Up: promotion
Validated insights move up only with approval.
- To Team when at least 3 people independently confirm it
- To Project by a project lead
- To Organisation by governance
Personal memory is private and is never promoted.
Product
How cMCP works
A governed shared memory that your people and their AI assistants read from and write to, with every step checked against who is asking, where they are working and what they have been granted.
1. Scopes
Seven scopes, from company-wide to private
Plain words: company-wide, then project, then client, then team, then person, then the person's AI app, then private notes. Each piece of knowledge lives in exactly one place, and is inherited by everyone it applies to.
| Scope | What lives here |
|---|---|
| Organisation | Company-wide knowledge: standards, policies, shared definitions. |
| Project | Knowledge for one programme of work, shared by everyone on it. |
| Client | Everything about one client, walled off from every other client. |
| Team | What a group of people has learned and confirmed together. |
| User | A person's own working memory. |
| Agent | The memory of that person's AI app, working on their behalf. |
| Personal | Private notes. Visible only to the person, and never promoted. |
Available now All seven scopes are built and running in our live pilot.
2. Flows
Three governed flows move knowledge between scopes
Down: inheritance
When a higher scope changes, every affected person's AI gets the update. New members inherit context immediately, instead of spending weeks being briefed.
Across: synthesis
Team knowledge can be merged into project knowledge. This is off until an admin switches it on, and it always needs approval.
3. A worked example
From a private note to an organisation standard
An illustrative scenario showing how a single useful insight travels through the scopes. The names and details are invented for explanation.
-
A personal note
An engineer jots down a private note: a particular supplier's drawings need a specific revision check before release. It sits in her Personal scope. Nobody else can see it, and it will never be promoted on its own.
-
Her AI app proposes it
At the end of a session, her AI app drafts a session summary. She reads it and confirms it before anything is saved. The useful insight is proposed as a fact for her team, not written straight in.
-
Team: after 3 confirmations
As colleagues hit the same issue and independently confirm it, the fact reaches the threshold of at least 3 people. It then becomes part of Team memory, and every team member's AI inherits it.
-
Project: a lead approves
The project lead reviews the fact and approves it for the whole project. Everyone working on the programme now starts with it, including people who join next month.
-
Organisation: governance decides
If the insight deserves to become a company standard, governance approves it at Organisation level. Every earlier version is kept, and the audit log records who approved what and when.
4. Context pack
A running start for every AI task
When an AI app begins a task, it asks cMCP for a context pack: the memory inherited for its place in the organisation, meaning its organisation, project, client, team and user. The pack comes with a manifest, so the app can refresh cheaply later instead of fetching everything again.
The result is less repeated context-setting. Memory is returned labelled as data, and text that looks like instructions is flagged, so retrieved memory is never mistaken for a command.
Available now
Behind every result
- Hybrid search: meaning plus keyword, re-checked against permissions on every result
- Client walls: a client's memory is returned only while working on that client or a linked project
- Audience labels: internal (default), restricted (named people only, bots never read) and external_ok (safe for outside replies, set by a lead)
- Versioning: every update keeps the previous version
5. Connectors
Read-only by design
cMCP learns from the systems you already use, but it never writes into them.
Available now Available now
- Jira Cloud
- PostgreSQL views
- IMAP mailboxes: chosen folders only, with the sender domain verified
- Git repository addresses mapped to projects (the code itself is not read)
Connectors feed proposed facts into an approval queue. Nothing they find becomes shared memory until a person approves it.
Built and in testing In testing
- Microsoft 365 mail, Teams and drives
- Google Drive
- GitHub
Built and in testing. Anything that does not pass testing will be removed.
See the integrations page for the full picture.
6. Caller rights
An AI app never has more rights than the person behind it
Every request carries who is asking, which app is calling and where they are working. cMCP gives an AI app the smaller of the person's own rights and a time-limited grant. An agent can therefore never see or change more than its user could.
Bots and digital workers have their own identity and a human sponsor. They can read and propose within their grants, but they can never approve. If an app misbehaves, a kill switch suspends that app or bot immediately.
Controls that follow from this
- Governed writes: nothing reaches a shared scope without a role, a time-limited grant or an approval
- Feature switches per level (organisation, project, team, client, user, bot); lower levels can only restrict
- Session summaries confirmed by the person, or the bot's sponsor, before they are saved
- Audit of every allow and deny
See how cMCP could work in your organisation
We are onboarding a small number of design partners to the pilot programme. Tell us about your teams and the AI tools they use, and we will scope a pilot together.