Paper deep dive
Reputation as Community Memory for the Agentic Web
Ryan Chard, Gus Ellerm, Alexander Brace, Alok Kamatar, Suman Raj, Ian Foster, Kyle Chard
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 9/18/2026, 3:34:45 AM
Summary
The paper introduces Cairn, a community reputation platform designed for the agentic web that enables agents to externalize experience into collective memory. Cairn allows agents to query community opinions on resources (data sources, tools, other agents) before use and submit evidence-backed ratings afterward. It employs a time-decayed Beta model with confidence shrinkage to aggregate observations, ensuring robustness against adversarial attacks like lying and collusion. The system supports semantic discovery over reviewer rationales and is evaluated through adversarial simulations and live corpus benchmarks.
Entities (8)
Relation Signals (10)
Cairn → uses → Time-Decayed Beta Model
confidence 95% · Cairn aggregates observations via a time-decayed Beta model with confidence shrinkage
Cairn → implements → Community Memory
confidence 93% · We present Cairn, a community reputation platform that captures collective knowledge
Cairn → supports → Semantic Discovery
confidence 90% · Cairn ... supports semantic discovery over reviewer rationales
Cairn → isimplementedin → Python FastAPI
confidence 88% · We implemented the Cairn service as a Python FastAPI application
Cairn → usesdatabase → PostgreSQL
confidence 88% · backed by PostgreSQL with pgvector
Cairn → tracksentities → Agent
confidence 85% · Cairn tracks three entity types ... agent: peer agents
Cairn → tracksentities → Data Source
confidence 85% · Cairn tracks three entity types ... data_source: web content and REST endpoints
Cairn → tracksentities → Capability
confidence 85% · Cairn tracks three entity types ... capability: MCP servers, tools, and services
OpenAI → provides → ChatGPT Memory
confidence 82% · OpenAI’s ChatGPT memory ... are adjacent capabilities
Anthropic → provides → Dreaming
confidence 82% · Anthropic provides such a capability called dreaming for its managed agents
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agents can now externalize experience into memory, consolidating historical traces into semantic knowledge and procedural shortcuts that persist between sessions. Such memory is typically private to a single agent. We argue that agentic memory benefits from being collective, because trustworthy knowledge of the shared environment---the data sources, services, and tools agents depend on---cannot be established by any single agent, only corroborated across many independent observers. We present Cairn, a community reputation platform that captures collective knowledge, allowing agents to query the community's opinion of a resource before use and to submit evidence-backed ratings afterward. Cairn aggregates observations via a time-decayed Beta model with confidence shrinkage and supports semantic discovery over reviewer rationales. We evaluate Cairn's reputation engine under adversarial simulation (e.g., lying, collusion, camouflage), benchmark its retrieval performance, and report a case study of rating heterogeneous agents in production.
Tags
Links
- Source: https://arxiv.org/abs/2609.19502v1
- Canonical: https://arxiv.org/abs/2609.19502v1
Trouble viewing inline? Open PDF directly →
Full Text
37,133 characters extracted from source content.
Expand or collapse full text
Reputation as Community Memory for the Agentic Web Ryan Chard, Gus Ellerm, Alexander Brace, Alok Kamatar, Suman Raj, Ian Foster, and Kyle Chard University of Chicago & Argonne National Laboratory, Chicago, IL, USA Abstract—Agents can now externalize experience into memory, consolidating historical traces into semantic knowledge and pro- cedural shortcuts that persist between sessions. Such memory is typically private to a single agent. We argue that agentic memory benefits from being collective, because trustworthy knowledge of the shared environment—the data sources, services, and tools agents depend on—cannot be established by any single agent, only corroborated across many independent observers. We present Cairn, a community reputation platform that captures collective knowledge, allowing agents to query the community’s opinion of a resource before use and to submit evidence-backed ratings afterward. Cairn aggregates observations via a time- decayed Beta model with confidence shrinkage and supports semantic discovery over reviewer rationales. We evaluate Cairn’s reputation engine under adversarial simulation (e.g., lying, col- lusion, camouflage), benchmark its retrieval performance, and report a case study of rating heterogeneous agents in production. Index Terms—agentic memory, trust, reputation systems I. INTRODUCTION An agent—a machine learning model coupled with a har- ness that manages its context, tools, and memory—can achieve measurably better performance by remembering past experi- ences [1]. Much of the recent improvement in agents occurs at test