Prism Coder

Give your AI agent memory that lasts — and see the cloud tokens it never had to spend. Persistent sessions, knowledge graphs, offline tool-routing, and an auditable savings meter. Fully local and free.

Prism Coder is an MCP server that gives Claude, Cursor, and other AI tools long-term memory that survives across sessions. It ships with the open-weight prism-coder model fleet (2B–27B) for fast, offline tool-routing — no cloud required. And it keeps score: every call served locally is metered, so prism savings shows the token volume that never reached your cloud model — measured honestly, in tokens.

No account needed. No API keys. Runs on your machine.
A paid subscription adds cloud sync, higher model tiers, and team features through the Synalux portal.

---

What Prism gives you

• Session memory that survives restarts — resume projects with handoff notes, recent work, open TODOs, and configurable quick, standard, or deep context.
• Local-first inference — bounded work is routed through local Ollama models first, with automatic 2B/4B/9B/27B selection based on installed models, available RAM, context fit, and subscription entitlements.
• A savings meter you can audit — prism savings (or the local_savings tool from any host) reports the token volume local serving kept off your cloud model: headline, local share, per-model breakdown. It reports tokens, never an invented dollar figure, and prints its assumptions and known undercounts inline — a number you can check, not marketing.
• Route-output enforcement — route mode returns only well-formed calls to tools the host actually advertised. Standard and higher plans can add authenticated deterministic correction; route_guard: "local" keeps the prompt and draft entirely on-device.
• One setup for every agent — prism connect configures Claude Code, Claude Desktop, Cursor, Gemini CLI, and Codex while preserving unrelated settings.
• Subscription-aware skills — entitled skills are synchronized before the host launches, with safe upgrades, downgrades, conflict preservation, and offline last-good recovery.
• Hook-free startup — MCP metadata and native instructions request Prism's startup context without requiring lifecycle hooks or a Prism-owned launcher. Where a host offers hooks (Claude Code, Codex), prism connect adds two small ones on top: mid-session prompt routing, and a post-compaction re-injection of the protected-floor digest.
• Safe escalation and observability — inference outcomes are explicit, reserved content remains fail-closed, and local/cloud usage is recorded for review.

Get started

npm install -g prism-mcp-server
prism connect

Use prism connect --dry-run to preview changes, prism connect --all to configure every detected host, or prism connect --refresh to reconcile Prism-managed entries after an upgrade. Restart the host after connecting.

Prism works locally without an account, API key, or cloud subscription. Add a Synalux subscription when you want cloud memory, paid-tier skills, or team features.

After a few sessions, ask what it's been worth:

prism savings --period month

💾 Local serving — LAST 30 DAYS
  ~510K tokens kept off your cloud model
  53 call(s) served locally of 58 routed (91%)

Your numbers will differ — that's the point: it reports what your machine actually served, not a projection. Full report anatomy and the honesty rules behind it are in the local_savings section.

Install as a plugin

Prism also ships as a plugin, which registers the MCP server and the startup skill for you.

Both hosts install straight from this repository. There is nothing to host and no server to run: the catalogue is the .claude-plugin/marketplace.json file committed here, and your client clones it from GitHub.

Claude Code:

claude plugin marketplace add dcostenco/prism-coder
claude plugin install prism-coder@prism

Codex:

codex plugin marketplace add dcostenco/prism-coder
codex plugin add prism-coder@prism

The plugin registers prism-mcp via npx -y prism-mcp-server. If you already configured Prism by hand — prism connect writes an mcp_servers.prism-mcp entry — you have that server twice under one key. Install the plugin or run prism connect, not both.

What prism connect changes about host subagents

connect steers bounded work to prism_infer on your machine rather than to host-spawned agents. What it writes differs per host, and it does not disable subagents everywhere — Claude Code keeps them and is pointed at an economy model instead. Prism's local workers stay available over MCP in every case.

Host	Setting written	Effect
Claude Code	env.CLAUDE_CODE_SUBAGENT_MODEL = "sonnet" in ~/.claude/settings.json	Subagents stay enabled, pinned to an economy model. Fan-out is discouraged by policy text, not by config
Gemini CLI	experimental.enableAgents = false in ~/.gemini/settings.json	Subagents off. Gemini exposes one boolean, so that is all there is to set
Codex	features.multi_agent = false in $CODEX_HOME/config.toml (default ~/.codex), plus a bounded fallback: 2 threads, depth 1, cheap subagent model, 900s cap	Subagents off, with a bounded profile underneath so a deliberate re-enable lands somewhere sane

Two things worth knowing:

• experimental is Gemini's namespace, not ours. Prism is not enabling anything experimental — it writes false to a flag Gemini already defines at that path. Writing anywhere else would have no effect.
• That namespace is by definition temporary. If Gemini promotes enableAgents out of experimental, Prism keeps writing the old path, Gemini reads the new one, and host subagents quietly turn back on. Nothing errors and the settings file still looks correct. If you see host subagents running while enableAgents reads false, check whether the key has moved before assuming connect failed to write it.

