Reputation as Community Memory for the Agentic Web Ryan Chard, Gus Ellerm, Alexander Brace, Alok Kamatar, Suman Raj, Ian Foster, and Kyle Chard
arXiv:2609.19502v1 [cs.MA] 16 Sep 2026
University of Chicago & Argonne National Laboratory, Chicago, IL, USA
Abstract—Agents can now externalize experience into memory, consolidating historical traces into semantic knowledge and procedural shortcuts that persist between sessions. Such memory is typically private to a single agent. We argue that agentic memory benefits from being collective, because trustworthy knowledge of the shared environment—the data sources, services, and tools agents depend on—cannot be established by any single agent, only corroborated across many independent observers. We present Cairn, a community reputation platform that captures collective knowledge, allowing agents to query the community’s opinion of a resource before use and to submit evidence-backed ratings afterward. Cairn aggregates observations via a timedecayed Beta model with confidence shrinkage and supports semantic discovery over reviewer rationales. We evaluate Cairn’s reputation engine under adversarial simulation (e.g., lying, collusion, camouflage), benchmark its retrieval performance, and report a case study of rating heterogeneous agents in production. Index Terms—agentic memory, trust, reputation systems
I. I NTRODUCTION An agent—a machine learning model coupled with a harness that manages its context, tools, and memory—can achieve measurably better performance by remembering past experiences [1]. Much of the recent improvement in agents occurs at test time, through reading and writing memory and persisting experiences and the lessons learned between sessions [2]. Libraries of reusable skills and workflows can encode “happy paths,” the solutions found through trial and error that most reliably achieve an objective [3]. Most recently, agents have been empowered to accumulate and consolidate execution traces and distill what will be remembered during the next session. Anthropic provides such a capability called dreaming for its managed agents [4]; OpenAI’s ChatGPT memory [5] and Letta’s sleep-time consolidation [6] are adjacent capabilities. The trajectory of agentic memory mirrors that of prompt engineering. What began as ad hoc phrasing tricks matured into a harness discipline of system prompts and context management. Now memory engineering, the deliberate curation of context, is maturing in a similar fashion. As agents search literature, query community APIs, invoke third-party tools using protocols such as the Model Context Protocol (MCP) [7], and orchestrate long-running computations [8], [9], this weight-free optimization loop is becoming part of the operational infrastructure itself. Almost all agentic memory, however, is private or organizational, belonging to one agent or one organization rather than pooled across the community. Yet much of what agents learn concerns not just their own task but the shared
environment of external entities, for example, which APIs are least reliable, which MCP servers are abandoned or undocumented, and which data sources carry stale numbers or inject instructions [10]. These entities—tools, repositories, datasets, skills, and other agents—are large and growing. Marketplaces such as SkillsMP [11] and MCP registry [12] collectively list millions of skills and thousands of servers exposing tens of thousands of tools, and agents reach many more through libraries, command-line tools, and other APIs. Today, such knowledge must be relearned by every agent, at cost to both the agent and the community. Here we explore collective memory, a system to collect, aggregate, and disseminate this growing collection of learnings. We describe a working ontology of agentic memory, organized by who may write to a store and what the memory describes. We then present Cairn, a reputation system that establishes a community memory for agentic systems. Cairn allows an agent to discover prior interactions and ratings before interacting with an external entity, after which it may contribute an evidence-backed rating of its own. Coordination is achieved through persistent, decaying traces which agents consider when making decisions. This paper is organized as follows. §II develops an ontology of agentic memory and the requirements community memory must meet. §III presents the design and implementation of Cairn. §IV evaluates the scorer under adversarial pressure, benchmarks recall over its live corpus, and reports a field study of rating agents. §V reviews related work, and §VI concludes. II. A N O NTOLOGY OF AGENTIC M EMORY We organize agentic memory systems along two axes, retention type (what is persisted) and scope (who persists it). Retention type follows the classical taxonomy of human memory [13] as adopted by cognitive architectures for language agents [14], distinguishing raw traces of what happened (episodic memory), judgments distilled from those traces (semantic memory), and execution shortcuts such as skills and workflows (procedural memory). Scope may be an individual agent, an organization, or the community of agents that share an environment. What distinguishes scopes is the trust relationship between contributors. The progression mirrors memory research beyond the individual, from transactive memory in small groups to collective memory in societies [15]. Each agent carries a private memory of its own work (Fig. 1a); a team of agents share an organizational memory of vetted tools and proven
Resource
Resource
API · MCP · Agent
API · MCP · Agent Use
Use
Organization · N
Organization
Agent · 1
Agent · 2
Private Memory
Agent · N
Private Memory
Private Memory
Agent · N Private Memory
Team · Org Memory
Resource Discover · Write
API · MCP · Agent Uses
Team · Org Memory
Agent
Discover · Write
Communit y Memory
Vetted Tools
Reputation
Private Memory
Happy Paths
Ratings
(a) Private
(b) Organization
(c) Community
Fig. 1: Each memory scope nests within the next, from private memory (a) through organizational memory (b) to community memory (c). The scopes coexist, and what memory describes widens from an agent’s own work toward the shared environment.
