Five sources.
One origin.
Agents trust a claim more each time they read it. Echo traces every claim back to where it came from, and counts the independent origins instead of the repeats.
Agent memory counts how often it heard something. Not who said it first.
Memory poisoning is an active research problem. MPBench finds that a single adversarial memory write can steer an agent long after it lands, and MemForm finds broad susceptibility at every memory-formation interface it tests. Memory systems rank by frequency and recency. None ask whether the repeats are independent.
Planted posts
One paid post, copied and reworded across five sites, reads to an agent as consensus.
Circular citations
A wiki cites a local paper that copied the wiki. Two sources, one unverified edit.
Self-echo
An agent re-reads its own earlier summary and counts it as fresh evidence. No attacker needed.
A reflection is not a second witness.
In the myth, Echo could only repeat the last words she heard, and Narcissus took his reflection for someone else. Memory that counts repetitions makes both mistakes. Echo is built to catch them.
Ask once. See which sources were really one.
The same research agent answers twice, once on a plain memory and once on Echo. The plain one recommends the planted vendor. Echo shows its work. Scroll to follow one run.
The agent shows its work
Ask a question and every tool call streams in: semantic recall from the vector index, then an independence check per belief, with the Cypher it ran and how long FalkorDB took.
It says what it caught
Five pages call Halcyon the safest gateway. Echo finds they trace back to one origin, so the claim stays disputed, and the agent recommends the vendor with independent support.
The proof, as a diagram
Lineage reads left to right: the planted post, the copies that carried the claim, the belief. Every edge says why: verbatim copy, link, same figures. The plain agent's own note carries zero weight.
Retract, and watch it fall
Flag the planted post and every belief built on it is rescored in the same request. Disputed becomes retracted, one origin becomes zero, in milliseconds.
Link. Collapse. Decide.
// a new page that reuses two precise figures
MATCH (a:Source {id:$copier}), (b:Source {id:$original})
MERGE (a)-[r:COPIED_FROM]->(b)
SET r.method = 'shared-specifics',
r.evidence = 'same precise figures: 1,284, 99.982%'
Same claims, same scoring rule. Only the counting changes.
30 seeded scenarios: 18 poisoned claims spread by two to six echo pages, and 12 genuine claims with independent support.
poisoned claims it would state as fact
12 of 12 genuine claims trusted
poisoned claims it would state as fact
12 of 12 genuine claims trusted. The caution is not blanket doubt.
Which echoes Echo catches
A reworded copy with no link, no shared figures and a different owner leaves no trace, and Echo counts it as independent. That case is in the set on purpose: it is the one poisoned claim Echo still trusts, and chains built on such a copy inherit the miss. Claims are given to both systems as annotations, so this measures lineage and scoring, not LLM extraction. Rerun it with uv run python -m echo_memory.evaluate.
Your model. Your agent. Your sources.
Start free on Echo's default model, or bring your own key for any provider. Plug the memory into the agent you already use. Feed it pages, papers and notes.
A memory you can run your work on.
Bring your own model
Pick a provider and a model in settings. Your key stays in your browser and travels only with your own requests; the server never stores it.
A trust policy per memory
Decide how many independent origins make a belief verified: one for exploring, three for clinical or legal work. Every belief is rescored when you change it.
Many memories
One for each project, client or agent team. Name them, switch between them, export one as JSON and import it anywhere.
Memory your agent can reach
Every memory has its own MCP address. Your agent reads and writes the same graph you are looking at, with the same verdicts.
Retraction that propagates
Flag a source as wrong and every belief built on it, through any chain of copies, is rescored in the same request.
Runs anywhere
FalkorDB and the API ship as one container. Use the hosted studio, or run your own on a laptop or a server you control.
Take the graph away and Echo cannot count origins.
FalkorDB is not storage beside the agent. Every verdict is a traversal, and the agent's tools are graph queries and graph algorithms.
Ancestry walks
One variable-length traversal finds every upstream ancestor of a belief's sources.
(s)-[:CITES|COPIED_FROM|DERIVED_FROM*0..8]->(a)Proof paths
shortestPath returns the hop-by-hop chain from each copy back to its origin, with evidence.
WITH shortestPath((a)-[*1..8]->(b)) AS pLoad-bearing origins
PageRank over lineage ranks the origins the most beliefs rest on, with blast radius.
CALL algo.pageRank('Source', null)Content rings
Label propagation over copies and shared ad or affiliate IDs surfaces coordinated sites.
CALL algo.labelPropagation({...})Recall in the same graph
Beliefs carry embeddings in a vector index, so recall and lineage never leave the database.
CALL db.idx.vector.queryNodes('Belief', ...)A graph per visitor
Each visitor gets a private graph cloned from a template in milliseconds. Agents query it read-only.
GRAPH.COPY · GRAPH.RO_QUERYGive any agent this memory.
Echo ships as an MCP server. Point Claude Code, Cursor or your own agent at it and the independence check becomes a tool the model can choose.
{
"mcpServers": {
"echo": {
"type": "http",
"url": "https://echo-memory.onrender.com/mcp/"
}
}
}
- echo_recallBeliefs relevant to a query, with verdicts
- echo_checkOrigin clusters and lineage paths for one belief
- echo_ingestStore a source; lineage is inferred
- echo_rememberWrite a note linked to what it came from
- echo_retractRetract a source and rescore dependents
- echo_load_bearingPageRank origins and blast radius
- echo_cypherRead-only Cypher over the memory
FAQ
Who is Echo for?+
Anyone whose agents read the web and remember what they read: research and diligence agents, support and sales copilots, security and compliance assistants, newsroom fact-checkers. If an agent's answer can be steered by repeating a claim, Echo is the check.
Is it free?+
The hosted studio is free and runs on a free model. Bring your own key for a stronger or private model. You can also run the whole thing yourself in one container.
Where do my API keys go?+
Nowhere you didn't send them. They are kept in your browser's storage and sent as headers with your own requests to the Echo API, which uses them for that request and keeps nothing.
What does Echo catch, and what does it miss?+
Verbatim and paraphrased copies, hyperlinks, shared identifiers, shared precise figures, shared owners and ad or analytics fingerprints, chains of copies, citation loops, and an agent's own notes. A reworded copy with no link, no shared figures and a different owner leaves no trace; the eval reports that case honestly.
How is this different from other agent memory?+
Most memory layers decide what to keep and how relevant it is. Echo decides how much to believe it: it counts independent origins, so repetition stops passing for evidence. It complements a memory store; it can also be the store.
Why a graph database?+
Every verdict is a reachability question over lineage, and retraction is the same walk in reverse. FalkorDB answers both in milliseconds, runs the graph algorithms (PageRank, label propagation, components), and keeps the vector index in the same place.