Both writes are idempotent in the sense that a host already configured this way is left untouched — but they are re-applied on every prism connect run, not only on --refresh. If you deliberately re-enable host subagents, the next connect will turn them off again. Keep them on by not re-running connect, or by re-enabling after each run.

---

What's New in v20.18.0

The protected floor rides the bootstrap — and survives compaction

• session_bootstrap now inlines a digest of the protected floor on paid tiers at standard and deep depth: one inert line per rule, derived from each skill's first paragraph (or its pinned digest:), plus its section map, ~5.6K chars for the full floor. Small-context hosts such as Codex were re-reading the sixteen SKILL.md files every session (median 8 re-reads / 36KB, worst 823 / 5.1MB in rollout logs) because the bootstrap only named them. The digest is paid for on top of the context budget, so the ledger/handoff share at every depth is byte-identical to before. Quick depth stays names-only — the opt-out.
• A second hook re-injects the digest after compaction. prism connect registers the prism-route script on SessionStart matched to compact (Claude Code and Codex); it runs prism floor-digest, which applies the same tier and depth decisions as the bootstrap, and adds nothing on startup/resume/clear. Hosts without hooks (Gemini, Cursor) still get the digest on every bootstrap. Codex: UNVERIFIED against a live compaction. The hook is registered and the script accepts the documented payload spellings, but no Codex compaction has been observed end-to-end; on a payload it does not recognise it re-injects nothing rather than something wrong. If the digest comes from a generation whose skill files never finished syncing, the re-injected block carries the same STALE warning the bootstrap shows.
• Codex trust is reported honestly after a hook rewrite. Approvals are keyed by definition hash, so a rewritten hooks.json — this release adds the SessionStart entry — voids prior trust: connect prints AWAITING TRUST for both entries instead of a green ✓ for a hook Codex would silently skip, and trust recorded for an older hook version is never mistaken for current.
• A host config that no longer parses is left alone. If ~/.claude/settings.json or ~/.codex/hooks.json exists but is not valid JSON, connect keeps it byte-identical, registers no hook there, and says so — it no longer replaces the file with a minimal hooks-only one. The npm postinstall notice says the same, instead of asking you to trust a Codex hook it never registered.
• Fixed: a symptom-routed skill whose closing frontmatter fence is its last line was inlined with its YAML (triggers included) as if it were the rule.
• Fixed: a digest line that crosses into a new section keeps that section's heading in front of it — whatever opened the section (an H2, a mid-document H1, an empty heading, a setext underline) — so "Delegate to" / "Do NOT delegate" rules cannot read with the wrong polarity once joined. A skill file on disk is used only when it digests: empty, cut off inside its frontmatter, or frontmatter-only files fall back to the stored copy instead of rendering YAML as the rule.
• Fixed: on Windows, a Codex hook approval is recognised even though Codex stores the path with escaped backslashes.
• The publish gate now refuses release notes that run ahead of the package version (CHANGELOG, README, translated READMEs) — reading the newest version on the heading line, so a v20.17.3 – v20.18.0 range counts as 20.18.0, and surviving a typographic apostrophe or a BOM.

What's New in v20.17.3

• A plugin install can no longer enable the prompt-routing hook. The package's maintenance paths (npm postinstall, server startup) now only refresh a hook that an explicit prism connect previously installed — a prism MCP registration in host config no longer counts as consent. First install of the hook happens through prism connect or not at all.
• The Claude Code plugin launcher is fully deterministic. It runs the exact pinned server version with npm lifecycle scripts disabled, and the plugin now documents its security posture in plugins/prism/README.md.

What's New in v20.17.2

• Pasted logs can no longer falsely activate skills. Symptom-triggered routing now strips fenced blocks and routable skill-name mentions (including inside compound identifiers like container/pod names) from the routing view of a prompt, so quoting an agent log or a skill list doesn't load skills the text merely mentions. Skills named by ordinary words keep routing normally.
• Symptom-routed skills now arrive whole. Startup budgets deliver the full rule text at every depth that fits; when a rule genuinely cannot fit, the display says exactly how much is missing and how to load the rest, instead of silently truncating.
• Routing can no longer be silently disabled by one bad skill. Corrupt or hostile trigger tables — wrong value shapes, patterns named after object prototype properties — are skipped per entry instead of taking down all prompt routing (or, in one case, the vault export) for the session.

