
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Your codebase remembers its decisions, conventions, and rules — and proves they're still true.
AI Dimag is a memory system for software engineering — not a general-purpose "AI memory" app. It gives any MCP-compatible agent (Claude, Cursor, Copilot, Windsurf…) a persistent memory of your codebase that survives across sessions — decisions, conventions, gotchas, failed approaches, guardrails, and reusable skills — stored as falsifiable claims with grounding evidence in .aidimag/ next to your code.
The subject of memory is your repository, not your preferences or chat history. Every capability — evidence, git-hook verification, guardrails, pre-commit checks, path-scoped recall, session scratchpad — exists to serve day-to-day development work.
Most memory systems store text and retrieve whatever is similar later — a stored fact is assumed true forever. That's dangerous in a codebase, where a confidently-retrieved stale fact is worse than no memory at all.
Every AI Dimag memory carries evidence (a shell check, an anchored commit, a test) that dim verify re-runs against the current repo — automatically, via git hooks, on every pull, checkout, and rebase. Beliefs that stop being true go STALE instead of silently misleading your AI.
.cursorrules, CLAUDE.md, AGENTS.md, etc.)npm install -g aidimag
Requires Node 22+. Ships two equivalent binaries: dim (short) and aidimag.
cd your-repo
dim init # creates .aidimag/, installs additive git hooks
dim bootstrap # optional: LLM-survey the repo into a starter memory set
dim review # approve what enters memory (nothing is stored unreviewed)
dim remember "All DB access goes through src/db/store.ts" -k INVARIANT -p src/db \
-e "STATIC_CHECK:grep -rL better-sqlite3 src --include=*.ts"
dim recall db access
dim verify # re-run all evidence; stale beliefs get flagged
dim brief # session-start briefing: in-scope memory, guardrails, gaps
# For non-MCP tools (Copilot, Cursor without MCP, etc.):
dim generate-context --format all --auto # creates .cursorrules, CLAUDE.md, AGENTS.md, etc.
Add to your agent config (e.g. .mcp.json for Claude Code):
{
"mcpServers": {
"aidimag": {
"command": "npx",
"args": ["-y", "aidimag", "mcp"],
"env": { "AIDIMAG_REPO": "/path/to/your/repo" }
}
}
}
MCP Tools get memory_search, memory_propose, context_note (live in-chat fact capture), memory_critique (a second critic grounded in verified memory), session-start briefings, session-end extraction, and more.
Non-MCP Tools: dim generate-context -f all renders verified memory into .cursorrules, CLAUDE.md, AGENTS.md, .windsurfrules, and .github/copilot-instructions.md (--auto keeps them refreshed).
Commits, PRs, AI-chat transcripts, and pasted docs are mined into proposals. Nothing enters memory until you approve it in dim review (auto-triaged best-first, approve all --min-score 0.7 for batches).
STATIC_CHECK / COMMIT_REF / TEST_RESULT / EXEC_TRACE / HUMAN_ATTESTED evidence. Failing evidence flips memories to STALE and auto-drafts a recovery proposal. Confidence decays without re-confirmation.
Shell-command evidence that arrives via team sync is never executed until you inspect and approve it (dim verify --trust).
FTS5 keyword + vector KNN (OpenAI or local Ollama, auto-detected; works keyword-only with neither).
Behavioral rules (never / ask-first / always) and step-by-step procedures, enforced by dim check (pre-commit) and memory_critique.
dim serve + dim sync: local-first replicas, device-code login, brain-scoped API keys, hashed credentials, cross-machine verification consensus.
Drop design docs / ADRs / PDFs / DOCX into knowledge/ and they're summarized into reviewed, pinned memories.
dim scratch (and the scratchpad_* MCP tools) hold short-term session notes — TTL-expiring, never synced, never durable memory. dim audit lists memories resting on the weakest ground (agent-authored, evidence-free, stale, or long-unverified) so you can fix them up like a dependency audit for your repo's knowledge.
dim ui plus VS Code and IntelliJ extensions.
AI Dimag follows a claim-and-verify model; other memory systems follow store-and-retrieve. The short version:
| Conversational memory layers | Vector-store memory plugins | Hand-maintained context files | AI Dimag | |
|---|---|---|---|---|
| Built for | Chat assistants remembering users | General recall over embedded text | Static instructions for coding agents | Coding agents in a living repo |
| Unit of memory | Extracted facts / chat summaries | Embedded text chunks | Prose | Falsifiable, typed claims with evidence |
| How memory gets in | Automatic capture | Automatic embedding | Manual edits | Human-gated review queue |
| When the code changes | Nothing — stored facts stay "true" | Nothing | File silently rots | Evidence re-runs via git hooks; broken claims flip STALE |
| Trust model | Write-time label, never re-checked | Similarity ≈ trust | "It's in the file" | Verification status + decaying confidence; trust-ranked retrieval |
| Enforcement | None — injection only | None | Hope the model reads it | Guardrails + pre-commit dim check + memory_critique |
| Failure mode | Confidently recalls outdated facts | Retrieves similar, true or not | Instructions drift from reality | Says "this went STALE" instead of guessing |
Full comparison: aidimag.com/comparison
|
Getting Started |
Reference |
Guides |
Full documentation: aidimag.com
Contributions welcome! See CONTRIBUTING.md for dev setup, project principles, and the PR checklist. All participation is governed by our Code of Conduct.
AI Dimag is open source under the MIT License — free for everyone, any team size, forever. Use it, fork it, embed it.
The entire local-first product is free: CLI, MCP server, verification, guardrails, skills, IDE extensions, local dashboard, and self-hosted team sync (dim serve).
Want team sync without running a server? AI Dimag Cloud is an optional managed sync subscription — that's how the project stays funded and open source. See Pricing.
Built by Anup Khanal
Website • Documentation • Cloud • npm • License
FAQs
Persistent, verified memory for AI coding agents. CLI: dim.
The npm package aidimag receives a total of 119 weekly downloads. As such, aidimag popularity was classified as not popular.
We found that aidimag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.