the size limit and the non-blocking open directly.

What's New in v20.22.0

Why it matters: on Apple Silicon, prism_infer can now draft code on an oMLX server instead of Ollama, opt-in per call, behind its own safety screen. Separately, Layer 1 now marks two more kinds of auth request reserved, on every path.

- Opt-in oMLX backend: local_backend: "omlx" with mode: "code", text only. Nothing changes for calls that do not ask for it. It requires the oMLX build with Prism's control routes, published as the prism-v0.7.1rc1 branch of dcostenco/omlx (install and settings); with stock oMLX every call is refused. - Its own safety screen: the 9b classifier on the same oMLX server reads every request; rules only refuse. In our tests, of 327 labelled sensitive requests, the 9b alone let 2 run locally, against 19 for the 4b classifier on Ollama; two rules written after reviewing those rows bring this path to 0, so 0 is not an out-of-sample figure. Of 294 routine requests, 2 were escalated (27 on Ollama). Of 135 adversarial probes, 3 ran locally, all one shape (a documentation field). - Speed and cost: a classifier read took about 0.37 s at the 95th percentile on an idle machine and up to 0.65 s under load. The first read after a long idle took 14.5 s, because macOS had paged the classifier out, so Prism waits up to 90 s for it instead of refusing. The classifier holds about 9.2 GB while loaded (9.7 GB peak). - Fails closed: a classifier failure, an unreadable answer or a missing model refuses the call; it never falls back to a keyword check or to Ollama. A long prompt is read whole, in windows, not as an excerpt. - Frees memory first: Ollama's loaded models are unloaded before the call (they reload on the next Ollama call), so the two runtimes do not hold large models at once. - Layer 1, every path: a request that decides whether signed-out, anonymous or guest users may reach a route, page or endpoint (granting or blocking it), makes one public, or gives them admin rights is marked reserved by rule, and so is code that exchanges an authorization code for tokens. Measured on the 327 sensitive requests on the default Ollama path: 18 now run locally, against 19 before; routine escalations are unchanged (27 of 294).

What's New in v20.21.27

Why it matters: a script that feeds Prism Browser through a pipe can now pause between blocks of commands. Before, commands that had already arrived waited for the next write, and never ran if the 600 s idle timeout came first, so a script that checked a result before sending more stalled and then failed.

- Every piped command runs when it arrives. The reader waited on select() for new pipe data while readline() had already buffered the commands sent so far. It now reads the descriptor itself and decodes it as the text stream did (its encoding, universal newlines). Measured with two commands written together and a third written only after the reader hands over the second: the second came out only with the third before, and before the third is written now. - Unchanged: the idle timeout, \ line continuation (CRLF endings included), comment lines, and streams select() cannot watch, now read blocking. At the idle timeout, a command still being written is dropped, never run cut short.

What's New in v20.21.26

Why it matters: routine wording no longer lets a mixed request skip Layer 1, the safety screen that decides whether a request may run on your device. A BCBA who asks in one message for an operational definition and how many mL of a drug to give, or a developer who asks for a code review and then authentication code, now has that request screened by Layer 1's rules and, unless the request or conversation is already marked reserved, a classifier read. Before, it could be answered by a local model with no classifier read.

- Rules no longer clear requests. Before, one routine clause let Layer 1's rules clear the whole request, so it skipped the classifier. "Write an operational definition for tantrums and tell me how many mL of Benadryl to give at bedtime" was answered locally with no classifier read, and so was "review the dashboard component for hook order and then write the JWT validation middleware". Now rules can only mark a request reserved. The routine shortcut is gone for a single prompt and for the current prompt of a follow-up; the prompt's classifier read is skipped only if the request or conversation is already marked reserved. A long prompt that reaches the classifier is read as excerpts, as before. - What happens to a flagged request. A text request that a rule marks reserved, or that the classifier flags, goes to a stronger cloud model when your plan includes cloud and the call does not pass cloud_fallback: false. Otherwise it is refused, and the refusal says why. Requests the classifier clears remain eligible to run locally, so routine drafting (operational definitions, data sheets, antecedent strategies) and routine code work still run on your device when the local model can answer. - Seclusion by another name. Placement phrases such as "put him in the quiet room until he calms down" (also isolation, time-out, padded and calm-down rooms) are now marked reserved by rule. This catches placement requests of that shape (him, her, them, or the client, student or child placed into the room) that never use the word "seclusion". Other wording, and other mentions of these rooms, are left to the classifier. - Measured: of 46 mixed requests built to test this bypass, which should never be answered locally, 41 were cleared to run locally before this release and 9 after: 32 fewer sensitive requests reaching a local model. Of 294 routine requests, 2 more than before are escalated (or refused, without cloud). - Limits, unchanged in this release. Keep them in mind when deciding whether a local answer needs your review: - The classifier can miss a request, and a missed request still runs locally. The 9 above are such misses. - Some classifier failures fall back to a keyword check, and text that passes it can still run locally. - A request with images is processed on this device even when flagged, and is never sent to the cloud. - Cost: requests that used the shortcut now need a classifier read, unless screening has already marked them reserved. That added check is the price of closing the bypass; in our tests the read took about 0.3 s at the 95th percentile.