What's New in v20.17.1

• Fixes a broken CLI in 20.17.0 — a command-name collision made every prism CLI invocation exit with a commander error at startup (the MCP server was unaffected). The handoff-sync command is prism handoff …; prism sync remains cross-backend data synchronization. If you installed 20.17.0, update.

What's New in v20.17.0

Cross-Machine Session Handoff — End-to-End Encrypted

• Resume a session on any of your machines. With prism handoff enable (paid, off by default), each session_save_handoff seals the handoff to all your account's device keys and relays the CIPHERTEXT; another machine pulls with sync_pull_handoff (or prism handoff pull <project>) and opens it locally.
• The relay stores ciphertext only — X25519 + AES-256-GCM sealed envelopes. No key that opens a handoff ever exists server-side. The channel is deliberately separate from savings sync, which carries counters only.
• TOFU device pinning surfaces a compromised relay: sealing to a key this machine has never seen warns loudly, keyed on the client-derived recipient id so a swapped key can't hide behind a familiar device name.
• prism handoff status|devices to inspect; revoke a lost machine from the portal.

What's New in v20.16.0

See What Local Serving Saves You — Meterable, Auditable, Team-Wide

• local_savings tool + prism savings CLI — the token volume local serving kept off your cloud model: all time, trailing 30/7 days, or any --days N window. Tokens, never an invented dollar figure, with the assumptions and known undercounts printed inline.
• Team roll-up (paid) — prism savings --sync-enable uploads per-day counters only (never content; the payload is a closed field set the server also enforces); prism savings --team shows the workspace-wide total with per-member share. Off by default.
• E2E sync foundation — sealed multi-recipient envelopes (X25519 + HKDF-SHA256 + AES-256-GCM on node:crypto, no new dependency) and per-device identities, adversarially reviewed: cross-machine session sync will ship on a relay that only ever stores ciphertext.
• Push-time public-leak guard — outgoing diffs AND commit messages are scanned before anything leaves the machine.

What's New in v20.12.1

• prism connect --refresh now converges every registration it owns, not just the top-level one — directory-scoped entries could otherwise keep launching an old build indefinitely.
• prism update checks the installed package, not the CLI that happens to be running, so it can no longer report "current" while the install is stale.
• The opt-in scheduled updater can actually start — the LaunchAgent now carries a PATH that includes node and npm.

What's New in v20.12.0

• Prism now tells you when it's out of date. Session startup shows a one-line update notice when a newer release exists — cache-backed, at most one registry check per day, silent offline. PRISM_NO_UPDATE_CHECK=1 opts out.
• Hands-free updates, if you want them. prism autoupdate enable sets up a daily prism update --if-idle: it updates only the global npm package, defers while any Prism server is running, and never touches host configuration — that stays behind a visible prism connect.

What's New in v20.11.1

• Saving memory never gets refused. The save path used to reject session_save_ledger/save_handoff calls when its path-to-project heuristic disagreed with the project you declared — and the registry the heuristic trusted could contain junk from earlier auto-registration, so legitimate sessions ended unsaved. Your declaration now always wins; the disagreement is returned as an advisory warning, and auto-registration only accepts real repository roots.
• Screenshots are evidence again. prism browser captures on macOS were silently upscaled to the size cap, so a screenshot no longer showed what actually rendered. Only genuinely oversized captures are resized now, and the cap no longer clips a standard 1920-wide viewport.

What's New in v20.10.0 – v20.11.0

• Skill routing now works mid-session. New prompts are matched on-device as the conversation moves — not just on turn one — and injected within each host's real context limits (Claude Code caps hook output at 10k chars; Codex truncates by default), with pointer-first delivery when a payload can't fit inline.
• prism connect is a converge command. It self-updates first, re-execs, then reconciles MCP registration, skills, and hooks — no more "fresh config, stale code" machines.
• Scoped skills route on prompts too, and startup output survives hosts that discard structured tool content.

What's New in v20.9.0 – v20.9.3

• Your skills follow your account. skill_save stores a skill at the scope you choose: this machine only (local, works offline and signed out), your account (user — every machine you sign into receives it), or a workspace (team — shared with members, admin-managed, optionally targeted to specific people).

• Trim the catalog you don't use. skill_manage can release platform skills you never touch — freeing host skill-catalog budget — and restore them any time, losslessly. Deleting a scoped skill archives its final content locally first, so nothing is ever silently unrecoverable.

