The layer, in detail.
Everything below is deterministic code. No stage calls a model, holds a model API key, or guesses.
Connect a host, keep the key
One local step is unavoidable, and it is the point of the design: the key is generated on your machine and the server never sees it.
Myelin is pre-release with no self-serve signup. Hosted access is by invite: your invite carries a token that looks like myl_pat_… and is shown once. Local mode needs no invite at all. The hosted instance is one small server, no uptime promise; myelin pull brings your whole brain home at any moment.
Install the binary, once
One command. It fetches the build for your platform, verifies its checksum, and installs into a directory already on your PATH — no sudo. Needed even for the hosted server: your first key has to be made locally, and nothing on the server could create one for you.
Run the wizard
In the project directory you want Myelin to serve. One question decides everything that follows:
This machine only (the default, and the better option for one laptop): a brain is created in ./.myelin/, your host is wired over stdio, and you are done. No account, no network — the key never exists anywhere else.
Hosted server: paste your invite token, pick or create a brain, and the wizard does the rest — the key is generated here and stored in your OS keychain, a connector token scoped to that one brain is issued, your host is wired, and setup ends with a live round-trip against the real endpoint. It finishes with proof, not hope.
Creating a brain prints a 24-word recovery phrase, once. Write it down, on paper, before pressing Enter. Your key exists in exactly two places: your keychain and that phrase. Lose both and the brain is unrecoverable — by you, by the server, by anyone. There is no reset path, by design.
The hosted trade-off, stated plainly: wiring a hosted brain puts its key in a connector header, so that host platform now holds your key. That is the price of reaching a brain from more than one machine. One laptop only? Choose local — the key never leaves the machine.
Check the connection
Restart your host. It should list Myelin's eighteen tools, four resources, and the myelin-loop prompt — Claude Code shows it under /mcp. Any MCP host works; the wizard prints the three headers for hosts it cannot wire itself.
A first task
Use the host the way you already do. Setup has written a Myelin section into your standing-instructions file, so the assistant knows to call recall and match_process before it starts, and to record what it learns as it goes.
Worth doing deliberately on day one: state the conventions you re-explain every week. Myelin does not read your conversation — nothing is stored until the assistant calls a tool — and phrasing decides what survives that call. "We squash before merging, from now on" passes the durable test and can be stored as a standing preference; "squash this one" is refused by design, so a passing remark cannot harden into a permanent rule. Then work normally; after the third success in a task family, or the second time the same correction is logged, a proposal appears:
Bring notes you already have
Point Myelin at a folder of Markdown — an Obsidian vault, a docs directory — and each file becomes one memory, keyed by its path so a second run supersedes a changed note rather than duplicating it. A note renamed in your editor is followed, not duplicated. Anything that looks like a credential is refused, file by file.
That first run links the folder: the path is saved in the brain, and every session from then on re-reads it at startup, so notes you add between sessions arrive on their own. It is a folder you named, read at a moment you can predict — Myelin still watches nothing on its own. myelin serve --vault-sync=false turns it off.
Checking on it
The Markdown export exists so Myelin is never the only thing that can read your brain.
myelin tree lists a directory one path per line — the artifact the project-tree standard reads, so a layout becomes something validate can grade rather than something you argue about. Dependency and version-control directories are excluded by default, and the exclusion list is held to the standard's own by a test. It is a command and not an MCP tool on purpose: both transports share their tool handlers, so a tool that walked a directory would walk the server's disk for anyone who asked.
Scripting it
Every answer the wizard asks for can be a flag, so provisioning a machine is one non-interactive line — including the standing-instructions note, which is written by default on both paths. --auto-invoke takes auto, none, or an explicit list of files. Running your own server is also supported — the full procedure is in deploy/RUNBOOK.md.
Nothing is overwritten
A correction writes a new fact and supersedes the old one, so what you believed last March is still there when it matters. Recall is FTS5 top-40, scored by relevance × trust, fitted to a byte budget, then one hop along edges. Trust is computed at read time and never stored.
The way work gets done, portable
Workflows and skills are served to the host as native MCP prompts, so process travels to whichever model you are using. Matching is deterministic keyword matching on word boundaries — "test" does not fire on "latest". Multi-word triggers must match as phrases, and count double.
Every brain is seeded with a starter pack: skills for designing a visual, writing a test, reviewing a diff, and structuring a project — where a thing belongs, what to call it, and what shape the tree should take. A skill carries judgement only. What a regex can settle instead lives in a standard, so the two never argue.
Validation with an address
A deterministic validate grades output against your standards — fourteen checker primitives, a closed set, about 6ms per 100KB with no model in the loop. Every violation carries the rule, the line, the column, and a fix.
It proposes; you decide
Outcomes are logged as episodes and structured records — the assistant calls log_outcome at the end of a task and names what it had to be corrected on. When the same correction is logged twice, or a family of tasks keeps failing, the reflector raises a proposal for you to accept or reject. Accepting takes a snapshot first. Nothing rewrites itself unasked, and safety-relevant settings can never be written automatically at all.
Seven stages around one task
Eighteen tools, four resources, and the myelin-loop prompt. Four stages answer before the model works, one it stays out of, two after.
Where the key lives, and where it cannot
32-byte key generated here. OS keychain + 24 words on paper — the only copies.
TLS only, a header per request. Plaintext → 426 refused.
Key + decrypted brain in /dev/shm while a session is open. Closed and zeroed after 10 idle minutes.
Ciphertext + a 16-byte one-way verifier. Rejects a wrong key; cannot recover the right one.
At rest, the server holds ciphertext and a verifier. Disk theft, a stolen backup, a snapshot of the volume — all yield nothing readable.
The residual risk, stated plainly: root on the server, during an active session, can read that session's brain out of RAM. On the hosted instance, root means the project owner.
Key loss is final. Keychain plus the 24-word phrase are the only copies. Lose both and no one can help, by construction.