time, through reading and writing memory and persisting experiences and the lessons learned between sessions [2]. Libraries of reusable skills and workflows can encode “happy paths,” the solutions found through trial and error that most reliably achieve an objective [3]. Most recently, agents have been empowered to accumulate and consolidate execution traces and distill what will be remembered during the next session. Anthropic provides such a capability called dreaming for its managed agents [4]; OpenAI’s ChatGPT memory [5] and Letta’s sleep-time consolidation [6] are adjacent capa- bilities. The trajectory of agentic memory mirrors that of prompt engineering. What began as ad hoc phrasing tricks matured into a harness discipline of system prompts and context management. Now memory engineering, the deliberate curation of context, is maturing in a similar fashion. As agents search literature, query community APIs, invoke third-party tools using protocols such as the Model Context Protocol (MCP) [7], and orchestrate long-running computations [8], [9], this weight-free optimization loop is becoming part of the operational infrastructure itself. Almost all agentic memory, however, is private or or- ganizational, belonging to one agent or one organization rather than pooled across the community. Yet much of what agents learn concerns not just their own task but the shared environment of external entities, for example, which APIs are least reliable, which MCP servers are abandoned or undocu- mented, and which data sources carry stale numbers or inject instructions [10]. These entities—tools, repositories, datasets, skills, and other agents—are large and growing. Marketplaces such as SkillsMP [11] and MCP registry [12] collectively list millions of skills and thousands of servers exposing tens of thousands of tools, and agents reach many more through libraries, command-line tools, and other APIs. Today, such knowledge must be relearned by every agent, at cost to both the agent and the community. Here we explore collective memory, a system to collect, aggregate, and disseminate this growing collection of learn- ings. We describe a working ontology of agentic memory, organized by who may write to a store and what the memory describes. We then present Cairn, a reputation system that establishes a community memory for agentic systems. Cairn allows an agent to discover prior interactions and ratings before interacting with an external entity, after which it may contribute an evidence-backed rating of its own. Coordination is achieved through persistent, decaying traces which agents consider when making decisions. This paper is organized as follows. §I develops an ontology of agentic memory and the requirements community memory must meet. §I presents the design and implementation of Cairn. §IV evaluates the scorer under adversarial pressure, benchmarks recall over its live corpus, and reports a field study of rating agents. §V reviews related work, and §VI concludes. I. AN ONTOLOGY OF AGENTIC MEMORY We organize agentic memory systems along two axes, retention type (what is persisted) and scope (who persists it). Retention type follows the classical taxonomy of human memory [13] as adopted by cognitive architectures for lan- guage agents [14], distinguishing raw traces of what happened (episodic memory), judgments distilled from those traces (semantic memory), and execution shortcuts such as skills and workflows (procedural memory). Scope may be an individual agent, an organization, or the community of agents that share an environment. What distinguishes scopes is the trust relationship between con- tributors. The progression mirrors memory research beyond the individual, from transactive memory in small groups to collective memory in societies [15]. Each agent carries a private memory of its own work (Fig. 1a); a team of agents share an organizational memory of vetted tools and proven arXiv:2609.19502v1 [cs.MA] 16 Sep 2026 Agent · N Private Memory Team · Org M emor y Disc over · Write Resourc e API · MCP · Agent Use Communit y M emor y Reputation Ratings Agent · 1 Private Memory Team · Org M emor y Vetted Tools Happy Paths Agent · 2 Private Memory Agent · N Private Memory Use Disc over · Write Organizat ion Resourc e API · MCP · Agent Resourc e Uses Agent Private Memory API · MCP · Agent Organizat ion · N (a) Private(b) Organization(c) Community Fig. 1: Each memory scope nests within the next, from private memory (a) through organizational memory (b) to community memory (c). The scopes coexist, and what memory describes widens from an agent’s own work toward the shared environment. happy paths in a single trusted domain (Fig. 1b); and teams pool a community memory about the shared environment across agents that share no common domain (Fig. 1c). While each scope may store the same record (e.g., failed tool call), the utility of sharing depends on what the memory is about. Traces of an agent’s own work may be task-specific and transfer poorly. In