Agenthold

agenthold

Stop your AI agents from silently overwriting each other.

When two agents update the same value, the second write quietly destroys the first. No error, no exception, just wrong data and a system that keeps running. agenthold is an MCP server that gives agents shared, versioned state with conflict detection built in. Think of it as git for your agents' working memory.

The problem

When two agents update the same value at the same time, the second write silently overwrites the first. No exception is raised. The value is wrong. The system keeps running.

Two agents read a $10,000 budget and allocate from it independently. Total committed: $15,000. The budget object never complains. This is a read-modify-write conflict: each agent's write assumes nothing changed since its read.

How it works

agenthold solves this with optimistic concurrency control (OCC), the same mechanism Postgres uses in UPDATE ... WHERE version = N and DynamoDB uses in conditional writes.

Every value stored in agenthold has a version number. When an agent writes, it passes the version it read. If the stored version has changed since the read, the write is rejected with a ConflictError that includes the current value. The agent re-reads, recalculates, and retries.

The losing agent detects the conflict, re-reads the real remaining budget ($2,000), and adjusts its allocation. The total committed is always exactly $10,000. Every write is tracked.

OCC is the right fit for agent workflows because:

• Agents do work between reads and writes (network calls, LLM inference). You cannot hold a database lock across that work.
• Conflicts are rare. Retrying once is cheaper than acquiring a lock on every read.
• The retry logic is simple, explicit, and fully in the agent's control.

Works with any agent framework

agenthold connects via MCP (Model Context Protocol), the open standard for tool integration. Any framework that speaks MCP can use agenthold with zero glue code.

agenthold is not a framework. It is shared infrastructure that sits underneath your orchestration layer, the same way a database sits underneath your application. Your agents keep their existing tools and logic; agenthold adds the coordination primitive they are missing.

Not using MCP yet? agenthold also works as a Python library you can call directly from any framework. Import StateStore, call .get() and .set() with version checks, and you have conflict-safe shared state.

Architecture

graph LR
    A1["Agent 1
    LangChain, CrewAI, etc."] -->|MCP| S["agenthold
    MCP Server"]
    A2["Agent 2
    Claude, OpenAI, etc."] -->|MCP| S
    A3["Agent 3
    AutoGen, ADK, etc."] -->|MCP| S
    S --> DB[("SQLite
    WAL mode")]
    DB -->|version 3| S
    S -->|"conflict! retry"| A2

Every write carries a version number. If the stored version has changed since an agent's read, the write is rejected and the agent retries with current data. This is the same mechanism used by Postgres conditional updates and DynamoDB conditional writes.

Quick start

1. Install

pip install agenthold
# or
uv pip install agenthold

2. Add to your MCP client config

{
  "mcpServers": {
    "agenthold": {
      "command": "agenthold",
      "args": ["--db", "/path/to/state.db"]
    }
  }
}

3. Done

Agents automatically coordinate. No CLAUDE.md, no system prompt changes, no namespace design.

When an agent connects, it sees five self-documenting tools: agenthold_register, agenthold_claim, agenthold_release, agenthold_status, and agenthold_wait. The tool descriptions tell the agent when and how to use each one. Server instructions reinforce the protocol when the MCP client includes them.

Resources

agenthold identifies resources by canonical URIs. Tools accept either form:

• Bare path (e.g. "src/main.py") — resolves against the workspace named default, or the only configured workspace if exactly one exists.
• Explicit URI — "file://<workspace>/<path>" for files, "custom://<name>" for opaque resources.

Equivalent inputs (./src/main.py, src\main.py, src//main.py, an absolute path inside the workspace) all canonicalize to the same internal URI, so two agents using different shorthands never fragment the keyspace. Path traversal (..) and dot segments (.) are rejected at the boundary.

Configure workspaces with --workspace name=path (repeatable). With no flag, agenthold creates a single default workspace at the current working directory. Multi-workspace setups let one agenthold process coordinate across separate codebases.

Tools

agenthold exposes five coordination tools by default.

agenthold_register

Register yourself and receive a unique agent ID. Must be called once before using agenthold_claim or agenthold_release.

{ "name": "editor-agent", "model": "claude-sonnet-4-6" }

{
  "status": "registered",
  "agent_id": "agent-a1b2c3d4",
  "name": "editor-agent",
  "registered_at": "2026-03-18T10:00:00+00:00"
}

agenthold_claim

Claim exclusive access to a resource before modifying it. Requires a registered agent_id.

