# postmq

> PostMQ is durable messaging and session state for AI coding agents: one hosted MCP server (87 tools, Streamable HTTP at https://mcp.postmq.com/), a REST API and a dashboard where agents hand work to each other as typed, durable messages — one agent builds, another reviews, the findings come back schema-validated — and keep the record as they work: sessions that resume, rules asked before acting, an append-only decision log, a triaged backlog, usage in token counts, with humans supervising in the dashboard — every step attributed, append-only where it matters, and chained into a tamper-evident audit log.

Developer preview — no SLA, no SOC 2 yet; hosted in Microsoft Azure, United States. The product is at https://app.postmq.com. The full machine-readable version of this site is https://postmq.com/llms-full.txt.

## Docs

- [Home](https://postmq.com): durable handoffs for AI coding — the messaging mechanisms (leases decided in SQL, at-least-once, dead-letter after 3/5/10), the review use case, the four ledgers a picked-up hand-off starts from, the six-step loop (start_build_session, query_applicable_rules, send, append_decision_log, file_backlog_item, end_build_session, then record_build_session_usage), the audit chain (tamper-evident; daily verification, weekly seals), the dogfood numbers generated from the project's own ledger, and where PostMQ fits (MCP for agents, REST for everything else, the dashboard for humans).
- [Messaging](https://postmq.com/handoffs): hand-offs that survive the session — a durable inbox for AI agents: send with a mandatory idempotency key (one SQL transaction: envelope, idempotency record, audit row, outbox row), get_pending under a lease (1–100 a call, 10–600 s, long-poll up to 20 s), ack / nack / extend_lease by the lease holder only, decided inside the SQL UPDATE, redelivery ceilings high 3 / normal 5 / low 10 then dead-letter, TTL 7 days default / 30 max, at-least-once (best-effort per-recipient FIFO), transactional-outbox webhooks (5 jittered attempts, HMAC-signed, SSRF-guarded; read-only list / get / delivery trail; create REST-only), three templates + validate, recipient-attention guidance; twelve MCP tools, thirteen REST routes, four pmq commands, five dashboard pages; recipients are AI accounts in the same workspace.
- [Multi-agent code review](https://postmq.com/use-cases/ai-code-review): the messaging pillar's marquee workflow — one agent builds, another reviews: the builder sends a directive (directive_kind: review) into the reviewer's inbox; the reviewer pulls it under a lease, reviews with its own tools, validates and sends the verdict back as a typed assessment (assessment_kind code_review; pass | fail | error; failures and next_action_suggested; status travels as a freeform_note), acks with an outcome summary; the builder's next session pulls the findings and acts — no human copy-paste relay, neither agent needs to be running when the other is, every transition on the tamper-evident audit chain. Works between different products (Codex reviewing Claude Code's work) or two sessions of one; both sides are AI accounts in the same workspace.
- [Session state](https://postmq.com/session-state): build sessions that resume-or-create (project + computer + branch + actor, unique index), rules queried before the agent acts (five trigger dimensions), an append-only decision log (database trigger; corrections are new entries), a triaged backlog with absorbing terminal states, usage per session in token counts (not dollars), markdown import with fingerprint dedup — and the nine-step protocol this repository runs on itself.
- [Decision log](https://postmq.com/decision-log): the append-only decision log — a database trigger rejects every delete and every update except the two source links, a correction is a new entry that points at the one it supersedes, every entry is attributed to the credential that wrote it and linked to the open build session; nine MCP tools and nine REST routes under /v1/decision-log, keyset-paged listing, substring search (not full-text), and the two dashboard pages people read.
- [Rules](https://postmq.com/rules): build rules an AI coding agent asks for before it acts — a five-dimension trigger surface (file_patterns globs, operations, languages, project_attributes overlaps, code_patterns substrings of task_context), query_applicable_rules returns only the rules whose every populated dimension matches (most-retrieved first, with candidate_count and suppressed_count, limit 1–100 default 50), retrieval_count / last_retrieved_at on every rule, rules authored by hand or derived only from an enforced lesson, active → archived forward-only by a database trigger, LLM enrichment optional and off by default; ten MCP tools, eleven REST routes under /v1/rules, three dashboard pages.
- [Backlog](https://postmq.com/backlog): a backlog AI coding agents file into over MCP or REST — file from the open build session (attributed to the credential and the client), triage between open, in_progress, resolved and dismissed with a database trigger that never reopens a closed item, priority and status as persisted ranks, an owner, staleness as a persisted clock with an explicit un-audited acknowledgement (default threshold 90 days), dated closing-notes amendments on a closed item, thirteen tools and thirteen routes (writes need write_session_state), a four-column dashboard board and an item page; and how our launch plan is generated from the live backlog (five tiers, P0 a closed set, the generator fails on an untiered open item).
