diff --git a/README.md b/README.md
index 05e6524..c721e66 100644
--- a/README.md
+++ b/README.md
@@ -185,6 +185,7 @@ Projects that instrument agents for security observability, which could be usefu
 | [SourceryKit](https://github.com/ProvablyAI/sourcerykit) | zero-knowledge, source-of-truth, egress, MCP, allowlist | Source-available Python SDK and gateway that verifies an agent's outbound HTTP requests and MCP tool calls against a source of truth using zero-knowledge proofs, so a call only goes out if its claims check out. Allow-lists trusted endpoints and logs every outbound call for provenance. BSL 1.1, with a hosted backend for the proof and source-of-truth check. |
 | [Prismor Attestation Bundle](https://github.com/PrismorSec/prismor/blob/main/docs/attestation-bundle.md) | attestation, Ed25519, compliance-mapping | Ed25519-signed bundle of governance posture: agent inventory, host discovery (shadow AI sweep), audit-trail anchor, and framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act). JCS-canonical, offline-verifiable. |
 | [aee-conformance](https://github.com/astrogilda/aee-conformance) | in-toto, attestation, recompute-verify | Conformance vector suite and reference verifier for the in-toto Adversarial Execution Evidence (AEE v0.7) predicate. Execute-and-attest model: consumer recomputes outcome from carried bytes rather than trusting producer verdicts. |
+| [memory-blackbox](https://github.com/lavkumarv/memory-blackbox) | provenance, Ed25519, BLAKE3, Merkle, MCP, rollback | Post-incident forensics for agent memory: every read and write is captured into an append-only ledger (BLAKE3 hash chain, Ed25519 signatures, signed Merkle checkpoints) and a provenance DAG, so a harmful action can be traced to the memory that caused it, the forward closure of a poisoned source computed, and the poison quarantined by appending rather than deleting. Capture via library adapters (Mem0, Chroma, Letta, pgvector, `MEMORY.md`/`CLAUDE.md` diffing), an MCP gateway that forwards `tools/call` byte-identically, or a sidecar in front of hosted vector DBs. The signing key is held by the engine and never reachable by the agent. Reconstruction only — it enforces nothing at runtime. Early development. |
 
 ## Secrets Management & Isolation