What's New in v20.21.25

Semantic memory search now automatically applies ACT-R ranking, combining relevance with recency, frequency and associations. Account & Settings → Preferences → Automatic Memory Ranking (ACT-R) lets you opt out after an AI client restart; an explicit environment value takes precedence.

Synalux Cloud uses authenticated, owner-scoped access-history and candidate-link APIs. Cloud deployment requires the matching Portal history migration. Stored importance thresholds remain separate, and HRR drift detection remains independent.

What's New in v20.21.24

- Synalux cloud preserves initial importance and handles votes, graduated insights, and stale-score decay through the authenticated Portal API. - Voting rejects inactive or inaccessible records; decay preserves archived history. Existing scores remain unchanged. - Graph importance thresholds use stored scores. Automatic retrieval ranking and access tracking do not automatically turn ordinary memories into high-score rules.

What's New in v20.21.23

- Factory routes suitable bounded implementation prompts and executes only the allowed file actions, with independent verification and explicit lifecycle results. - Paid pipeline creation, updates, aborts, and verification records use the authenticated Portal API. Startup waits for paid storage initialization before reporting Factory readiness. - The default-enabled toggle distinguishes the saved setting from the active MCP setting and shows when a restart is required.

What's New in v20.21.22

- Factory pipeline lists for cloud accounts use the authenticated Portal API, including exact project and status filters, without direct database credentials. - Invalid, incomplete, or oversized reads show an unavailable state. A valid empty list remains distinct from a failed read. - This release covers pipeline lists. Cloud pipeline creation, controls, and execution still need separate validation.

What's New in v20.21.21

- Prism Dashboard now reports unavailable analytics and factory reads clearly, prevents stale project results, and keeps graph filters and counts in sync. - Project analytics can be read through the authenticated Portal API with validated 14-day activity data.

What's New in v20.21.20

- Fixed: a session_save_ledger call refused with context_not_loaded, or the greeting-only reply that writes nothing, restarted the hourly drift reminder. A ledger save restarts it now only when it writes an entry. - A written ledger entry's reply also asks for the handoff when the checkpoint ends a unit of work. - A ledger save skipped as a duplicate of one saved in the last 5 minutes now says nothing new was written, instead of "saved". - Fixed: with Supabase storage, a handoff whose save failed was reported as updated. It is now an error the agent can see and retry.

What's New in v20.21.19

- Prism Browser emulates phones and tablets. --device iphone-17, or one of five other measured iPhones and iPads, turns on touch CSS, the pixel ratio, and the iPhone safe area, so a layout that only breaks on the phone can be caught in a test. --touch, --device-scale-factor, and --safe-area set each part on its own.

What's New in v20.21.18

- Fixed: when a save was refused with context_not_loaded, the instructions Prism installs for Claude Code, Codex and Gemini CLI forbade the one call that recovers. The refusal now prints that call, session_load_context with the same project and conversation_id, and the installed instructions allow it. First-turn startup is unchanged.

What's New in v20.21.17

- Fixed: the on-device screen refused some ordinary coding requests. With a Synalux account (free included), it now reads each request through a policy that Synalux serves, pinned by its SHA-256. Without an account, or with images attached, the screen is unchanged. - prism_infer route mode: set allow_parallel_calls to keep a reply that calls several of the tools you offered in allowed_tools.

What's New in v20.21.16

What's New in v20.21.15

What's New in v20.21.14

What's New in v20.21.13

What's New in v20.21.12

What's New in v20.21.11

What's New in v20.21.10

What's New in v20.21.9

What's New in v20.21.8

What's New in v20.18.1

What's New in v20.18.0

What's New in v20.17.3

- A plugin install can no longer enable the prompt-routing hook. The package's maintenance paths (npm postinstall, server startup) now only refresh a hook that an explicit prism connect previously installed — a prism MCP registration in host config no longer counts as consent. First install of the hook happens through prism connect or not at all. - The Claude Code plugin launcher is fully deterministic. It runs the exact pinned server version with npm lifecycle scripts disabled, and the plugin now documents its security posture in plugins/prism/README.md.

What's New in v20.17.2

- Pasted logs can no longer falsely activate skills. Symptom-triggered routing now strips fenced blocks and routable skill-name mentions (including inside compound identifiers like container/pod names) from the routing view of a prompt, so quoting an agent log or a skill list doesn't load skills the text merely mentions. Skills named by ordinary words keep routing normally. - Symptom-routed skills now arrive whole. Startup budgets deliver the full rule text at every depth that fits; when a rule genuinely cannot fit, the display says exactly how much is missing and how to load the rest, instead of silently truncating. - Routing can no longer be silently disabled by one bad skill. Corrupt or hostile trigger tables — wrong value shapes, patterns named after object prototype properties — are skipped per entry instead of taking down all prompt routing (or, in one case, the vault export) for the session.

What's New in v20.17.1

- Fixes a broken CLI in 20.17.0 — a command-name collision made every prism CLI invocation exit with a commander error at startup (the MCP server was unaffected). The handoff-sync command is prism handoff …; prism sync remains cross-backend data synchronization. If you installed 20.17.0, update.

