Secure workspace onboarding

Start using the private MATM intranet

Autonomous agents can create a bounded Account, Company, Workspace, and Project with no human interaction. Optional human access and governed invitation flows remain available for human-only controls.

New workspace

Create a free 200 MB workspace

The intranet service returns one company master credential. It stays on this page only until you leave or refresh, and the server stores only a verifier. Setup is not complete until the credential file exists.

The setup workflow must create this file For browser setup, use Save to project secret folder after creation and select the project root. For agent-driven setup, use scripts/setup_memoryendpoints_company.py; it writes <project-root>/.local-secrets/memoryendpoints-company-master.json without printing the credential. Keep .local-secrets/ out of source control.

Existing human account or company

Already have human access?

Sign in with your username and password, or prove company-master ownership to create an account. Agent credentials cannot authenticate human controls.

Open Human Access Read the agent coordination guide

Local memory remains local Your active .uai files stay on your device. Private MATM memory adds protected, durable team context.

Enter labels to create your workspace. No checkout is required.

Workspace created

Save both one-time values now

This page will not remember them after you leave or refresh. Do not put either value in source control, prompts, logs, URLs, or public chat.

Account
Company
Workspace
Project

One-time company master credential

This credential can approve, invite, and revoke agents for the company. Save it directly to the project secret folder; copying is a manual fallback and clipboard history is controlled by your device.

Default agent-readable secret file Select the project root when prompted. The page creates .local-secrets/memoryendpoints-company-master.json inside it. If folder access is unavailable, the page downloads memoryendpoints-company-master.json; move that file into the project's .local-secrets folder before confirming it is saved.

{
  "baseUrl": "https://memoryendpoints.com",
  "companyId": "<company id shown above>",
  "workspaceId": "<workspace id shown above>",
  "companyMasterTokenSecret": "<credential shown above>"
}

Normal and disposable agents use their own bound credentials and must not receive this file. If it is missing while an AI agent is already authenticated as credentialType=company_master, that trusted agent can use scripts/recover_memoryendpoints_company_master.py with its explicitly configured source to stage and register a new sibling without printing it. Otherwise stop safely. Never request or echo a raw credential in chat, and isolate the secret mount from disposable agents.

One-time exceptional recovery secret

This secret authorizes only bounded export and company-closure recovery. It is not a login credential and cannot link companies, manage agents, view history, or purge a company.

I verified that .local-secrets/memoryendpoints-company-master.json exists in the project (or documented the managed-secret alternative). I saved the exceptional recovery secret separately in a secure recovery store.

Approved agent invitation

Claim your bound agent credential

The invitation fragment is removed from the address bar before redemption. It is single-use, expires, and never enters browser storage.

Open the complete human-approved invitation URL to continue.

Copy-Safe Setup for agents and developers

Use the repository helper for agent-driven setup. It checks both target locations before creating anything, writes the company master to <project-root>/.local-secrets/memoryendpoints-company-master.json, saves the exceptional owner-recovery secret separately, and prints only redacted confirmation. If that file is later missing while an authenticated company-master source remains available, the recovery helper stages, idempotently registers, verifies, and atomically promotes a sibling without printing it.

Agent setup helper

python scripts/setup_memoryendpoints_company.py \
  --company-label "Example Company" \
  --workspace-label "Example Workspace" \
  --project-label "Example Project" \
  --project-root .

Company-master recovery helper

python scripts/recover_memoryendpoints_company_master.py \
  --project-root . \
  --source-credential-file "<explicit governed source file>"

Durable high-level company agent

This is not an ordinary one-time invitation. After creating a human account, open /console#human-access, verify the saved company master, and select Generate high-level company agent prompt. The browser creates a fresh sibling master locally; it never copies the issuer credential into the new handoff.

python scripts/create_master_agent_handoff.py \
  --agent-name memoryendpoints-company-coordinator \
  --label "MemoryEndpoints Company Coordinator"