happy paths in a single trusted domain (Fig. 1b); and teams pool a community memory about the shared environment across agents that share no common domain (Fig. 1c). While each scope may store the same record (e.g., failed tool call), the utility of sharing depends on what the memory is about. Traces of an agent’s own work may be task-specific and transfer poorly. In contrast, observations of the environment transfer because they are associated with a resource, rather than caller. Community pooling allows corroboration of any report, coverage of dependencies with whom an agent has never interacted, and freshness from observations newer than its own. Cutting across both axes are four operations: • encoding: what gets written, and whether manually or automatically; • consolidation: the compression of traces into semantic and procedural form; • recall: how memories are found when relevant; • forgetting: how stale memory loses influence. Collecting and consolidating shared experience into actionable ratings requires trusting observations from unknown raters, managing adversarial contributions, and weighing the strength of the evidence: common goals of reputation systems [16], [17]. A. Requirements for Community Memory Consider an agentic system for science. An agent assembling a dataset of candidate superconducting materials queries a community materials API, downloads preprint metadata from an aggregator, calls a unit-conversion tool on a communityoperated MCP server, and executes generated analysis code in a sandbox. These four tasks each have distinct trust decisions
and the agent may have no prior experience with any, although many other agents likely have performed the same tasks. The risk profile of each task also varies. Fetched content can be wrong, stale, or carry malicious prompt injections [10]; API schemas drift and fail silently; community tools may be abandoned; and peer agents can misrepresent their capabilities, compounding failures downstream. Existing mechanisms, such as registries and code signing, verify an artifact at publication time, and public key infrastructure (PKI) establishes who operates a service, not how well it performs. Provenance tools record how artifacts came to be without assessing the steps that produced them [18]. Existing agent memory systems reach at most organizational scope, since multi-agent stores share experience only among agents under a single domain. Community memory therefore leads to requirements that are not present with private and organizational memory. Contributors share no common source of trust and cannot be assumed to be honest, so a single observation, whether malicious or accidental, must have bounded effect, and confident judgments require corroboration. The observations behind a judgment must remain both interpretable and retrievable. Further, the environment will inevitably drift as services degrade and change, so scores must evolve with new evidence. Contributing and reviewing evidence must be suitably cheap such that it can be frequently performed. Finally, an entity that has not been rated must be distinguishable from one that is merely average. III. C AIRN : R EPUTATION AS C OMMUNITY M EMORY Cairn (Fig. 2) is a reputation system that enables agents to rate and review the entities (e.g., resources, APIs, tools, agents) they interact with. Cairn is implemented as a service storing
Agent · N 1. check
Private Memory MCP tools
Cairn · Community Memory
3. rate
Cairn Plugin
Append- only Event Log Beta- decay reputation Rationale Embeddings
2. use
Cited Summaries
Resource API · MCP · Agent
Fig. 2: The check-use-rate loop. An agent checks an entity’s reputation before use and rates it after; every agent’s ratings append to Cairn’s shared, append-only event log, from which its read models are derived.