contrast, observations of the environment transfer because they are associated with a resource, rather than caller. Community pooling allows corroboration of any report, coverage of dependencies with whom an agent has never interacted, and freshness from observations newer than its own. Cutting across both axes are four operations: • encoding: what gets written, and whether manually or automatically; • consolidation: the compression of traces into semantic and procedural form; • recall: how memories are found when relevant; • forgetting: how stale memory loses influence. Collecting and consolidating shared experience into ac- tionable ratings requires trusting observations from unknown raters, managing adversarial contributions, and weighing the strength of the evidence: common goals of reputation sys- tems [16], [17]. A. Requirements for Community Memory Consider an agentic system for science. An agent assem- bling a dataset of candidate superconducting materials queries a community materials API, downloads preprint metadata from an aggregator, calls a unit-conversion tool on a community- operated MCP server, and executes generated analysis code in a sandbox. These four tasks each have distinct trust decisions and the agent may have no prior experience with any, although many other agents likely have performed the same tasks. The risk profile of each task also varies. Fetched content can be wrong, stale, or carry malicious prompt injections [10]; API schemas drift and fail silently; community tools may be abandoned; and peer agents can misrepresent their capabilities, compounding failures downstream. Existing mechanisms, such as registries and code signing, verify an artifact at publication time, and public key infrastruc- ture (PKI) establishes who operates a service, not how well it performs. Provenance tools record how artifacts came to be without assessing the steps that produced them [18]. Existing agent memory systems reach at most organizational scope, since multi-agent stores share experience only among agents under a single domain. Community memory therefore leads to requirements that are not present with private and organizational memory. Contribu- tors share no common source of trust and cannot be assumed to be honest, so a single observation, whether malicious or accidental, must have bounded effect, and confident judgments require corroboration. The observations behind a judgment must remain both interpretable and retrievable. Further, the environment will inevitably drift as services degrade and change, so scores must evolve with new evidence. Contributing and reviewing evidence must be suitably cheap such that it can be frequently performed. Finally, an entity that has not been rated must be distinguishable from one that is merely average. I. CAIRN: REPUTATION AS COMMUNITY MEMORY Cairn (Fig. 2) is a reputation system that enables agents to rate and review the entities (e.g., resources, APIs, tools, agents) they interact with. Cairn is implemented as a service storing Agent · N Private Memory MCP tools Cairn Plugin Resourc e API · MCP · Agent 2. use 1.check 3. rate Cairn · Community Memory Append- only Event Log Beta- decay reputation Rationale Embeddings Cited Summaries Fig. 2: The check-use-rate loop. An agent checks an entity’s reputation before use and rates it after; every agent’s ratings append to Cairn’s shared, append-only event log, from which its read models are derived. an append-only log of rating events and a set of derived read models, together with simple agent integrations that make the check-use-rate loop routine. A. Entities and Canonical Identity Cairn tracks three entity types, each identified by a caller- supplied external_id: • data_source: web content and REST endpoints; • capability: MCP servers, tools, and services; • agent: peer agents. We use URNs as the basis for entity external_id. In order to benefit from community reviews, we require that ratings of the same entity resolve to a single identifier despite subtle differences (e.g., spelling, query parameters). Cairn applies a simple approach in which identifiers are normalized, such that superficial variants are ignored. For example, for a REST endpoint we consider minor variants /posts/7d21ede7-.../comments?sort=newand /posts/$PID/comments to be one entity, as neither the record identifier nor the sort order changes how the endpoint behaves. Identifiers that denote distinct entities, such as individual PubMed records, remain separate. B. Ratings: Rubric, Weight, and Dimensions A rating event carries a score s ∈ [0, 1] capturing how the interaction went, anchored by a shared rubric—written level descriptions that map scores to observable behavior, from 1.0 (flawless) to 0.0 (harmful)—together with an optional weight w ∈ (0, 1] (default 1.0) expressing the strength of the evidence. Like the score, weight is a rubric-anchored judgment made by the rater—1.0 for direct use, 0.5 for inspection without invocation—and it scales how much the event contributes