- [Usage](https://postmq.com/usage): what a session consumed, recorded by the client that spent it — record_build_session_usage is an upsert on (build session, transcript id) behind a unique index and a UPDLOCK+HOLDLOCK key-range read, so a re-fired report overwrites its row (201 Created first, 200 OK after) and a project rollup never double-counts; five token classes kept apart (input, cache write 5m, cache write 1h, cache read, output) plus turns and sidechain turns, the model ids seen and the reported window; get_usage rolls up on five axes (total, project, day, week, month) with an optional project filter and an inclusive-from / exclusive-to created_at window, the per-project rollup following each session's CURRENT project; two tools and two routes (the write needs write_session_state, the read only an authenticated caller); one read-only dashboard view with totals and a breakdown table — no chart, no export; deliberately not audited; self-reported (PostMQ meters no provider), token counts and not dollars, and nothing anywhere reads the number to budget, alert or stop on it.
- [Lessons](https://postmq.com/lessons): build lessons with a forward-only lifecycle — observed, documented, enforced, archived, enforced by tg_build_lessons_status_monotonic over a persisted status_rank, with the id and slug fixed at insert; the promotion gate is two database CHECK constraints (documented and enforced need a pattern write-up; enforced also needs prevention_mechanism_markdown), so nothing reaches enforced until somebody writes the mechanism down — structural gate, human by convention (any write_session_state credential can enforce); observations are append-only by construction (no trigger) and bump last_observed_at; lesson candidates cannot be authored on any transport and leave pending a single time (promoted, rejected or superseded, absorbing at the database), promotion landing the lesson at documented and carrying its evidence across; LLM detection over a project's resolved backlog is optional, off by default and on your own Anthropic key; derive_rule promotes an enforced lesson into a rule; fourteen MCP tools, fifteen REST routes under /v1/lessons and /v1/lesson-candidates, four dashboard pages.
- [AI coding governance](https://postmq.com/solutions/ai-coding-governance): governance by record, not by gate — what a governed record of AI-coding work is here (attributed sessions, an append-only decision log, a triaged backlog, self-reported token counts, rules asked for at decision time, lessons with a written prevention mechanism) and, in its own section, what PostMQ is NOT: it does not block a tool call, enforces no policy at the moment a tool runs, inspects no content, and is neither a tracing tool nor a vector memory — rules are advisory and enforcement stays in your CI; the only two refusals that run before an action are on send (an unacknowledged workspace policy, an OFAC SDN sanctions hit). Also the operator console behind four named gates, the read-only dead-letter inspector, DSA/DMCA notice-and-action and the three delivery paths a takedown disables, the §12.4 purge that ships disabled with each environment opting in, legal preservation holds, REST-only data rights, workspace scope taken from the credential, retention and export stated in full (versioned /v1 routes for every ledger; no one-click export; payloads anonymised at 30 days; no audit deletion path), a five-screen review walk, and the same not-yet list the security page carries.
- [For enterprise](https://postmq.com/for/enterprise): the buyer's half of governance by record — what an organisation gets (the workspace as the boundary, read off the credential and never supplied by a caller; one AI account per agent with 19 issuable scopes; least privilege by default with the operator scope not issuable over the API; one service layer behind the dashboard, MCP and the versioned /v1 REST API), and what it must accept, each labelled: a workspace holds its owner plus anyone they invite by email, added and removed one at a time — no SAML, no SCIM and no directory sync; Entra ID sign-in is configuration-gated; the break-glass request, approve and close lifecycle is on the tamper-evident audit chain but withheld from the workspace's own view — a workspace cannot see from its own log that break-glass was opened over it (the override it authorises is on the chain and visible); retention is one 30-day compile-time constant for every workspace with no per-workspace window; getting the record out means paging the API (no one-click export, and /v1/me/export is the human-portability export, not the work record); data rights are REST only; one Azure US region with no customer-managed keys and no private endpoints; and the workspace-facing audit-log surfaces return the rows and the integrity sweep's verdict, deliberately NOT the hashes — re-deriving the chain uses the transparency artefact, which is opt-in (toggled from the dashboard), and no verifier tool ships. Also what a reviewer can check without us, the same not-yet list the security and governance pages carry, the pricing posture (a published Enterprise floor, allowances enforced only on a published tier, billing not open, and contact details on /support rather than a published sales mailbox), and a six-step afternoon evaluation naming only surfaces that exist.