an append-only log of rating events and a set of derived read models, together with simple agent integrations that make the check-use-rate loop routine. A. Entities and Canonical Identity Cairn tracks three entity types, each identified by a callersupplied external_id: • data_source: web content and REST endpoints; • capability: MCP servers, tools, and services; • agent: peer agents. We use URNs as the basis for entity external_id. In order to benefit from community reviews, we require that ratings of the same entity resolve to a single identifier despite subtle differences (e.g., spelling, query parameters). Cairn applies a simple approach in which identifiers are normalized, such that superficial variants are ignored. For example, for a REST endpoint we consider minor variants /posts/7d21ede7-.../comments?sort=new and /posts/$PID/comments to be one entity, as neither the record identifier nor the sort order changes how the endpoint behaves. Identifiers that denote distinct entities, such as individual PubMed records, remain separate. B. Ratings: Rubric, Weight, and Dimensions A rating event carries a score s ∈ [0, 1] capturing how the interaction went, anchored by a shared rubric—written level descriptions that map scores to observable behavior, from 1.0 (flawless) to 0.0 (harmful)—together with an optional weight w ∈ (0, 1] (default 1.0) expressing the strength of the evidence. Like the score, weight is a rubric-anchored judgment made by the rater—1.0 for direct use, 0.5 for inspection without invocation—and it scales how much the event contributes to an entity’s score. Optional fields carry further evidence behind the judged interaction, including a task description, a written rationale, failure_modes, quantitative metrics,
free-form task_tags, and dimensions. Dimensions map over seven axes: accuracy, latency, cost, reliability, safety, token_efficiency, and context_efficiency and are scored in [0, 1], with higher values being preferable (e.g., latency 0.9 is fast), which keeps aggregation uniform across axes. While many of these dimensions are common in prior reputation systems, we add two dimensions specifically for agents: token_efficiency (total tokens an interaction consumes for the task [19]) and context_ efficiency (the context-window footprint a capability imposes) are important costs managed by LLM agents [20]. Both are rubric judgments anchored to an observed quantity. The rater restates the measurement in the rationale (“used ∼18k tokens against a ∼10k baseline”) beside the score. C. Aggregation: Time-Decayed Beta with Shrinkage Cairn’s aggregation mechanism is designed to address three of the requirements described above. Single observations must have bounded effect, scores must evolve as the environment drifts, and unrated must be distinguishable from average. The default scorer maintains, per entity, a Beta-distribution (α, β) with priors α0 = β0 = 1. When an event (s, w) arrives after elapsed time ∆t, the state first decays toward the prior and then absorbs the event: α ← α0 +(α−α0 ) e−λ∆t , α ← α + ws,
β ← β0 +(β−β0 ) e−λ∆t , (1) β ← β + w(1 − s),
(2)
with λ = ln 2/h and half-life h = 3 days. Reads decay the state to the present, then report α , neff = (α − α0 ) + (β − β0 ), (3) µ= α+β neff , composite = c µ + (1 − c) 12 , (4) c= neff + k with shrinkage constant k = 3. Three properties give the scorer its behavior under adversarial pressure. First, reputation must be maintained. Ratings decay with a three-day half-life, so an entity’s composite score drifts back toward the prior. Second, confidence is modeled explicitly. An unrated entity reads as (0.5, c=0), treated as “no signal” rather than “trusted.” Low confidence is enforced at read time. When Cairn is asked to recommend entities, those below a confidence floor (default c=0.3) are omitted. When a specific entity is queried directly, its score is always returned with the confidence attached, leaving the caller to reason about interpreting the score. Third, single ratings are bounded. One maximally negative full-weight rating (s=0, w=1) against a fresh entity moves the mean to µ = 1/3 at c = 1/4 and, after shrinkage toward the prior, a composite of 0.458. Driving a composite confidently low requires sustained, supporting evidence, and the same shrinkage minimizes false praise. The scoring mechanism repackages the Beta reputation, whose state, weighted feedback, and forgetting are all inherited: the original discounts the i-th of n feedback events by a