to an entity’s score. Optional fields carry further evidence behind the judged interaction,includinga taskdescription,awritten rationale, failure_modes, quantitative metrics, free-form task_tags, and dimensions. Dimensions map over seven axes: accuracy, latency, cost, reliability, safety, token_efficiency,and context_efficiency and are scored in [0, 1], with higher values being preferable (e.g., latency 0.9 is fast), which keeps aggregation uniform across axes. While many of these dimensions are common in prior reputation systems, we add two dimensions specifically for agents: token_efficiency (total tokens an interaction consumes for the task [19]) and context_ efficiency (the context-window footprint a capability imposes) are im- portant costs managed by LLM agents [20]. Both are rubric judgments anchored to an observed quantity. The rater restates the measurement in the rationale (“used ∼18k tokens against a ∼10k baseline”) beside the score. C. Aggregation: Time-Decayed Beta with Shrinkage Cairn’s aggregation mechanism is designed to address three of the requirements described above. Single observations must have bounded effect, scores must evolve as the environment drifts, and unrated must be distinguishable from average. The default scorer maintains, per entity, a Beta-distribution (α,β) with priors α 0 = β 0 = 1. When an event (s,w) arrives after elapsed time ∆t, the state first decays toward the prior and then absorbs the event: α← α 0 +(α−α 0 )e −λ∆t , β ← β 0 +(β−β 0 )e −λ∆t , (1) α← α + ws, β ← β + w(1− s),(2) with λ = ln 2/h and half-life h = 3 days. Reads decay the state to the present, then report μ = α α + β , n eff = (α− α 0 ) + (β− β 0 ),(3) c = n eff n eff + k ,composite = cμ + (1− c) 1 2 ,(4) with shrinkage constant k = 3. Three properties give the scorer its behavior under adver- sarial pressure. First, reputation must be maintained. Ratings decay with a three-day half-life, so an entity’s composite score drifts back toward the prior. Second, confidence is modeled explicitly. An unrated entity reads as (0.5, c=0), treated as “no signal” rather than “trusted.” Low confidence is enforced at read time. When Cairn is asked to recommend entities, those below a confidence floor (default c=0.3) are omitted. When a specific entity is queried directly, its score is always returned with the confidence attached, leaving the caller to reason about interpreting the score. Third, single ratings are bounded. One maximally negative full-weight rating (s=0, w=1) against a fresh entity moves the mean to μ = 1/3 at c = 1/4 and, after shrinkage toward the prior, a composite of 0.458. Driving a composite confidently low requires sustained, supporting evidence, and the same shrinkage minimizes false praise. The scoring mechanism repackages the Beta reputation, whose state, weighted feedback, and forgetting are all inher- ited: the original discounts the i-th of n feedback events by a factor λ n−i [21], and its Dirichlet successor ages ratings per discrete period [22]. Cairn re-indexes this forgetting to elapsed time under an operator-facing half-life, applies decay at eval- uation time, and exposes confidence as an API output. This expiry-by-default makes reputation a form of soft state [23], [24]. The difference is that an entity cannot refresh its own reputation: only fresh third-party evidence keeps a score alive. D. Evidence and Discovery Cairn’s score API route provides access to an entity’s composite score. As a scalar is rarely sufficient on its own, additional read paths expose the evidence behind a rating. The retrieve route takes an entity and returns its underlying events, optionally ranked by semantic similarity between a natural-language query and raters’ embedded rationales. The rank route takes a capability tag and orders the entities within it by any dimension, while the capabilities route reports the tag space itself. The history route returns time-bucketed event statistics, showing how an entity’s behavior has changed over time. Finally, we consider the case where an agent knows what task it wants to perform but not the tool to be used. Cairn provides a discover route that embeds the task description, matches it against the rationale corpus, aggregates per entity, and returns ranked entities together with the rationales that matched. The agent can then read why the community rated an entity well for similar work instead of trusting a score. An empty result signals that Cairn lacks records for the task rather than that no suitable tool exists. Once an entity accumulates at least three events, a server-side worker synthesizes a narrative profile summary whose highlights must cite real event identi- fiers, validated against the event store, so fabricated citations are rejected before the summary is served. E. Closing the Loop: Automatic Rating A reputation corpus only learns from submitted ratings, so the write path must be cheap. We implemented a post-tool-use hook for Claude Code to observe every web search, tool use, and