- [PostMQ and Claude Code auto memory](https://postmq.com/compare/postmq-vs-claude-code-auto-memory): a comparison with a public source on both sides of every row — Anthropic's own Claude Code memory documentation for their column (read 2026-08-18, footnoted per section), our claims register for ours. Ten axes: who writes it, where it lives, how far auto memory reaches (documented machine-local, one directory per git repository, "not shared across machines or cloud environments"), how far a written CLAUDE.md reaches (its own row, because the same page lists a project CLAUDE.md as shared with "Team members via source control" and a managed-policy one with "All users in organization" — file-based sharing is documented and is not denied here), how an entry changes (plain markdown you can edit or delete at any time, versus a database trigger that refuses deletes and updates so a correction is a new entry), what loads when a session starts (the first 200 lines or 25KB of MEMORY.md, topic files read on demand, versus nothing loaded automatically and an agent that asks), how guidance is narrowed (path-scoped .claude/rules/ versus query_applicable_rules over five trigger dimensions — both scope, differently), whether either can stop an action (neither: theirs is "context, not enforced configuration", ours is governance by record and advisory), setup cost (on by default, versus a workspace, a scoped credential, one .mcp.json entry and a restart), and retention. Plus the mandatory "when to choose auto memory alone" section (five genuine reasons: nothing to set up, no server to operate, already in the client, it writes itself, the files are yours), what a shared record adds that a client-local one is not trying to (reach across machines and people, attribution derived from the credential, corrections rather than overwrites, a query at decision time, a tamper-evident chain with its limits stated), and the honest recommendation: run both. Six rows were CUT for want of a citable source and the page says which.
- [Docs](https://postmq.com/docs): connect an agent in one approval (a person creates the workspace → a client that implements MCP authorization registers itself over OAuth and asks → the person approves once; no credential is pasted. A client that does not, or an environment with no browser, falls back to a credential issued by a person), the session protocol, the usage hook, templates, rate limits, REST.
- [Docs](https://postmq.com/docs): the integrator-facing documentation — the landing that connects an agent in one approval and states the retention and security posture, then a quickstart that runs the send → get_pending → ack loop over MCP and over REST, authentication (the 19 issuable scopes across the two credential tiers, once-disclosed plaintext, rotation with an overlap window), the REST conventions every route shares (bearer auth, idempotency keys fingerprinted over the body for 24 h, keyset paging whose cursors are bound to the query that issued them, one error envelope, request ids, rate-limit headers on every authenticated response), every error code with its HTTP status and the recovery for it, the rate limits and how to back off, runnable samples in bash, Python, TypeScript and C#, and the MCP guide — transports, what to do straight after connecting, thirteen recommended workflows, an intent → tool selection guide, and the catalogue of all 87 tools with the arguments of each, generated from the server's own manifest. The operator surface appears nowhere on it, and a test derives the forbidden route list from the code so it cannot.
- [Claude Code](https://postmq.com/integrations/claude-code): the Claude Code setup we run ourselves — the .mcp.json entry (Streamable HTTP; the same snippet as the docs), the stdio alternative (pmq mcp stdio reads POSTMQ_CREDENTIAL, then PMQ_CREDENTIAL, then ~/.pmq/credentials), one restart to refetch the tool catalog, and the /start-session and /end-session skills, the SessionStart hook and the SessionEnd usage hook (ours; the server does not enforce the protocol), with the tools each step calls and a troubleshooting table.
- [Codex](https://postmq.com/integrations/codex): the Codex setup — one [mcp_servers.postmq] entry in ~/.codex/config.toml (url plus bearer_token_env_var, so the credential stays in the environment) or one codex mcp add; the same config serves the Codex CLI, IDE extension and desktop app; the desktop app and IDE extension need a restart after config changes and a new CLI invocation reads the config at startup; the session-state kit installs into Codex's own surfaces (the two skills under .agents/skills, the session hooks through .codex/hooks.json, written from the same files as the Claude Code install), with AGENTS.md instructions as the no-install alternative; Codex reads a project's .codex/ config only once that project is trusted and reviews a hook once before running it, and its session-end hook is capped at 1s (3s max) so the usage reporter runs detached; the worked session is the reviewer's half of the multi-agent code review loop.
- [Antigravity](https://postmq.com/integrations/antigravity): the Antigravity setup — one mcpServers entry in ~/.gemini/config/mcp_config.json (the same top-level shape as Claude Code's .mcp.json), the kit into .agents/skills and .agents/tools, and the one install that wires NOTHING: no hook could be made to fire there (we drove the CLI; we did not test the IDE), so the skills run the scripts and usage is recorded only when end-session runs.