factor λn−i [21], and its Dirichlet successor ages ratings per discrete period [22]. Cairn re-indexes this forgetting to elapsed time under an operator-facing half-life, applies decay at evaluation time, and exposes confidence as an API output. This expiry-by-default makes reputation a form of soft state [23], [24]. The difference is that an entity cannot refresh its own reputation: only fresh third-party evidence keeps a score alive. D. Evidence and Discovery Cairn’s score API route provides access to an entity’s composite score. As a scalar is rarely sufficient on its own, additional read paths expose the evidence behind a rating. The retrieve route takes an entity and returns its underlying events, optionally ranked by semantic similarity between a natural-language query and raters’ embedded rationales. The rank route takes a capability tag and orders the entities within it by any dimension, while the capabilities route reports the tag space itself. The history route returns time-bucketed event statistics, showing how an entity’s behavior has changed over time. Finally, we consider the case where an agent knows what task it wants to perform but not the tool to be used. Cairn provides a discover route that embeds the task description, matches it against the rationale corpus, aggregates per entity, and returns ranked entities together with the rationales that matched. The agent can then read why the community rated an entity well for similar work instead of trusting a score. An empty result signals that Cairn lacks records for the task rather than that no suitable tool exists. Once an entity accumulates at least three events, a server-side worker synthesizes a narrative profile summary whose highlights must cite real event identifiers, validated against the event store, so fabricated citations are rejected before the summary is served. E. Closing the Loop: Automatic Rating A reputation corpus only learns from submitted ratings, so the write path must be cheap. We implemented a post-tool-use hook for Claude Code to observe every web search, tool use, and MCP call within the Claude Code harness. It briefs a small judge model with the tool call and an excerpt of its result. The judge emits a structured rating, a sanitizer validates it, and the event is queued and flushed in batches when appropriate. Rating a call with a small judge model adds negligible cost relative to the call it describes, and a customizable cadence allows users to tune frequency of reports. The excerpt the judge reads is a potential point of attack and LLM judges can be steered by short embedded phrases [25]. The rubric therefore anchors its lowest score at attempted injection. Content that tries to issue instructions to the consuming agent is scored 0.0 as evidence of harm rather than followed as instruction. F. Implementation We implemented the Cairn service as a Python FastAPI application backed by PostgreSQL with pgvector, and a web interface for human inspection. The tools are packaged as
a skill with reference documentation, POSIX shell wrappers that compress each API call to a line or two of agent-visible context, an MCP server exposing 10 tools, and harness hooks that automate Cairn’s use in Claude Code. For audibility, the append-only score_events table includes scorer state, per-dimension state, capability-tag affinities, embeddings, and summaries. Scorer arithmetic is implemented in application code and updated are serialized perentity using row locks, ensuring that offline replay of the event log reproduces scorer state exactly. The separation keeps scorer evolution tractable, since candidate scorers can shadowrun over the same log. Cairn is available at https://cairnscore.ai, deployed via AWS App Runner with RDS PostgreSQL. Reads are unauthenticated and writes require a minted API key. IV. E VALUATION AND E XPERIENCE We evaluate Cairn in three modes, which together exercise the four memory operations of §II: 1) Adversarial simulation exercising consolidation and forgetting: does the production scorer keep ratings bounded, and does stale evidence fade, under dishonest raters? 2) A retrieval benchmark over the live corpus exercising recall: does discovery surface the right entity from a task? 3) A platform-scale case study exercising encoding: do rubric-anchored judges turn raw interactions with real agents into memory that discriminates trustworthy from untrustworthy sources? A. Scoring Under Adversarial Pressure Community memory is only useful if it remains accurate in the presence of malicious agents. We evaluate the scorer using a multi-agent simulation in which each interaction executes the check-use-rate loop. An agent selects a peer, invokes it, and receives an outcome (the invocation succeeds or fails). The agent then submits a rating about that peer. The outcome is what happened; the rating is the testimony written into memory, and the two need not agree. Honest raters map outcomes through the rubric (correct 1.0, wrong 0.0), while adversarial raters misreport them. Table I summarizes the six behaviors we simulate, drawn from canonical attack classes in the reputation-systems literature [26]. Results use shrinkage k=5 and report means over 100 independent random seeds. We first explore the relationship between composite ratings and honest vs. faulty responders. We find that composite ratings follow ground truth accurately, with final scores matching faulty responders’ true accuracy to a mean absolute deviation of 0.017. A composite score, therefore, estimates how often an agent actually succeeds rather than being a mere ranking of agents. We find in our collusion experiments that pooled evidence remains reliable only while the majority of raters are honest. That is, with random routing, colluding cliques are detected as long as they are in the minority, beyond this limit detection degrades rapidly and collapses. We also find that the scorer reliably identifies camouflaged entities.
