Autonomous Multi-Agent Digital Forensics & Temporal Intelligence Platform
The goddess of memory and mother of the Muses.
MNEMOSYNE is a local-first, autonomous digital forensics and intelligence analysis platform that reconstructs temporal knowledge graphs from digital artifacts. It employs multiple specialized AI agents to perform cross-reference analysis, anomaly detection, and narrative reconstruction—all while running locally on consumer hardware (e.g., an RTX 4060 laptop with 16GB RAM) with zero data exfiltration.
Digital forensics today is deeply fragmented, manual, and tool-heavy. Investigators juggle file carvers, timeline tools, and OSINT platforms. These tools give you raw data, but you lose the holistic narrative in the noise. Furthermore, enterprise platforms cost thousands of dollars and require uploading highly sensitive, non-consented personal data (PII) to a third-party cloud. MNEMOSYNE bridges these gaps by combining temporal knowledge graphs with a multi-agent debate architecture.
Unlike chatbots that just answer questions, MNEMOSYNE discovers what you didn’t know to ask, surfacing hidden connections and evidence chains that human investigators often miss.
- Autonomous Ingestion: Validates, identifies formats, extracts metadata, and virus-scans (via ClamAV) evidence files automatically.
- Local-First & Privacy-Preserving: Runs entirely on local consumer hardware. Zero cloud data exfiltration. External enrichment uses differential-privacy noise.
- Multi-Agent Debate: Resolves conflicting intelligence via structured debates between specialized agents, mediated by a Judge Agent.
- Cryptographic Audit Log: Anchors every piece of ingested evidence and analysis step to a tamper-evident Merkle-tree-chained append-only log.
- Temporal Querying: Ask time-bound questions (e.g., "Show me how these relationships changed between March and June") and get a graph-native answer.
- Dynamic VRAM Management: Intelligently swaps quantized models into GPU memory based on the active task.
The system is built on an event-driven message bus orchestrating an asynchronous swarm of AI agents. The backend is powered by FastAPI, wrapping our LangGraph-based agent workflows, while the frontend provides a real-time temporal visualization using React.
Key Differentiators:
- Temporal Knowledge Graphs with Provenance: Every extracted node and edge is versioned with timestamps, confidence scores, and source-evidence hashes.
- Multi-Agent Debate Architecture: Existing systems suffer from LLM hallucinations. MNEMOSYNE solves this with a Debate Mediator: Uncertain conclusions trigger structured debates between specialized agents, with a Judge Agent resolving conflicts using confidence-weighted evidence.
- Strictly Local, Privacy-Preserving OSINT: External enrichment (like WHOIS or Breach lookups) adds differential-privacy noise, uses local caches, and never transmits raw PII in the clear.
(Placeholders for UI Screenshots)
- Live Temporal Graph
- Event Timeline
- Real-time Agent Monitor
- Core & API: Python 3.11, FastAPI, Uvicorn, Pydantic
- AI & Orchestration: LangGraph, Llama.cpp (GGUF Quantization), HuggingFace, Sentence-Transformers
- Knowledge Graph: Memgraph (Cypher, Neo4j driver)
- Storage & Integrity: SQLite (Async), Cryptography (AES-256-GCM, Merkle Trees), ChromaDB (Vector Store)
- Frontend: React, TypeScript, Vite, TailwindCSS (via frontend integration)
- Python 3.11+
- Node.js 18+
- Docker (for the Memgraph temporal database)
- Poetry (for Python dependency management)
- Git
git clone https://github.com/HarshkumarG007/MNEMOSYNE.git
cd MNEMOSYNE
# Install backend dependencies
poetry install
# Install frontend dependencies
cd frontend
npm install
cd ..- Start Memgraph (Temporal Knowledge Graph)
docker run -p 7687:7687 memgraph/memgraph- Run the FastAPI backend
poetry run uvicorn src.mnemosyne.api.main:app --reload- Run the Frontend UI
cd frontend
npm run dev- Run the Quick Demo We have included an E2E demo script that automatically uploads a synthetic Enron email dataset to the ingestion pipeline. In a separate terminal:
poetry run python -m mnemosyne.demoThen navigate to http://localhost:5173 to view the analysis live.