• Delivery that queues instead of failing. Concurrent sessions no longer starve skill sync on the local config store (WAL + busy-timeout) — a failure that previously reported only "partial" where nobody could see it.

• Withheld rules still bind. When the context budget can't inline a skill's text, the manifest of withheld names now states that those skills still govern the work and names every way to load them before completion claims.

• The budget the floor never spent. A long-standing accounting bug meant no unprotected skill ever inlined at any normal context level — the always-inlined protected floor was debiting the budget meant for everything else. Task-matched skills (like the completion-evidence checklist) now actually arrive.

What's New in v20.8.2

• Skill delivery now admits failure instead of hiding it. A filesystem permission edge case (a umask stripping the owner-execute bit) could leave skill sync writing nothing while reporting itself current — measured at nine days on a real machine. Broken managed directories are repaired in place, every directory is created umask-proof, and the repair path refuses symlinks via an O_NOFOLLOW descriptor.
• A stale install tells you at startup. Prism now tracks the generation that actually reached disk separately from the one the database accepted; if they diverge, the startup banner says so in a warning placed where display truncation cannot cut it. A successful sync clears it automatically.

What's New in v20.7 – v20.8.0

• First run proves the memory instead of describing it — session_bootstrap seeds one demo memory and shows it recalled from disk, so the save→recall loop is felt in session 1. One-shot, contained in its own prism-demo project, removable with one call.
• Dashboard fixed — a quoting typo (shipped 2026-05-29) killed the inline script at parse time, so every dashboard since rendered "Loading projects..." forever. Fixed, and the ES5 lint now node --checks the built inline script so an unparseable dashboard can never ship again.
• Trusted Publishing — npm releases authenticate via GitHub OIDC. No stored token to expire or leak, and every release carries a signed provenance attestation — you can verify the tarball you install was built from this repo by CI (npm audit signatures).
• TLS enforced for cloud sync — a remote http:// storage URL is upgraded to https:// instead of silently sending session content in the clear.
• Codex plugin collision + enabled-state detection — prism connect skips its own registration only when a plugin actually provides prism-mcp (cache present and enabled), preventing both duplicate and missing servers.
• Windows CI stabilized; registry/npm listings realigned and deduplicated.

What's New in v20.6.0

Delivery Is Not a Suggestion

An audit of a real incident (an agent wiped demo data after announcing the wipe — with the ask-first rule committed, bundled, and absent from what any agent actually received) found the protected floor had outgrown every delivery budget: "unprotected" had quietly come to mean "never delivered".

• ask-first and feature-preservation join the protected floor (14 → 16). Protected skills are always inlined; these two now reach every session.
• Sync conflicts are loud and named. Startup used to say "· 2 local conflicts preserved" while safety skills sat months stale; it now names each frozen skill and states how to resume updates.
• --storage accepts auto and synalux — the CLI rejected its own documented default and the production backend.
• Disclosure: skill delivery informs; it does not gate. A live probe showed a host agent still edit unverified source with the rule loaded. If your threat model includes an agent acting against a loaded rule under task pressure, pair this package with mechanical gates (hooks, permissions, least-privilege roles). True of every prior release; stated from this one.

What's New in v20.5.3

Grounding Evidence Carries Its Age

Memory-grounded answers labelled their sources but never dated them, so a two-year-old note and yesterday's reached the model identically. Nothing in the evidence let it discount the stale one. Prompted by an external review naming the right risk for local-first memory: the data stays local, but bad grounding becomes permanent — storing everything on your machine removes the outside pressure that would otherwise surface a stale note.

Evidence now reads:

[SOURCE 1: ledger:8286581d (recorded 2025-05-29, 431 days ago)]

The date already existed in storage and was being dropped at the snippet layer, so this is plumbing rather than new data collection. Zone-less SQLite timestamps are normalised to UTC — read as local, a ten-minute-old record parsed hours into the future and its age was suppressed entirely, meaning the feature silently did nothing on the freshest memories. An absent or unparseable date renders as nothing rather than defaulting to now; defaulting would make the oldest memories, the ones most likely to be stale, appear freshest.

tests/integration/grounding-staleness.test.ts runs the reviewer's own probe — seed a deliberately outdated note beside a contradicting fresh one and assert the model receives both, visibly dated. Anyone can run it.

Not solved, and not claimed: retrieval does not weight recency. A stale note shown beside a fresh one is the easy case — the model sees both dates and can weigh them. The hard case is a stale note retrieved alone, because ranking is by keyword match and an old store returns old results; then the age label is the only defence and there is no fresher record to compare against. Tracked as TECH_DEBT.md #4.

What's New in v20.5.0 – v20.5.2

The First Message Never Leaves Your Machine