- [ZCode](https://postmq.com/integrations/zcode): the ZCode setup — one entry under mcp.servers in ~/.zcode/cli/config.json (its own shape, NOT the top-level mcpServers object Claude Code and Antigravity use): type, url, a headers object carrying the bearer, timeoutMs; the session-state kit installs into ZCode's own surfaces (the two skills under .zcode/skills, the hooks wired in .zcode/config.json, from the same files as the Claude Code and Codex installs); three ZCode behaviours shape that install and the page states all three — hooks.enabled defaults to false so a wired hook is loaded, listed and never run; there is NO SessionEnd event (seven events, ending at Stop), so the usage reporter runs on Stop and reports per TURN as an idempotent upsert; and a hook's stdout is injected only if it starts with { and parses as JSON, so the kit ships a wrapper rather than wiring the shared script directly; the worked session is the builder's half of the multi-agent code review loop.
- [MCP clients](https://postmq.com/integrations): the AI coders hub — Claude Code, Codex, ZCode and Antigravity are the four we run daily (founder-attested, each with its verified config surface: .mcp.json, config.toml, ~/.zcode/cli/config.json, ~/.gemini/config/mcp_config.json); the session-state kit installs into all four, Antigravity's being the one with nothing to wire — there its skills run the scripts themselves. Any MCP-capable client connects to the same server — Cursor, VS Code and GitHub Copilot each document MCP support in their own docs; no PostMQ-tested recipe is published for those three, and the page says so.
- [MCP server](https://postmq.com/integrations/mcp): transports (Streamable HTTP at mcp.postmq.com; stdio when co-located), authentication, rate limits, idempotency, and the catalogue of all 87 tools generated from the server's own manifest.
- [Security](https://postmq.com/security): the audit chain and the tests that pin it, credentials, MFA and step-up, notices, sanctions, data rights, Key Vault, Azure US, what is not built, and the 61-question vendor security questionnaire answered from the code.
- [Guide: AI coding agent context loss](https://postmq.com/guides/ai-coding-agent-context-loss): what context loss is for an AI coding agent and why it happens, the hand-rolled fixes (a state file, an end-of-session summary, a re-injecting hook) and where each breaks, and the explicit state layer instead — a session that resumes-or-creates, a ping, a continuation link, a current-state lead the next session reads first, decisions into an append-only log, deferrals into a triaged backlog, rules asked at decision time, usage reported at the end — with the session walkthrough this repository runs, how to verify it in the dashboard, and when not to use it.
- [Guide: how we run start-session and end-session](https://postmq.com/guides/how-we-run-start-session-and-end-session): the two Claude Code skills as this repository runs them, step by step in the order of their skill files — /start-session (read the law files; query the active sessions, the last ten decisions and the backlog counts; surface drift; pick a worktree and branch; resume or start the session and write the pointer file the usage hook reads) and /end-session (log decisions; file deferrals and resolve what was finished; refresh the status file and regenerate the launch plan, which fails on an untiered backlog item; local pre-merge guard; a PR body written against the required Discipline gate's three predicates; CI verification of every PR touched — a push exiting 0 is not shipped; close the session with its history entry; clean up), what the SessionStart hook prints and does not yet print, what the ritual buys (attribution, resumability, a record a reviewer can read) and does not claim, the generated numbers, and when not to.
- [Pricing](https://postmq.com/pricing): four tiers in USD — Developer $0, Pro $19 a month, Team $79 per workspace a month (early-adopter rate), Enterprise from $1,500 a month; the protocol (MCP tools, build sessions, decision log, backlog, lessons, rules) is unlimited on every tier; billing is not open yet, so every workspace currently runs at no charge — Team's workspace membership is built and usable regardless, since inviting people is not gated on billing.
- [Support](https://postmq.com/support): the one door for anything a person needs — a self-help band of documentation links first, then six routed cards. Four lead to a contact form on app.postmq.com (bugs and ideas, account and billing, sales and press, privacy and data rights); two publish an address instead, because a form would be in the way: security@postmq.com for vulnerability disclosure (acknowledged within three business days, safe-harbour terms on /security#disclosure, no bug bounty) and abuse@ / dmca@ for reporting illegal or infringing content, which are the addresses the Privacy Policy already names. Also a twelve-question FAQ.
- [llms-full.txt](https://postmq.com/llms-full.txt): everything above as one plain-text document — the tool catalogue, the security mechanisms, the questionnaire, the quickstart.

## Optional

- [Sitemap](https://postmq.com/sitemap-index.xml)