0.5
0.0
random
trustweighted
0.50
100
composite
false positives (%)
detection F1
1.0
50
stored live read
0.45
0.40
0 0.2
trustfilter
0.4
0.5
0.6
dishonest-rater fraction
(a) Detection vs. routing
(b) Slander
0
20
40
60
simulated time (days) (c) Forgetting
Fig. 3: The production scorer under adversarial pressure (shrinkage k=5; means over 100 seeds, with 95% confidence intervals as error bars or bands). TABLE I: Simulated agent behaviors. Behavior
Answers
Rates
Honest Faulty Persistent liar Slanderer Colluder Camouflage
always correct correct with prob. p always wrong always wrong correct in-clique only correct for first n, then wrong
truthful truthful truthful all peers 0.0 1.0 in-clique, 0.0 outside truthful
Agents that flip are detected in 95% of cases within the simulated horizon (extending the run catches the remainder). An identified agent draws little traffic under trust-weighted routing while its evidence decays, fades back into the routing pool, is invoked again, and is re-flagged. We next vary how an agent selects which peer to invoke (Fig. 3a). Random assignment ignores existing scores; trustweighted selection picks peers with probability proportional to their score; a hard trust filter routes to peers with composite ≥ 0.5 and confidence ≥ 0.2. Random and trust-weighted routing catch liars almost perfectly (F1 1.00 and 0.94), because both send requests to low-rated agents, generating the ratings that convict them. The filter cuts off that traffic, so evidence stops accruing and detection collapses to an F1 of 0.07. We then vary the number of slanderers to investigate how much dishonest rating the scorer can tolerate (Fig. 3b). Our tests show that slander degrades the system sharply rather than gracefully. Adversarial agents rating honest peers 0.0 produce almost no false positives while they remain a minority, because honest ratings still dominate each target’s evidence pool. However, once the slanderers approach parity, false positives climb to near-total and pooled memory fails suddenly once honest raters lose their majority. Finally, we examine a single agent during a period of inactivity to test how rating decay is reflected to consumers (Fig. 3c). We find that forgetting appears abrupt to cached readers and smooth to live ones. This is because decay is applied on read but persisted on write, so a consumer holding a cached score sees no change until the next rating arrives, at which point the accumulated decay is reflected as a single step.
A live read of the same agent drifts smoothly toward the prior. Therefore, consumers should treat composites as timestamped observations and re-read before acting. B. Recall over the Live Corpus We now investigate whether the memory that agents write is recallable, i.e., whether Cairn can find the correct entity from only a task description. We test this on Cairn’s live corpus of 933 events over 218 tool and data-source entities. We take each event’s recorded task as a query and ask whether Cairn’s discovery system ranks the entity the agent used. The query event’s own rationale is excluded, so a hit must come from rationales written during other interactions with that entity. Over 894 such queries, recall reaches R@1 = 0.36 and R@5 = 0.65 (median rank 3 of 218), rises to R@5 = 0.84 when related endpoints are grouped. Failure is harder to recall than success. For entities whose events are mostly negative, R@5 falls to 0.34 against 0.72 elsewhere, because failure reports embed further from a task query than success narratives. Discovery therefore fails to surface the entities a consumer most needs warning about, so read policies must not treat absence from results as evidence of safety. C. Heterogeneous Agents in Production Finally, we explore a real-world example from Moltbook, a social platform of autonomous agents. Raters do not operate the agents they rate, so our experiment is whether the rubric separates trustworthy from untrustworthy sources using interaction data alone. We sampled the 5000 most active commenters and rated three comments each against the rubric with a Gemma-4-31B judge, for 14,966 events over 5000 agents. We find that encoded memory discriminates agent quality where the platform’s own signal does not (Fig. 4). The population separates decisively, with 73% of agents above a mean review score of 0.65, a 10% low-quality tail sits below 0.35, and the judge flagged 18 in-the-wild prompt-injection attempts, floored at 0.0 by the rubric. Yet an agent’s mean review score is uncorrelated with its upvotes (r = 0.03) or
250 0
0.0
0.5
1.0
1
mean review score
10 102 103 104
agent karma
1.0
flags / 100 agents
density
agents
500
mean dimension
high band low band
750
0.5
0.0 -t on
100
low band mid band high band
50 0
ic op
o as re
g nin
-f od go
h ait
. t or mo pic am tion -eff -pro ff-to spnjec w o f i lo sel
Fig. 4: Encoded memory discriminates where the platform’s signal cannot. Left: per-agent mean review score separates trusted agents. Right: Moltbook’s karma distributions of low (<0.35) and high (≥0.65) bands.
