Skip to content

Corrobore

Corrobore is a Rust-native, Cypher-compatible graph runtime built as structured working memory for intelligence agents. It keeps entities, relationships, evidence, confidence, temporal context, and audit history outside model context while letting agents query and update only the smallest useful subgraph.

Choose an interface

Interface Best for Entry point
Embedded Rust Applications that want an in-process engine corrobore-engine
HTTP API Agent tools and services corrobore-http-server
TAXII ingestion Incremental STIX 2.1 collection polling through the public HTTP import boundary corrobore-ingest 
flowchart LR
    Sources["Reports, STIX, TAXII"] --> Ingest["Import and ingestion"]
    Agents["Agents and applications"] --> Gateway["Embedded or HTTP gateway"]
    Ingest --> Graph["Corrobore graph"]
    Gateway --> Graph
    Graph --> Cypher["Bounded Cypher reads and writes"]
    Graph --> Export["Deterministic STIX/FIMI export"]
    Graph --> Audit["Sessions, telemetry, and audit logs"]

Repository model

Corrobore follows a multi-repo operating model:

  • this repository owns core runtime behavior and contracts;
  • connectors and integration assets consume those contracts through stable boundaries (primarily HTTP);
  • integration repositories can evolve on their own cadence while preserving runtime compatibility.

See Architecture for crate-level boundaries and TAXII Ingestion for connector deployment guidance.

What is implemented

  • an in-memory property graph with evidence, confidence, temporal metadata, snapshots, and epistemic claim primitives;
  • a bounded Cypher parser, planner, and executor for reads and mutations;
  • host-controlled runtime policies, budgets, and mutation permissions;
  • an embedded Rust facade and an authenticated HTTP service;
  • STIX import, deterministic STIX/FIMI export, native validation, and safe auto-correction;
  • semantic seed search and a bounded working-set subsystem with telemetry, pheromone and anti-pheromone fields, a contextual controller, and reproducible benchmarks;
  • durable session state, JSONL audit logs, health data, Prometheus metrics, rate limiting, body limits, and graceful shutdown;
  • incremental TAXII 2.1 ingestion with persisted cursors.

The current public baseline is 0.1.x. Historical context remains in release notes, while this site describes behavior available on main.

Corrobore is not a distributed graph database and does not claim full openCypher support. Candidate R&D work is tracked separately under dev-docs/; this site describes the code that exists on main.

Start here