MNEMOSYNE/
├── src/mnemosyne/
│ ├── agents/ # Agent logic (Supervisor, Extraction, Judge, etc.)
│ ├── api/ # FastAPI routers, auth, and WebSocket endpoints
│ ├── core/ # Configuration and global dependencies
│ ├── evidence/ # Cryptographic evidence store and deduplication
│ ├── graph/ # Memgraph client and temporal schema mapping
│ ├── ingestion/ # File detection, extraction, and virus scanning
│ ├── memory/ # Vector store integration (ChromaDB)
│ ├── models/ # LLM router, embeddings, and VRAM management
│ └── reporting/ # RAG fallback and final report generation
├── frontend/ # React + TS frontend for data visualization
├── tests/ # Pytest unit and integration tests
├── data/ # Sample datasets for testing (e.g., Enron emails)
└── docs/ # Extended architecture and performance documentation
To fit a genuinely multi-agent workflow into an 8GB VRAM budget, MNEMOSYNE uses dynamic GPU memory management and llama.cpp mmap swapping:
- Hot Models:
Phi-3-mini(Fast NER) andBGE-M3(RAG) kept loaded in VRAM (~3.7GB). - Warm Models:
Mistral 7B(Reasoning/Debate) andLlama 3.1 8B(General Analysis) loaded on-demand. - Cold Models:
Whisper.cpp(Audio) andYOLOv8n(Computer Vision) loaded per-task.
- Ingestion Agent: Validates and extracts file metadata.
- Extraction Agent: Fast NER and relationship extraction.
- Temporal Analyst: Constructs timelines via Allen's interval algebra.
- Correlation Agent: Cross-references entities via similarity learning.
- OSINT Agent: Privacy-preserving external enrichment.
- Anomaly Detector: Flags timeline outliers.
- Judge Agent: Mediates debates and applies Bayesian confidence updating.
Traditional knowledge graph projects don't attempt evidentiary integrity, and they lack a temporal dimension (time), treating relationships as static facts rather than evolving realities.
MNEMOSYNE utilizes Memgraph, an in-memory graph database, to store relationships with valid_from and valid_to properties. This allows investigators to run Cypher queries that step forwards or backwards in time, effectively enabling a DVR-like playback of criminal networks and event timelines.
MNEMOSYNE operates strictly on artifacts the user already possesses and is authorized to analyze.
- Encryption: A local SQLite blob store uses SHA-256 content-addressed deduplication and AES-256-GCM encryption.
- Audit Trails: Every analysis step is chained to a Merkle-tree, creating a tamper-evident audit trail without any external blockchain dependencies.
- Data Privacy: No data is uploaded to third-party APIs. All LLM inference is performed locally.
- FastNER: Uses quantized Phi-3 for rapid entity extraction.
- Async Processing: Implements python
asyncioacross all I/O bound tasks (database querying, file reading). - For a deeper dive into performance metrics and benchmarks, see the Performance Optimization Report.
- Implement audio transcription via Whisper.cpp
- Add Computer Vision extraction via YOLOv8n
- Expand OSINT integrations (e.g., Shodan, HaveIBeenPwned)
- Build standalone desktop electron application
- Implement fully-automated forensic report exports in PDF/Docx
We welcome contributions! Please review our standard GitHub flow:
- Fork the repository
- Create your feature branch (
git checkout -b feature/AmazingFeature) - Commit your changes (
git commit -m 'Add some AmazingFeature') - Push to the branch (
git push origin feature/AmazingFeature) - Open a Pull Request
Distributed under the MIT License. See LICENSE for more information.
MNEMOSYNE is a tool for defensive security, authorized forensics, and intelligence analysis.