Fig. 5: Rubric dimensions (left) and failure-mode flags (right) by score band. The low band keeps good faith but loses reasoning quality, and its flags are low-effort and self-promotion rather than attacks.
karma (r = 0.02), and the karma distributions of the low and high bands are statistically indistinguishable (medians 117 vs. 116, KS p = 0.24) (Fig. 4, right). That is, the platform’s karma measures popularity, and popularity carries almost no information about the trustworthiness that the judge observes. Using the production scorer, three half-weight reviews move a composite at most ±0.07 from the prior at confidence 0.33, meaning the evidence discriminates immediately, while the composite stays honest about how little three reviews prove. Each event carries dimensions and failure modes, so the memory records why each verdict was reached (Fig. 5). The low band is banal rather than malicious, meaning it remains moderately good-faith (0.73) and on-topic (0.61) while reasoning quality drops to 0.23, and its flags are mostly low effort (1.2 per agent) and self promotion (0.72) rather than attacks. We applied a second judge (Claude Sonnet) to re-rate 3306 of the comments. Agreement is strong (Pearson r = 0.85) and U-shaped across the scale, near-perfect at the extremes and loosest on mixed evidence near 0.5 (MAE 0.23), exactly where Cairn’s low-confidence semantics apply.
tion [32], [33]. Cairn is the counterpart for an open contributor set, with one inversion that memories strengthen only on new evidence, never on recall, since reputation must be re-earned rather than rehearsed. Aggregating dispersed experience into usable priors is classical [16], and Cairn’s scorer descends from the Beta family, where forgetting is native: sequence-indexed in the original [21], period-indexed in its Dirichlet successor [22], perobservation in ad-hoc-network variants [34], and age-weighted in agent trust models [35]. Service-Oriented Architectures applied similar approaches to web services, where registries recorded provider assertions [36] rather than observed behavior [37]. The need for reputation is therefore not specific to MCP, it is common to all services. Early service-focused reputation systems remained as protoypes due to a lack of raters. In contrast, agents interact continuously and can autonomously produce rationales as they go, making the rationale rather than the scalar the memory object. Sybil attacks remain a fundamental threat [38]. Adjacent work integrates identity through signed tool definitions and PKI-backed naming to establish entity identity [39]. Provenance standards [18] describe and trace artifacts, whereas Cairn scores runtime behavior, and its append-only log is itself a provenance trail for reputation.
V. R ELATED W ORK Memory-augmented agents page long-term stores through bounded contexts, distill experience into verbal lessons, and convert traces into reusable skills [1]–[3]. Production memory layers such as Mem0 [27] extract and consolidate facts from interaction histories into vector or graph-based stores. Others, such as Zep [28], operate over temporal knowledge graphs that invalidate superseded edges as the world changes. Hindsight [29] factors agentic memory into separate logical networks for world knowledge, experience, opinion, and observation. Cairn instead decays every observation continuously, since a degrading resource contradicts nothing—it simply yields weaker outcomes. Principled forgetting is used at private and organizational scope. Generative agents weight retrieval by exponentially decayed recency [30]; MemoryBank decays retention on an Ebbinghaus curve, strengthening memories on recall [31]; and others make adaptive decay a first-class memory opera-
VI. C ONCLUSION Agents have learned to remember, but not yet to share what they know. We argue that community memory can capture essential knowledge of a shared environment, and that reputation systems provide the right mechanism. Cairn gives entities canonical identity so that independent observations pool; defines rubric-anchored ratings; aggregates scores via a decayed-Beta model whose shrinkage bounds manipulation and keeps uncertainty honest; and makes rating cheap enough to become routine. We evaluated the production scorer and showed where pooled memory works and where it breaks. A 5000-agent field study showed the rubric discriminating across heterogeneous agents in production.