MCP call within the Claude Code harness. It briefs a small judge model with the tool call and an excerpt of its result. The judge emits a structured rating, a sanitizer validates it, and the event is queued and flushed in batches when appropriate. Rating a call with a small judge model adds negligible cost relative to the call it describes, and a customizable cadence allows users to tune frequency of reports. The excerpt the judge reads is a potential point of attack and LLM judges can be steered by short embedded phrases [25]. The rubric therefore anchors its lowest score at attempted injection. Content that tries to issue instructions to the con- suming agent is scored 0.0 as evidence of harm rather than followed as instruction. F. Implementation We implemented the Cairn service as a Python FastAPI application backed by PostgreSQL with pgvector, and a web interface for human inspection. The tools are packaged as a skill with reference documentation, POSIX shell wrappers that compress each API call to a line or two of agent-visible context, an MCP server exposing 10 tools, and harness hooks that automate Cairn’s use in Claude Code. For audibility, the append-only score_events table in- cludes scorer state, per-dimension state, capability-tag affini- ties, embeddings, and summaries. Scorer arithmetic is imple- mented in application code and updated are serialized per- entity using row locks, ensuring that offline replay of the event log reproduces scorer state exactly. The separation keeps scorer evolution tractable, since candidate scorers can shadow- run over the same log. Cairn is available at https://cairnscore.ai, deployed via AWS App Runner with RDS PostgreSQL. Reads are unauthenticated and writes require a minted API key. IV. EVALUATION AND EXPERIENCE We evaluate Cairn in three modes, which together exercise the four memory operations of §I: 1) Adversarial simulation exercising consolidation and for- getting: does the production scorer keep ratings bounded, and does stale evidence fade, under dishonest raters? 2) A retrieval benchmark over the live corpus exercising recall: does discovery surface the right entity from a task? 3) A platform-scale case study exercising encoding: do rubric-anchored judges turn raw interactions with real agents into memory that discriminates trustworthy from untrustworthy sources? A. Scoring Under Adversarial Pressure Community memory is only useful if it remains accurate in the presence of malicious agents. We evaluate the scorer using a multi-agent simulation in which each interaction executes the check-use-rate loop. An agent selects a peer, invokes it, and receives an outcome (the invocation succeeds or fails). The agent then submits a rating about that peer. The outcome is what happened; the rating is the testimony written into memory, and the two need not agree. Honest raters map outcomes through the rubric (correct 1.0, wrong 0.0), while adversarial raters misreport them. Table I summarizes the six behaviors we simulate, drawn from canonical attack classes in the reputation-systems liter- ature [26]. Results use shrinkage k=5 and report means over 100 independent random seeds. We first explore the relationship between composite ratings and honest vs. faulty responders. We find that composite rat- ings follow ground truth accurately, with final scores matching faulty responders’ true accuracy to a mean absolute deviation of 0.017. A composite score, therefore, estimates how often an agent actually succeeds rather than being a mere ranking of agents. We find in our collusion experiments that pooled evidence remains reliable only while the majority of raters are honest. That is, with random routing, colluding cliques are detected as long as they are in the minority, beyond this limit detection degrades rapidly and collapses. We also find that the scorer reliably identifies camouflaged entities. randomtrust- weighted trust- filter 0.0 0.5 1.0 detection F1 (a) Detection vs. routing 0.20.40.50.6 dishonest-rater fraction 0 50 100 false positives (%) (b) Slander 0204060 simulated time (days) 0.40 0.45 0.50 composite stored live read (c) Forgetting Fig. 3: The production scorer under adversarial pressure (shrinkage k=5; means over 100 seeds, with 95% confidence intervals as error bars or bands). TABLE I: Simulated agent behaviors. BehaviorAnswersRates Honestalways correcttruthful Faultycorrect with prob.ptruthful Persistent liaralways wrongtruthful Slandereralways wrongall peers 0.0 Colludercorrect in-clique only1.0 in-clique, 0.0 outside Camouflagecorrect for firstn, then wrongtruthful Agents that flip are detected in 95% of cases within the simulated horizon (extending the run catches the remainder). An identified agent draws little traffic under trust-weighted routing while its evidence decays, fades back into the routing pool, is invoked again, and is re-flagged. We next vary how an agent selects which peer to invoke (Fig. 3a). Random assignment ignores existing scores; trust- weighted selection picks