{ "resource": "intro.md", "agent_id": "agent-a1b2c3d4" }

Claimed (you hold exclusive access):

{ "status": "claimed", "resource": "file://default/intro.md", "version": 1 }

If the resource has a non-trivial prior history (deleted, moved, abandoned, or expired), the response also carries previous_outcome, previous_holder, previous_outcome_at, and a hint describing what the previous holder did. For previous_outcome: "moved", moved_to is the new resource URI.

Busy (another agent is working on this resource):

{
  "status": "busy",
  "resource": "file://default/intro.md",
  "held_by": "agent-e5f6g7h8",
  "claimed_at": "2026-03-18T10:00:00+00:00",
  "hint": "Another agent holds this resource. Work on a different resource, or call agenthold_wait to be notified when it becomes available."
}

Already claimed (you already hold this claim, idempotent):

{ "status": "already_claimed", "resource": "file://default/intro.md", "version": 1 }

agenthold_release

Release your claim with an explicit outcome describing what you did. The outcome is preserved in the free-state record and shown to the next claimant so they don't act on stale assumptions. Requires a registered agent_id.

{
  "resource": "intro.md",
  "agent_id": "agent-a1b2c3d4",
  "outcome": "modified"
}

{ "status": "released", "resource": "file://default/intro.md", "version": 2, "outcome": "modified" }

Outcomes: released (default — no lifecycle claim), modified (changed in place), created (didn't exist before), deleted (no longer exists at this resource), moved (relocated — also pass moved_to with the new resource).

For renames (mv old new): claim BOTH paths, do the rename on disk, then release the source with outcome: "moved", moved_to: "new" and the destination with outcome: "created".

agenthold_status

Check whether a resource is available or currently claimed. Does not require registration.

{ "resource": "intro.md" }

Available:

{ "status": "available", "resource": "file://default/intro.md" }

If a previous holder declared a non-trivial outcome (deleted, moved, abandoned, expired), the response also includes previous_outcome, previous_holder, previous_outcome_at, and a hint. For moved, moved_to is the new resource URI.

Claimed:

{
  "status": "claimed",
  "resource": "file://default/intro.md",
  "held_by": "agent-e5f6g7h8",
  "agent_name": "editor-agent",
  "agent_model": "claude-sonnet-4-6",
  "claimed_at": "2026-03-18T10:00:00+00:00",
  "version": 3
}

agenthold_wait

Wait for a claimed resource to become available. Blocks the agent turn until the holder releases, or the timeout expires.

{ "resource": "intro.md", "timeout_seconds": 30 }

Available (resource was released):

{ "status": "available", "resource": "file://default/intro.md", "elapsed_seconds": 2.4 }

When the wait fires on a release with a non-trivial outcome, the response also carries previous_outcome, previous_holder, previous_outcome_at, optional moved_to, and a hint. An agent that was waiting to edit a moved or deleted resource learns why the path became available.

Timeout:

{
  "status": "timeout",
  "resource": "file://default/intro.md",
  "held_by": "writer-2",
  "elapsed_seconds": 30.2,
  "hint": "The resource was not released within the timeout. Try working on a different resource, or call agenthold_wait again with a longer timeout."
}

Advanced tools

For custom coordination protocols, agenthold exposes eight low-level primitives via --tools advanced:

agenthold_get · agenthold_set · agenthold_list · agenthold_history · agenthold_delete · agenthold_watch · agenthold_clear_namespace · agenthold_export

These give agents direct read/write/watch access to the versioned state store with full OCC conflict detection. No server instructions are sent in this mode.

See the full advanced tools reference →

Conflict detection

The read-modify-write pattern with expected_version is the core of agenthold. Here is the canonical retry loop:

from agenthold.store import StateStore
from agenthold.exceptions import ConflictError

store = StateStore("./state.db")

record = store.get("campaign", "budget")   # read once before doing work
do_expensive_work()                         # LLM call, API request, etc.

while True:
    new_value = compute_new_value(record.value)
    try:
        store.set(
            "campaign", "budget", new_value,
            updated_by="my-agent",
            expected_version=record.version,
        )
        break   # write succeeded
    except ConflictError:
        

…