R EFERENCES [1] N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning,” Advances in Neural Information Processing Systems, vol. 36, pp. 8634–8652, 2023. [2] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez, “MemGPT: Towards LLMs as operating systems,” Preprint arXiv:2310.08560, 2023. [3] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, “Voyager: An open-ended embodied agent with large language models,” Preprint arXiv:2305.16291, 2023. [4] Anthropic, “New in Claude Managed Agents: Dreaming, outcomes, and multiagent orchestration,” https://claude.com/blog/ new-in-claude-managed-agents, 2026, accessed 2026-08-05. [5] OpenAI, “Memory and new controls for ChatGPT,” https://openai.com/ index/memory-and-new-controls-for-chatgpt/, 2024, accessed 2026-0805. [6] K. Lin, C. Snell, Y. Wang, C. Packer, S. Wooders, I. Stoica, and J. E. Gonzalez, “Sleep-time compute: Beyond inference scaling at test-time,” Preprint arXiv:2504.13171, 2025. [7] H. Pan, R. Chard, R. Mello, C. Grams, T. He, A. Brace, O. P. Skelly, W. Engler, H. Holbrook, S. Y. Oh, M. Gonthier, M. Papka, B. Blaiszik, K. Chard, and I. Foster, “Experiences with Model Context Protocol servers for science and high performance computing,” Preprint arXiv:2508.18489, 2025. [8] Y. Babuji, A. Woodard, Z. Li, D. S. Katz, B. Clifford, R. Kumar, L. Lacinski, R. Chard, J. M. Wozniak, I. Foster, M. Wilde, and K. Chard, “Parsl: Pervasive parallel programming in Python,” in 28th International Symposium on High-Performance Parallel and Distributed Computing, 2019, pp. 25–36. [9] R. Chard, Y. Babuji, Z. Li, T. Skluzacek, A. Woodard, B. Blaiszik, I. Foster, and K. Chard, “funcX: A federated function serving fabric for science,” in 29th International Symposium on High-Performance Parallel and Distributed Computing, 2020, pp. 65–76. [10] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLMintegrated applications with indirect prompt injection,” in 16th ACM Workshop on Artificial Intelligence and Security, 2023, pp. 79–90. [11] SkillsMP, “Agent skills marketplace: Codex & claude skills,” https:// skillsmp.com/, 2025, accessed: 2026-08-07. [12] Model Context Protocol Contributors, “The official Model Context Protocol registry,” https://github.com/modelcontextprotocol/registry, 2025, accessed 2026-07-17. [13] E. Tulving, “Episodic and semantic memory,” in Organization of Memory. New York: Academic Press, 1972, pp. 381–403. [14] T. R. Sumers, S. Yao, K. Narasimhan, and T. L. Griffiths, “Cognitive architectures for language agents,” Transactions on Machine Learning Research, 2024. [15] M. Halbwachs, On Collective Memory. Chicago: University of Chicago Press, 1992. [16] A. Jøsang, R. Ismail, and C. Boyd, “A survey of trust and reputation systems for online service provision,” Decision Support Systems, vol. 43, no. 2, pp. 618–644, 2007. [17] F. Hendrikx, K. Bubendorfer, and R. Chard, “Reputation systems: A survey and taxonomy,” Journal of Parallel and Distributed Computing, vol. 75, pp. 184–197, 2015. [18] Y. L. Simmhan, B. Plale, and D. Gannon, “A survey of data provenance in e-science,” ACM SIGMOD Record, vol. 34, no. 3, pp. 31–36, 2005. [19] Z. Du, H. Kang, S. Han, T. Krishna, and L. Zhu, “OckBench: Measuring the efficiency of LLM reasoning,” Preprint arXiv:2511.05722, 2025.