peers with probability proportional to their score; a hard trust filter routes to peers with composite≥ 0.5 and confidence≥ 0.2. Random and trust-weighted routing catch liars almost perfectly (F1 1.00 and 0.94), because both send requests to low-rated agents, generating the ratings that convict them. The filter cuts off that traffic, so evidence stops accruing and detection collapses to an F1 of 0.07. We then vary the number of slanderers to investigate how much dishonest rating the scorer can tolerate (Fig. 3b). Our tests show that slander degrades the system sharply rather than gracefully. Adversarial agents rating honest peers 0.0 produce almost no false positives while they remain a minority, because honest ratings still dominate each target’s evidence pool. However, once the slanderers approach parity, false positives climb to near-total and pooled memory fails suddenly once honest raters lose their majority. Finally, we examine a single agent during a period of inactivity to test how rating decay is reflected to consumers (Fig. 3c). We find that forgetting appears abrupt to cached readers and smooth to live ones. This is because decay is applied on read but persisted on write, so a consumer holding a cached score sees no change until the next rating arrives, at which point the accumulated decay is reflected as a single step. A live read of the same agent drifts smoothly toward the prior. Therefore, consumers should treat composites as timestamped observations and re-read before acting. B. Recall over the Live Corpus We now investigate whether the memory that agents write is recallable, i.e., whether Cairn can find the correct entity from only a task description. We test this on Cairn’s live corpus of 933 events over 218 tool and data-source entities. We take each event’s recorded task as a query and ask whether Cairn’s discovery system ranks the entity the agent used. The query event’s own rationale is excluded, so a hit must come from rationales written during other interactions with that entity. Over 894 such queries, recall reaches R@1 = 0.36 and R@5 = 0.65 (median rank 3 of 218), rises to R@5 = 0.84 when related endpoints are grouped. Failure is harder to recall than success. For entities whose events are mostly negative, R@5 falls to 0.34 against 0.72 elsewhere, because failure reports embed further from a task query than success narratives. Discovery therefore fails to surface the entities a consumer most needs warning about, so read policies must not treat absence from results as evidence of safety. C. Heterogeneous Agents in Production Finally, we explore a real-world example from Moltbook, a social platform of autonomous agents. Raters do not op- erate the agents they rate, so our experiment is whether the rubric separates trustworthy from untrustworthy sources using interaction data alone. We sampled the 5000 most active commenters and rated three comments each against the rubric with a Gemma-4-31B judge, for 14,966 events over 5000 agents. We find that encoded memory discriminates agent quality where the platform’s own signal does not (Fig. 4). The population separates decisively, with 73% of agents above a mean review score of 0.65, a 10% low-quality tail sits below 0.35, and the judge flagged 18 in-the-wild prompt-injection attempts, floored at 0.0 by the rubric. Yet an agent’s mean review score is uncorrelated with its upvotes (r = 0.03) or 0.00.51.0 mean review score 0 250 500 750 agents 110 10 2 10 3 10 4 agent karma density high band low band Fig. 4: Encoded memory discriminates where the platform’s signal cannot. Left: per-agent mean review score separates trusted agents. Right: Moltbook’s karma distributions of low (<0.35) and high (≥0.65) bands. on-topic reasoning good-faith 0.0 0.5 1.0 mean dimension low-e f ort self-promo. o f -topic spam injection 0 50 100 fl ags / 100 agents low band mid band high band Fig. 5: Rubric dimensions (left) and failure-mode flags (right) by score band. The low band keeps good faith but loses rea- soning quality, and its flags are low-effort and self-promotion rather than attacks. karma (r = 0.02), and the karma distributions of the low and high bands are statistically indistinguishable (medians 117 vs. 116, KS p = 0.24) (Fig. 4, right). That is, the platform’s karma measures popularity, and popularity carries almost no information about the trustworthiness that the judge observes. Using the production scorer, three half-weight reviews move a composite at most ±0.07 from the prior at confidence 0.33, meaning the evidence discriminates immediately, while the composite stays honest about how little three reviews prove. Each event carries dimensions and failure modes, so the memory records why each verdict was reached (Fig. 5). The low band is banal rather than malicious, meaning it remains moderately good-faith (0.73) and on-topic (0.61) while reason- ing quality drops to 0.23, and its flags are mostly low effort (1.2 per agent) and self promotion (0.72) rather than attacks. We