Reflection

One brain, three models.

Published July 10, 2026

The moment the thesis stopped being a thesis

A year ago we wrote that agents are just markdown files — that the logic of an assistant shouldn’t be trapped inside whichever vendor you happened to build it with. Any AI that reads the file becomes that agent: Claude, GPT, DeepSeek, it doesn’t matter. At the time that was a claim about the architecture of the project, not something we had proven across vendors in practice.

This week it stopped being a claim. Not with more agents — with shared memory, which is the harder half. Three MCP clients, from three different places, are now reading and writing the same local brain. And the newest one is from a different AI vendor entirely.

Three clients, three vendors

Until this week, EIDARA’s local brain was read and written by two MCP clients: a multi-model aggregator, and Anthropic’s Claude desktop app. This week we added a third — OpenAI’s Codex desktop app, with a GPT model behind it.

All three point at the same local MCP server. All three read the same compiled brain — 588 notes today, compiled into a single file of about 18,500 tokens that every assistant reads at the start of a session. All three write to the same inbox of facts. And none of them had to be modified for another to join. That’s the whole point. The aggregator already spoke to several models, so multi-model itself wasn’t new. What’s new is that a client from one LLM vendor now connects to the same brain as a client from another, with no architectural friction between them.

How it connected

The mechanics were mundane, which is the best kind of milestone. Codex’s desktop app configures its MCP servers in a TOML file rather than the JSON that other clients use. The block is small:

[mcp_servers.DARA]
command = "uv"
args = ["run", "--script", "path/to/your/dara-server"]
startup_timeout_ms = 30000

The one snag worth writing down: the client has to be granted full local access before it’s allowed to launch a local process. Without that, Windows refuses to create the process and you get a flat “access denied.” Grant it, restart the app, open a new conversation, and the memory tools appear. Total time, including debugging the permission block: about twenty minutes.

Why this matters, architecturally

MCP is a standard, not one company’s product. When a server exposes tools, any client that respects the spec can use them. Anthropic published it, OpenAI adopted it, and the ecosystem is converging on it. EIDARA depends on none of them in particular — it depends on the standard.

What made this land cleanly, though, wasn’t the standard alone. It was the structural work of the past few weeks, which turns out to have been building toward exactly this:

• The confidentiality zones. The moment there’s more than one client, each one needs to see only its own scope. The vault is split into four zones — personal, business, shared, and system — and every client is scoped to a subset. Without zones, adding a client would mean total exposure. With them, a new client sees only what it should.
• The protocol for how a large model writes. The batch-and-calibrate rules we wrote a couple of weeks ago were written for any frontier model, not for one in particular. Any large model that reads them should honor them. This week was the first real test of that “any.”
• Per-client profiles. Each client gets its own scope and its own permissions. The OpenAI client starts read-only, until we’ve watched how it behaves. The Anthropic client writes freely. Same server, different policies.

The consequence is the part I care about. The project’s memory is no longer tied to the model it was built with. If a model from one vendor is better for a given project tomorrow, we use it, and the memory stays. If another vendor’s model is better for a different project, same again. Working by project instead of by provider becomes actually viable.

What we’ve seen in the first days

Calm and honest: the connection felt right. The new client read the vault, ran queries, and returned answers consistent with what’s actually in the brain. There wasn’t the broken first-integration moment you brace for.

It’s also been sending back useful feedback about EIDARA itself — proposals, comments on the shape of the context the server hands it — which we’re collecting as material for the next round.

What we’re watching, without drama: that the write protocol is honored the same way from the new client as from the old one — early signs say yes, but that’s a two-to-three-week confirmation, not a one-day one; that when the new client starts writing, cross-model contradictions from differences in phrasing don’t spike, which we have a proactive check ready to absorb; and an internal maintenance backlog that has nothing to do with any client, which we want to drain before we double the active write volume.

Closing the circle

A year ago, in a post about sharing agents, we wrote: any AI that reads it becomes that agent — Claude, GPT, DeepSeek, doesn’t matter. That was about agents. Today the same sentence holds for memory: any model that connects to the same MCP server can share the same brain, whatever vendor built it.

The vendor-agnostic thesis isn’t a thesis anymore. It’s one server, three clients from three vendors, and the same memory in the middle. We are still working on this. Every week it’s a little closer to the thing I want it to be.

— Javier

---

See the full roadmap →