IBEX Harness
Skip to content

§01 · Open source · Agent memory infrastructure

Agent memory belongs on the request path.

IBEX Harness turns the proxy into the place where identity, context, and eventually memory are applied. Auth, directives, and mock/live forwarding are live now; memory retrieval joins that same ingress in Phase 3.

Read the docs →View on GitHub
~/ibex — zshv0.1
# illustrative ingress trace
$ POST /v1/chat/completions
auth ok · directives attached
✓ 200 · sample 17.4ms
teaser · one ingress
live now
memory next

§02 · CAPABILITIES

Memory that follows the agent, not the prompt.

The proxy is the injection point. Auth, directives, and telemetry already sit on the same path.

  • [01] AGENT_MEMORY

    Persistent agent memory

    ROADMAP

    A memory graph that follows the agent across calls. The same ingress that handles auth, directives, and tracing becomes the place where recalled context is injected.

  • [02] INGRESS_PROXY

    The proxy is the injection point

    LIVE

    OpenAI-compatible ingress for every chat request. It already applies policy, directives, and forwarding in one place, so memory does not need app-specific glue.

  • [03] TENANT_AUTH

    Tenant auth + rate limits

    LIVE

    gRPC auth validation and per-org Redis limits protect the edge. Tenant boundaries are enforced before traffic reaches any model provider.

  • [04] TELEMETRY

    Observable by default

    LIVE

    Structured logs, Prometheus metrics, and request traces expose what happened on every call. Operators can inspect latency and behavior without sampling raw prompts.

§03 · REQUEST PATH

How one call moves through the system.

Intake, auth, context, then forward — four steps on one ingress.

  1. 01 · Ingress

    Agent request

    OpenAI-compatible request enters one org-scoped ingress.

  2. 02 · Control

    Validate + limit

    Auth verifies the token and agent; Redis applies per-org limits.

  3. 03 · Context

    Directives + session context

    System directives and sticky session state are attached before forwarding.

  4. 04 · Execution

    Forward + trace

    The call is forwarded and traced. Proxy overhead budget is p99 under 20ms, excluding upstream latency.

§04 · LOCAL STACK

Run the full stack locally.

This is the practical setup path: clone the repo, seed the dev data, bring up proxy plus auth, and verify the health endpoint before you wire an agent to it.

  • Proxy on :8080
  • Auth gRPC on :9091
  • Postgres with RLS — Redis for rate limits — ClickHouse traces
  • Prometheus + OTel exporters wired
~/ibex — zshcompose
# compose the phase-2 stack
$ git clone https://github.com/Rick1330/ibex-harness.git
$ cd ibex-harness
$ make db-migrate && make db-seed
$ make compose-dev-up
ibex-proxy  | Listening on :8080
ibex-auth   | grpc on :9091
postgres    | ready for connections
redis       | Ready to accept connections ✓
# Hit the proxy
$ curl -s localhost:8080/health | jq .
{ "status": "ok" }
local setup · phase 2

P99 PROXY BUDGET

< 20ms

OPEN SOURCE LICENSE

MIT

TENANT ISOLATION MODEL

RLS

PROXY + AUTH SERVICES

Go

// READY WHEN YOU ARE

Start with the ingress.
Grow into memory.

Run the authenticated control plane today, then follow the Phase 3 roadmap for extraction, ranking, and injection on every LLM call.

Get started →View benchmarks