Artificial intelligence tools have become remarkably good at remembering code. Coding assistants are supported by convention files, repository maps, session memory, memory banks, and external memory frameworks, so they can return to work knowing details of architecture, style, refactoring history, and flaky tests. But the same assistants lack an equivalent if a user asks a question about health, personal finance, past decisions, or relationships. Personal context tends to live in vendor memory features, such as ChatGPT Memory or Claude Memory, or it does not exist in a portable form. This article argues that users need a separation of concerns: personal context belongs in storage the user controls, not in an AI vendor's silo.
The open implementation described below connects a private Git-hosted Markdown vault to multiple LLM surfaces through a single remote Model Context Protocol, or MCP, endpoint. The system, vault-mcp, treats a folder of notes as a linked Obsidian vault and exposes it to claude.ai on the web, desktop apps, phones, and Claude Code in the terminal. The project also produced Zod AOT, an open-source ahead-of-time schema compiler, needed because edge platforms forbid runtime code generation, a restriction that silently disables the fast path of the TypeScript validation library Zod.
Key facts
- Coding AI assistants already have mature context tooling based on project files, repository maps, memory banks, and general-purpose memory frameworks.
- Personal context tools are largely locked to individual vendors, with no portable memory standard.
- The proposed fix separates context storage from assistant vendors, using user-owned Markdown stores connected through the open MCP protocol.
- vault-mcp implements the idea with a GitHub repository, an Obsidian vault, and a remote MCP server that works with multiple assistant surfaces.
- Edge platforms ban runtime code generation, which disables Zod's hidden just-in-time fast path; Zod AOT restores speed by compiling schemas at build time.
- As MCP spreads into e-commerce and new device categories, user-owned context can make assistants more personal, portable, and durable.
Coding context is almost solved
The modern developer has a rich set of context tools. Convention files are the simplest layer. Claude Code uses CLAUDE.md; cross-tool projects use AGENTS.md; Cursor and GitHub Copilot have their own rule files. These project-level files tell an agent how the codebase is organized and how to behave. Above them sit structural tools: repository maps compress the shape of a codebase into a context window, while code indexers and code-search integrations let an agent retrieve the exact file it needs. Persistence layers add memory across sessions. Cline's Memory Bank pattern stores structured notes, Cursor offers session memories, and Claude Code maintains a memory directory. Teams building agents on their own can choose general-purpose memory frameworks such as mem0, Letta, and Zep, which provide retrieval pipelines, ranking, and temporal knowledge graphs that track when a fact stopped being true.
The coding context ecosystem is crowded because the problem is well shaped. Code lives in repositories, is versioned, and has a structure that tools can exploit. The context is already stored independently of any single LLM prompt, and assistants can be pointed at it without losing provenance.
Personal context is an afterthought
Outside the terminal, the picture changes. Conversational use is the larger everyday LLM pattern for many people. Users ask questions grounded in their own situation: recent bloodwork trends, real portfolio exposure, previous vendor evaluations, or the promises made in earlier emails. Useful answers depend on personal context, yet the tooling is thin. Where memory exists, it usually lives inside ChatGPT, Claude, Gemini, or another assistant. Each tool remembers within its own boundary but not across them. Memory does not travel. Portability, when offered at all, arrives as a one-directional import controlled by the destination vendor. A person who switches assistants or uses several will see context fragment into inconsistent silos.
The extensible memory frameworks used by coding agents do not solve this either. mem0, Letta, and Zep are developer infrastructure for building agent products, not personal data stores. They keep memory in their own repositories, recreating lock-in one level down: a user can leave ChatGPT's silo but enter a startup's silo. The deeper question is why personal context should live inside any assistant at all. The answer proposed here is to decouple storage from the vendor.
A user-owned context layer
The basic architecture is plain and portable. Personal context is kept as plain text Markdown in a private GitHub repository, organized as an Obsidian vault, and exposed through an authenticated MCP endpoint. MCP matters because it is an open protocol rather than a proprietary SDK. A single server can serve claude.ai, the desktop app, a mobile app, and Claude Code in the terminal, allowing all of them to read and write the same notes. Any MCP-capable client can join in principle, so no vendor license is needed for interoperability. The neutrality of the design comes from the storage format, not from a platform. The corpus remains plain, open files in a Git repository. Leaving a vendor costs exactly git clone. A user never has to file an export request or wait for companies to agree on a migration format.
Transparency also improves. What an assistant knows about a user is a folder of readable, diffable files. Vendor memory products are now beginning to offer similar transparency, but user-owned storage had the property from the start. GitHub and Markdown are choices, not requirements. The principle asks only that context is outside the assistant in a store the user controls, accessible over MCP. A Google Docs store with a Docs MCP server works, as does a Notion workspace with a Notion MCP server. Each choice changes trade-offs: Git-hosted plain text maximizes portability and auditability, while a hosted workspace adds convenience. The separation between storage and assistant is the part that creates durable freedom.