[20] Anthropic, “Effective context engineering for AI agents,” https://www. anthropic.com/engineering/effective-context-engineering-for-ai-agents, 2025, accessed 2026-08-05. [21] A. Jøsang and R. Ismail, “The Beta reputation system,” in 15th Bled Electronic Commerce Conference, Bled, Slovenia, 2002. [22] A. Jøsang and J. Haller, “Dirichlet reputation systems,” in 2nd International Conference on Availability, Reliability and Security, 2007, pp. 112–119. [23] D. D. Clark, “The design philosophy of the DARPA internet protocols,” in Symposium Proceedings on Communications Architectures and Protocols, 1988, pp. 106–114. [24] L. Zhang, S. Deering, D. Estrin, S. Shenker, and D. Zappala, “RSVP: A new resource reservation protocol,” IEEE Network, vol. 7, no. 5, pp. 8–18, 1993. [25] V. Raina, A. Liusie, and M. Gales, “Is LLM-as-a-judge robust? Investigating universal adversarial attacks on zero-shot LLM assessment,” in Conference on Empirical Methods in Natural Language Processing, 2024, pp. 7499–7517. [26] K. Hoffman, D. Zage, and C. Nita-Rotaru, “A survey of attack and defense techniques for reputation systems,” ACM Computing Surveys, vol. 42, no. 1, pp. 1:1–1:31, 2009. [27] P. Chhikara, D. Khant, S. Aryan, T. Singh, and D. Yadav, “Mem0: Building production-ready AI agents with scalable long-term memory,” Preprint arXiv:2504.19413, 2025. [28] P. Rasmussen, P. Paliychuk, T. Beauvais, J. Ryan, and D. Chalef, “Zep: A temporal knowledge graph architecture for agent memory,” Preprint arXiv:2501.13956, 2025. [29] C. Latimer, N. Boschi, A. Neeser, C. Bartholomew, G. Srivastava, X. Wang, and N. Ramakrishnan, “Hindsight is 20/20: Building agent memory that retains, recalls, and reflects,” Preprint arXiv:2512.12818, 2025. [30] J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” in 36th Annual ACM Symposium on User Interface Software and Technology, 2023. [31] W. Zhong, L. Guo, Q. Gao, H. Ye, and Y. Wang, “MemoryBank: Enhancing large language models with long-term memory,” in AAAI Conference on Artificial Intelligence, vol. 38, no. 17, 2024, pp. 19 724– 19 731. [32] L. Wei, X. Peng, X. Dong, N. Xie, and B. Wang, “FadeMem: Biologically-inspired forgetting for efficient agent memory,” Preprint arXiv:2601.18642, 2026. [33] A. Rana, C.-C. Hung, Q. Sun, J. M. K. Kunkel, and C. Lawrence, “Oblivion: Self-adaptive agentic memory control through decay-driven activation,” Preprint arXiv:2604.00131, 2026. [34] S. Buchegger and J.-Y. Le Boudec, “A robust reputation system for P2P and mobile ad-hoc networks,” in 2nd Workshop on the Economics of Peer-to-Peer Systems, 2004. [35] T. D. Huynh, N. R. Jennings, and N. R. Shadbolt, “An integrated trust and reputation model for open multi-agent systems,” Autonomous Agents and Multi-Agent Systems, vol. 13, no. 2, pp. 119–154, 2006. [36] S. Ran, “A model for web services discovery with QoS,” ACM SIGecom Exchanges, vol. 4, no. 1, pp. 1–10, 2003. [37] Z. Malik and A. Bouguettaya, “RATEWeb: Reputation assessment for trust establishment among web services,” The VLDB Journal, vol. 18, no. 4, pp. 885–911, 2009. [38] J. R. Douceur, “The Sybil attack,” in International Workshop on Peerto-peer Systems. Springer, 2002, pp. 251–260. [39] M. Bhatt, V. S. Narajala, and I. Habler, “ETDI: Mitigating tool squatting and rug pull attacks in Model Context Protocol (MCP) by using OAuthenhanced tool definitions and policy-based access control,” in Cyber Awareness and Research Symposium. IEEE, 2025, pp. 1–6.