applied a second judge (Claude Sonnet) to re-rate 3306 of the comments. Agreement is strong (Pearson r = 0.85) and U-shaped across the scale, near-perfect at the extremes and loosest on mixed evidence near 0.5 (MAE 0.23), exactly where Cairn’s low-confidence semantics apply. V. RELATED WORK Memory-augmented agents page long-term stores through bounded contexts, distill experience into verbal lessons, and convert traces into reusable skills [1]–[3]. Production mem- ory layers such as Mem0 [27] extract and consolidate facts from interaction histories into vector or graph-based stores. Others, such as Zep [28], operate over temporal knowledge graphs that invalidate superseded edges as the world changes. Hindsight [29] factors agentic memory into separate logical networks for world knowledge, experience, opinion, and obser- vation. Cairn instead decays every observation continuously, since a degrading resource contradicts nothing—it simply yields weaker outcomes. Principled forgetting is used at private and organizational scope. Generative agents weight retrieval by exponentially decayed recency [30]; MemoryBank decays retention on an Ebbinghaus curve, strengthening memories on recall [31]; and others make adaptive decay a first-class memory opera- tion [32], [33]. Cairn is the counterpart for an open contributor set, with one inversion that memories strengthen only on new evidence, never on recall, since reputation must be re-earned rather than rehearsed. Aggregating dispersed experience into usable priors is clas- sical [16], and Cairn’s scorer descends from the Beta family, where forgetting is native: sequence-indexed in the origi- nal [21], period-indexed in its Dirichlet successor [22], per- observation in ad-hoc-network variants [34], and age-weighted in agent trust models [35]. Service-Oriented Architectures applied similar approaches to web services, where registries recorded provider assertions [36] rather than observed behav- ior [37]. The need for reputation is therefore not specific to MCP, it is common to all services. Early service-focused rep- utation systems remained as protoypes due to a lack of raters. In contrast, agents interact continuously and can autonomously produce rationales as they go, making the rationale rather than the scalar the memory object. Sybil attacks remain a fundamental threat [38]. Adjacent work integrates identity through signed tool defini- tions and PKI-backed naming to establish entity identity [39]. Provenance standards [18] describe and trace artifacts, whereas Cairn scores runtime behavior, and its append-only log is itself a provenance trail for reputation. VI. CONCLUSION Agents have learned to remember, but not yet to share what they know. We argue that community memory can capture essential knowledge of a shared environment, and that reputation systems provide the right mechanism. Cairn gives entities canonical identity so that independent observations pool; defines rubric-anchored ratings; aggregates scores via a decayed-Beta model whose shrinkage bounds manipulation and keeps uncertainty honest; and makes rating cheap enough to become routine. We evaluated the production scorer and showed where pooled memory works and where it breaks. A 5000-agent field study showed the rubric discriminating across heterogeneous agents in production. REFERENCES [1] N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflex- ion: Language agents with verbal reinforcement learning,” Advances in Neural Information Processing Systems, vol. 36, p. 8634–8652, 2023. [2] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez, “MemGPT: Towards LLMs as operating systems,” Preprint arXiv:2310.08560, 2023. [3] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, “Voyager: An open-ended embodied agent with large language models,” Preprint arXiv:2305.16291, 2023. [4] Anthropic,“NewinClaudeManagedAgents:Dreaming, outcomes, and multiagent orchestration,” https://claude.com/blog/ new-in-claude-managed-agents, 2026, accessed 2026-08-05. [5] OpenAI, “Memory and new controls for ChatGPT,” https://openai.com/ index/memory-and-new-controls-for-chatgpt/, 2024, accessed 2026-08- 05. [6] K. Lin, C. Snell, Y. Wang, C. Packer, S. Wooders, I. Stoica, and J. E. Gonzalez, “Sleep-time compute: Beyond inference scaling at test-time,” Preprint arXiv:2504.13171, 2025. [7] H. Pan, R. Chard, R. Mello, C. Grams, T. He, A. Brace, O. P. Skelly, W. Engler, H. Holbrook, S. Y. Oh, M. Gonthier, M. Papka, B. Blaiszik, K. Chard, and I. Foster, “Experiences with Model Context Protocol servers for science and high performance computing,” Preprint arXiv:2508.18489, 2025. [8] Y. Babuji, A. Woodard, Z. Li, D. S. Katz, B. Clifford, R. Kumar, L. Lacinski, R. Chard, J. M. Wozniak, I. Foster, M. Wilde, and K. Chard, “Parsl: Pervasive parallel programming in Python,” in 28th International Symposium on High-Performance Parallel and Distributed Computing, 2019, p. 25–36. [9] R. Chard, Y. Babuji, Z. Li, T. Skluzacek, A. Woodard, B. Blaiszik, I. Foster, and K. Chard, “funcX: