Skip to content

Truth maintenance for agents

Agent memory that can take things back.

Retcon turns security advisories into real pull requests, and records what every decision rests on. When an advisory is withdrawn, it revises exactly the work that depended on it, and nothing more.

Open the live appHow it worksTake the tour
gladys · jsonwebtoken
  1. 2022-12-22Four advisories land for jsonwebtoken@8.5.1.
  2. 2023-01-27GitHub withdraws GHSA-27h2, the RCE claim.
  3. wave 1Triage's judgment rested on it, so it is retracted.
  4. outcomeUnchanged: three advisories still hold it at P1.

How it works

Memory that keeps its reasons.

Every belief and every decision records what supports it. That one rule is what lets Retcon take work back, and take back only the right work.

  • Every decision knows why

    A decision is held only while at least one support holds, and a support holds only while all its premises do. Ask why, and you get the whole chain, including what was retracted and when.

    1. GHSA-8cf7supports
    2. jsonwebtoken@8.5.1supports
    3. upgrade to 9.0.0

  • A withdrawal takes back exactly what it should

    When an advisory is withdrawn, the retraction travels forward wave by wave and every decision it reaches gets an outcome. Nothing is deleted, so the history stays.

    • Cancel: PR closed
    • Downgrade: relabelled
    • Unchanged: text rewritten

  • Ask what if, before it happens

    Press What if wrong? on any advisory, exposure or judgment. Retcon copies the graph, applies the retraction to the copy, shows what would change, and deletes the copy.

    Simulated on a copy. Nothing was written.

Four agents write into it

They never write a belief without naming its support; the engine rejects it. The memory rules themselves are never left to a model.

Triage
Reads your code and judges whether an advisory is exploitable here, citing file and line.
Planner
Chooses what to do on GitHub at each decision point, and re-plans when its evidence is withdrawn.
Fixer
Writes the prose of pull requests and comments from the decision and its chain of support.
Auditor
Reads every withdrawal, classifies it, and explains why the retraction happened.

Real runs

Not a mock-up. Real advisories, real pull requests.

Retcon replayed GitHub’s real 2019 to 2026 advisory history against two open-source projects and opened, rewrote and closed real pull requests on snapshot copies of them.

  • 635

    advisories withdrawn in GitHub’s npm and PyPI data

  • 131

    of them for reasons other than being a duplicate

  • 568

    real events replayed against two projects in about 30 seconds

  • jsonwebtoken

    in gladysUnchanged

    1. 2022-12-22

      Four advisories land, one claiming remote code execution.

    2. Triage

      Reads Gladys’s code: jwt.verify gets the server’s own secret, never attacker input. Judged not reachable here, so the upgrade is P1, not a panic.

    3. 2023-01-27

      The RCE claim is withdrawn. Triage’s judgment rested on it, so it is retracted too.

    4. Result

      The pull request stays open, rewritten to show the three advisories that still hold.

  • axios

    in wiredoorCancel, then back

    1. 2025-07-23

      A pull request opens for a “transitive critical” advisory.

    2. Next day

      The advisory is withdrawn: the flaw sits in form-data. The pull request closes, and the form-data pull request is untouched.

    3. September

      New axios advisories arrive and the cancelled decision is supported again, so it reopens.

  • express

    in wiredoorCancel

    1. Withdrawn

      The advisory is withdrawn because it “describes a correctness bug, not a vulnerability”.

    2. Result

      Nothing else holds the decision up, so it is cancelled and its pull request closes with an explanation.

See every pull request it opened, rewrote and closed:gladyswiredoor

Use it

Free, three ways in.

There is nothing to buy. Look around the live console, give your own agent Retcon’s memory, or run the whole thing yourself.

  • Look around

    Open the live console

    Browse the decisions Retcon holds, open the chain of support behind any of them, ask what if, and replay a real withdrawal in 3D.

    Open the console

  • Connect your agent

    Use it over MCP

    Retcon’s memory is an MCP server, read only when remote. Any agent can ask why a pull request is open, or what would change if an advisory were wrong.

    claude mcp add --transport http retcon https://retcon-kappa.vercel.app/mcp

    Then ask: why is there an open pull request for jsonwebtoken in gladys?

  • Run it yourself

    Self-host the whole system

    FalkorDB for the graph, a worker that replays the advisory feed, and the API and console. The README walks through it, and the tests run against real FalkorDB.

    View the code

FAQ

Questions people ask first.

Is it really opening pull requests?

Yes. On two demo repositories: snapshot copies, not forks, of Gladys and wiredoor, so nothing can ever reach the upstream projects. The GitHub token is limited to those two repositories, and the code refuses any other.

Does an LLM decide what is true?

No. What holds and what is retracted is decided by the graph, never by a model. The agents write beliefs, and the engine rejects any belief that does not name its support. The Auditor only explains a retraction; it does not decide it.

What happens when an advisory is withdrawn?

Every decision that rested on it gets an outcome. Cancel: no support is left, so the pull request is closed with an explanation. Downgrade: support is left but urgency is lower, so it is relabelled with a comment. Unchanged: other advisories still hold it, so only the pull request text is rewritten.

Will What if wrong? change anything?

No. It copies the graph, applies the retraction to the copy, shows you what would change, and deletes the copy. Making a correction for real needs an admin passphrase.

Why are most withdrawals ignored?

About 80% of withdrawals are duplicates. Retcon links a duplicate to its original and counts them as the same evidence, so withdrawing one changes nothing and touches nothing on GitHub.

Which models do the agents use?

Triage, the Planner, the Fixer and the Auditor all use Groq’s gpt-oss-120b. If no model is available, a fixed policy takes over: P0 and P1 get pull requests, the rest go to the report.

Can I point it at my own repository?

The hosted demo watches two projects. To watch your own, run Retcon yourself; the README explains the setup.