跪拜 Guibai
← All articles
Backend · GitHub · Agent

OneSelf Gives Every AI a Single User-Owned Context Profile

By 超级东哥CyberFD ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Most agent memory lives inside a vendor's platform, with no export and no revocation. OneSelf demonstrates a self-hosted pattern where identity data stays on your machine, and agents are granted scoped, human-approved access that can be withdrawn at any time.

Summary

Every AI interaction still starts with a self-introduction: your stack, your tastes, your history. That personal data usually ends up locked inside one vendor's memory system. OneSelf turns it into a user-owned layer. The system stores context as Markdown pages and attachments, keeps the originals in S3-compatible object storage, and projects parsed metadata into PostgreSQL for search. Agents discover an instance through `/.well-known/pcp`, then read and write over HTTP or MCP, but each permission is scoped per source directory, approved by a human, and revocable per key.

On the protocol side, a single operation registry in `packages/operations/src/registry.ts` drives both HTTP routes (with OpenAPI) and MCP tools, so the two interfaces can't drift. Key creation is HTTP-only and requires owner identity, so an Agent can't mint its own credentials. Authorization supports API keys and OAuth 2.1 device code, and facts carry confidence scores and validity dates, so an Agent knows when to doubt data. Edits are versioned (50 versions per page) and deletions are soft for 30 days. The stack is TypeScript on Node 24 with Hono 4, React 19, PostgreSQL 18, and RustFS, and a one-line installer sets it up with Docker Compose.

Takeaways
— Context is stored as Markdown pages with frontmatter metadata; attachments (JPEG, PNG, WebP, GIF, PDF, max 20 MiB) hang off pages.
— Facts in the `## Facts` block include `confidence` and `valid_until`, so an agent knows how reliable they are and when to re-ask.
— Timeline entries follow `date | event | note` and can be appended by agents via `add_timeline_entry`.
— Edits are incremental with version checks, keep 50 versions, and reverting writes a new version instead of overwriting.
— Deletions are soft, with a 30-day window for restore (`restore_page`).
— A discovery document at `/.well-known/pcp` tells an agent the protocol version, auth header format, public endpoints, upload limits, OpenAPI/MCP endpoints, OAuth URLs, and Skill address.
— A product Skill named `oneself` installs with `npx skills add https://your-site -a <agent> -s oneself -y`.
— All operations are defined once in `packages/operations/src/registry.ts`; HTTP routes, OpenAPI, and MCP tools derive from that single table.
— Key-management operations (`create_api_key`, `list_api_keys`, `revoke_api_key`) exist only over HTTP, never as MCP tools, and require owner identity.
— Authentication supports API Key and OAuth 2.1 device code; both require human approval, and the device code flow keeps an agent from ever seeing the admin password.
— Authorization scopes are per source directory, with separate read/write/visibility controls; agents see private pages as if they don't exist.
— Site changes can be previewed by agents with `site:write`, but going public requires a human to approve.
— The stack is TypeScript strict, Node.js 24, Hono 4, React 19, PostgreSQL 18, and RustFS (S3-compatible); MCP uses Streamable HTTP.
— The service runs as a single Node process serving PCP, MCP, OAuth, admin UI, and public sites; deployment is via Docker Compose with a one-line installer.
— The repository is MIT-licensed; a live instance is at <https://chenfudong.win/>.
Conclusions

Keeping key creation and revocation off the MCP surface is a clean, enforceable way to prevent an agent from escalating its own access; most agent APIs treat key management as just another tool, which invites self-granted privileges.

Relying on confidence scores and validity periods treats agent-maintained data as probabilistic rather than authoritative; that's a more honest model than the typical "remember everything" memory store.

The single operation registry that generates both OpenAPI and MCP is the pragmatic answer to dual-interface drift; it makes consistency a property of the code, not a discipline.

Concepts & terms
Device Authorization Grant
An OAuth 2.1 flow where a device without a browser displays a user code; the user approves on another device. In OneSelf, an agent requests a code, the user approves in the admin UI, and the agent polls for a token, never touching the password.
PCP
OneSelf's protocol name for reading and writing a user's context; exposed via a discovery document at `/.well-known/pcp`. Not yet an industry standard.
Projection
In OneSelf's storage, PostgreSQL holds parsed views of Markdown pages and attachments (tags, links, facts, timeline) separate from the source-of-truth object storage; a broken database can be rebuilt from originals.
Source directory
A named category (e.g., `profile`, `career`, `health`) that scopes an agent's access; permissions are granted per source, with separate read/write/visibility controls.
Soft delete
Deleting marks data as removed but keeps it recoverable for 30 days via `restore_page`, rather than permanently erasing it.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