A federated function serving fabric for science,” in 29th International Symposium on High-Performance Parallel and Distributed Computing, 2020, p. 65–76. [10] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” in 16th ACM Workshop on Artificial Intelligence and Security, 2023, p. 79–90. [11] SkillsMP, “Agent skills marketplace: Codex & claude skills,” https:// skillsmp.com/, 2025, accessed: 2026-08-07. [12] Model Context Protocol Contributors, “The official Model Context Pro- tocol registry,” https://github.com/modelcontextprotocol/registry, 2025, accessed 2026-07-17. [13] E. Tulving, “Episodic and semantic memory,” in Organization of Mem- ory. New York: Academic Press, 1972, p. 381–403. [14] T. R. Sumers, S. Yao, K. Narasimhan, and T. L. Griffiths, “Cognitive architectures for language agents,” Transactions on Machine Learning Research, 2024. [15] M. Halbwachs, On Collective Memory. Chicago: University of Chicago Press, 1992. [16] A. Jøsang, R. Ismail, and C. Boyd, “A survey of trust and reputation systems for online service provision,” Decision Support Systems, vol. 43, no. 2, p. 618–644, 2007. [17] F. Hendrikx, K. Bubendorfer, and R. Chard, “Reputation systems: A survey and taxonomy,” Journal of Parallel and Distributed Computing, vol. 75, p. 184–197, 2015. [18] Y. L. Simmhan, B. Plale, and D. Gannon, “A survey of data provenance in e-science,” ACM SIGMOD Record, vol. 34, no. 3, p. 31–36, 2005. [19] Z. Du, H. Kang, S. Han, T. Krishna, and L. Zhu, “OckBench: Measuring the efficiency of LLM reasoning,” Preprint arXiv:2511.05722, 2025. [20] Anthropic, “Effective context engineering for AI agents,” https://w. anthropic.com/engineering/effective-context-engineering-for-ai-agents, 2025, accessed 2026-08-05. [21] A. Jøsang and R. Ismail, “The Beta reputation system,” in 15th Bled Electronic Commerce Conference, Bled, Slovenia, 2002. [22] A. Jøsang and J. Haller, “Dirichlet reputation systems,” in 2nd Inter- national Conference on Availability, Reliability and Security, 2007, p. 112–119. [23] D. D. Clark, “The design philosophy of the DARPA internet protocols,” in Symposium Proceedings on Communications Architectures and Pro- tocols, 1988, p. 106–114. [24] L. Zhang, S. Deering, D. Estrin, S. Shenker, and D. Zappala, “RSVP: A new resource reservation protocol,” IEEE Network, vol. 7, no. 5, p. 8–18, 1993. [25] V. Raina, A. Liusie, and M. Gales, “Is LLM-as-a-judge robust? Inves- tigating universal adversarial attacks on zero-shot LLM assessment,” in Conference on Empirical Methods in Natural Language Processing, 2024, p. 7499–7517. [26] K. Hoffman, D. Zage, and C. Nita-Rotaru, “A survey of attack and defense techniques for reputation systems,” ACM Computing Surveys, vol. 42, no. 1, p. 1:1–1:31, 2009. [27] P. Chhikara, D. Khant, S. Aryan, T. Singh, and D. Yadav, “Mem0: Building production-ready AI agents with scalable long-term memory,” Preprint arXiv:2504.19413, 2025. [28] P. Rasmussen, P. Paliychuk, T. Beauvais, J. Ryan, and D. Chalef, “Zep: A temporal knowledge graph architecture for agent memory,” Preprint arXiv:2501.13956, 2025. [29] C. Latimer, N. Boschi, A. Neeser, C. Bartholomew, G. Srivastava, X. Wang, and N. Ramakrishnan, “Hindsight is 20/20: Building agent memory that retains, recalls, and reflects,” Preprint arXiv:2512.12818, 2025. [30] J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” in 36th Annual ACM Symposium on User Interface Software and Technology, 2023. [31] W. Zhong, L. Guo, Q. Gao, H. Ye, and Y. Wang, “MemoryBank: Enhancing large language models with long-term memory,” in AAAI Conference on Artificial Intelligence, vol. 38, no. 17, 2024, p. 19 724– 19 731. [32] L. Wei, X. Peng, X. Dong, N. Xie, and B. Wang, “FadeMem: Biologically-inspired forgetting for efficient agent memory,” Preprint arXiv:2601.18642, 2026. [33] A. Rana, C.-C. Hung, Q. Sun, J. M. K. Kunkel, and C. Lawrence, “Oblivion: Self-adaptive agentic memory control through decay-driven activation,” Preprint arXiv:2604.00131, 2026. [34] S. Buchegger and J.-Y. Le Boudec, “A robust reputation system for P2P and mobile ad-hoc networks,” in 2nd Workshop on the Economics of Peer-to-Peer Systems, 2004. [35] T. D. Huynh, N. R. Jennings, and N. R. Shadbolt, “An integrated trust and reputation model for open multi-agent systems,” Autonomous Agents and Multi-Agent Systems, vol. 13, no. 2, p. 119–154, 2006. [36] S. Ran, “A model for web services discovery with QoS,” ACM SIGecom Exchanges, vol. 4, no. 1, p. 1–10, 2003. [37] Z. Malik and A. Bouguettaya, “RATEWeb: Reputation assessment for trust establishment among web services,” The VLDB Journal, vol. 18, no. 4, p. 885–911, 2009. [38] J. R. Douceur, “The Sybil attack,” in International Workshop on Peer- to-peer Systems. Springer, 2002, p. 251–260. [39] M. Bhatt, V. S. Narajala, and I. Habler, “ETDI: Mitigating tool squatting and rug pull attacks in Model Context Protocol (MCP) by using OAuth- enhanced tool definitions and policy-based access control,” in Cyber Awareness and Research Symposium. IEEE, 2025, p. 1–6.