Security by conservative defaults
Implementation choices carry more than plumbing because they define the security posture. vault-mcp runs on serverless edge infrastructure and uses the GitHub API as transport, so no personal computer has to remain powered on and the project fits into free tiers. Writes are append-only in a specific sense: an assistant can create or overwrite a note but cannot delete one. Every change becomes a Git commit, which makes the history auditable and enables rollback of any write. Authentication separates who can connect from what the server can touch, using two scoped credentials to limit damage if one leaks.
There is another subtle risk. When a personal knowledge base is exposed to LLMs, the notes themselves become untrusted inputs. A malicious instruction buried inside a note could act as a prompt injection the moment a model reads it. The server therefore treats retrieved notes as data rather than as instructions. Append-only behavior and path restrictions act as backstops. These are conservative defaults because the payload is small in volume but enormous in sensitivity: it is everything a person knows.
The edge constraint that forced a new tool
Serving the context vault from edge infrastructure was the right choice for zero maintenance, but it exposed an issue in a surprising layer: request validation. An MCP server is a public API. Every assistant tool call arrives as untrusted input and must be validated before touching storage. TypeScript developers usually reach for Zod, and the official MCP SDK is built around it. Zod's current performance comes from a hidden just-in-time compiler. The first validation of a given object shape generates specialized JavaScript for that shape and compiles it at runtime; later validations use the specialized code. Edge platforms such as Cloudflare Workers consider runtime code generation a security hazard in multi-tenant environments and forbid it. Zod detects the platform and falls back to a slower interpreted route.
That environment was exactly the one where the ecosystem's most common validator could not run at full speed. The solution followed Zod's own insight: schemas are static. They are written at development time and do not change during server execution. If specialized code cannot be generated at runtime, it should be generated at build time. The result is Zod AOT, an open-source compiler that transforms Zod schemas into flat JavaScript validation functions during the build. Because no code is produced during execution, the compiled validators work on edge runtimes and any other restricted environment. Because no compilation happens on the first request, there is no cold-start penalty. Benchmarks cited in the project show compiled validators checking complex nested objects up to sixty times faster than Zod's normal path, with a wider gap on edge platforms where Zod's fast path is unavailable. Schemas that embed arbitrary functions are partially compiled, and the remaining parts fall back to Zod unchanged. vault-mcp now validates every tool call with precompiled validators.
MCP turns chat into a way to act
The case for separating storage from vendor becomes stronger as MCP adoption spreads. MCP is becoming the standard method for connecting LLMs to external services. Every service that exposes an MCP endpoint makes chat a place where concrete work happens. E-commerce is one example. If a store exposes product search and checkout over MCP, an assistant can find a product, compare it with alternatives, and make a purchase in one conversation. A user-owned context layer makes the advice genuinely personal because the assistant can also read notes about sizes, budgets, past purchases, and disappointments. It can even recommend against buying, something a recommendation engine built for a seller is unlikely to do.
Service providers may not all welcome this shift. An MCP checkout shortens the time spent on a store's website and routes around the merchandising and advertising systems that generate e-commerce revenue. Some platforms will defend a destination site; others may decide it is better to be available where the customer already is. The user retains the context layer regardless of which path the market takes.
MCP also delivers device independence. A remote context vault does not assume a laptop or a smartphone. It is exposed through a protocol rather than an application-specific system. Future device categories such as smart glasses, wearables, home devices, and vehicle assistants can access the same vault in the same way as desktop clients today. There is nothing to migrate and no per-device memory that must be rebuilt from an empty state.
What this design accepts
The approach is not free. A user-owned vault does not offer ranked retrieval or a temporal model that knows when an individual fact has expired. Dedicated memory frameworks remain better for high-volume, automated recall. For one person's corpus of hundreds of notes, it is reasonable to let the assistant decide through tool use which notes to read, and that is the scale the system targets. Markdown-over-MCP servers and git-backed vault servers already exist. What is distinctive is the specific combination of user-owned storage, open-protocol access, no always-on host, conservative write semantics, and reuse of a build-time validator. The assistant is replaceable; the context is not.
Personal context affects finance, health, work, relationships, and decisions made over decades. Because edge platforms increasingly shape modern services, the work that went into Zod AOT offers a general solution for any team that validates data on the edge. The same separation principle that lets a lifelong knowledge store survive vendor changes helps embedded validation code run in environments where JIT-style shortcuts are illegal. For high-volume agent memory, a simpler vault should not replace dedicated infrastructure; for personal use, the trade is compelling. The last line of defense is not a clever ranking model but the knowledge that the files can be read and moved by their owner. That distinction keeps the proposal grounded in uncomfortable but manageable limitations.
Source: TNW | Contributed News