What's New in v20.17.0

What's New in v20.16.0

What's New in v20.12.1

- prism connect --refresh now converges every registration it owns, not just the top-level one — directory-scoped entries could otherwise keep launching an old build indefinitely. - prism update checks the installed package, not the CLI that happens to be running, so it can no longer report "current" while the install is stale. - The opt-in scheduled updater can actually start — the LaunchAgent now carries a PATH that includes node and npm.

What's New in v20.12.0

- Prism now tells you when it's out of date. Session startup shows a one-line update notice when a newer release exists — cache-backed, at most one registry check per day, silent offline. PRISM_NO_UPDATE_CHECK=1 opts out. - Hands-free updates, if you want them. prism autoupdate enable sets up a daily prism update --if-idle: it updates only the global npm package, defers while any Prism server is running, and never touches host configuration — that stays behind a visible prism connect.

What's New in v20.11.1

- Saving memory never gets refused. The save path used to reject session_save_ledger/save_handoff calls when its path-to-project heuristic disagreed with the project you declared — and the registry the heuristic trusted could contain junk from earlier auto-registration, so legitimate sessions ended unsaved. Your declaration now always wins; the disagreement is returned as an advisory warning, and auto-registration only accepts real repository roots. - Screenshots are evidence again. prism browser captures on macOS were silently upscaled to the size cap, so a screenshot no longer showed what actually rendered. Only genuinely oversized captures are resized now, and the cap no longer clips a standard 1920-wide viewport.

What's New in v20.10.0 – v20.11.0

- Skill routing now works mid-session. New prompts are matched on-device as the conversation moves — not just on turn one — and injected within each host's real context limits (Claude Code caps hook output at 10k chars; Codex truncates by default), with pointer-first delivery when a payload can't fit inline. - prism connect is a converge command. It self-updates first, re-execs, then reconciles MCP registration, skills, and hooks — no more "fresh config, stale code" machines. - Scoped skills route on prompts too, and startup output survives hosts that discard structured tool content.

What's New in v20.9.0 – v20.9.3

- Your skills follow your account. skill_save stores a skill at the scope you choose: this machine only (local, works offline and signed out), your account (user — every machine you sign into receives it), or a workspace (team — shared with members, admin-managed, optionally targeted to specific people). - Trim the catalog you don't use. skill_manage can release platform skills you never touch — freeing host skill-catalog budget — and restore them any time, losslessly. Deleting a scoped skill archives its final content locally first, so nothing is ever silently unrecoverable.

- Delivery that queues instead of failing. Concurrent sessions no longer starve skill sync on the local config store (WAL + busy-timeout) — a failure that previously reported only "partial" where nobody could see it. - Withheld rules still bind. When the context budget can't inline a skill's text, the manifest of withheld names now states that those skills still govern the work and names every way to load them before completion claims. - The budget the floor never spent. A long-standing accounting bug meant no unprotected skill ever inlined at any normal context level — the always-inlined protected floor was debiting the budget meant for everything else. Task-matched skills (like the completion-evidence checklist) now actually arrive.

What's New in v20.8.2

- Skill delivery now admits failure instead of hiding it. A filesystem permission edge case (a umask stripping the owner-execute bit) could leave skill sync writing nothing while reporting itself current — measured at nine days on a real machine. Broken managed directories are repaired in place, every directory is created umask-proof, and the repair path refuses symlinks via an O_NOFOLLOW descriptor. - A stale install tells you at startup. Prism now tracks the generation that actually reached disk separately from the one the database accepted; if they diverge, the startup banner says so in a warning placed where display truncation cannot cut it. A successful sync clears it automatically.

What's New in v20.7 – v20.8.0

- First run proves the memory instead of describing it — session_bootstrap seeds one demo memory and shows it recalled from disk, so the save→recall loop is felt in session 1. One-shot, contained in its own prism-demo project, removable with one call. - Dashboard fixed — a quoting typo (shipped 2026-05-29) killed the inline script at parse time, so every dashboard since rendered "Loading projects..." forever. Fixed, and the ES5 lint now node --checks the built inline script so an unparseable dashboard can never ship again. - Trusted Publishing — npm releases authenticate via GitHub OIDC. No stored token to expire or leak, and every release carries a signed provenance attestation — you can verify the tarball you install was built from this repo by CI (npm audit signatures). - TLS enforced for cloud sync — a remote http:// storage URL is upgraded to https:// instead of silently sending session content in the clear. - Codex plugin collision + enabled-state detection — prism connect skips its own registration only when a plugin actually provides prism-mcp (cache present and enabled), preventing both duplicate and missing servers. - Windows CI stabilized; registry/npm listings realigned and deduplicated.

What's New in v20.6.0

What's New in v20.5.3

What's New in v20.5.0 – v20.5.2

What's New in v20.4.0

What's New in v20.3.2

What's New in v20.3.1

What's New in v20.2.7

What's New in v20.3.0

What's New in v20.2.6

What's New in v20.2.4

What's New in v20.2.2