diff --git a/.cursor/rules/codebase-memory.mdc b/.cursor/rules/codebase-memory.mdc
new file mode 100644
index 000000000..cc1680b32
--- /dev/null
+++ b/.cursor/rules/codebase-memory.mdc
@@ -0,0 +1,38 @@
+---
+description: Codebase Memory graph-first repository intelligence policy
+globs: **/*
+alwaysApply: true
+---
+# Codebase Memory MCP Policy
+
+Codebase Memory is an advisory repository-intelligence layer. Source code, schemas, tests, DECISIONS.md, AGENTS.md, and existing project rules remain authoritative.
+
+## Mandatory workflow
+
+For architecture discovery, dependency tracing, blast-radius analysis, or any change that can affect multiple files:
+
+1. Use Codebase Memory first when the MCP server is available.
+2. Establish current architecture with `get_architecture` when the session lacks fresh repository context.
+3. Locate symbols and relationships with `search_graph` and `trace_path` instead of broad repeated file reads.
+4. Before editing, determine the affected surface and read the actual source files that will be changed.
+5. Never treat graph output as authorization to violate `.cursorrules`, `DECISIONS.md`, `AGENTS.md`, sealed boundaries, or user scope.
+6. After editing, run `detect_changes` to inspect blast radius when Codebase Memory is available.
+7. Run the repository's existing verification gates from `AGENTS.md` and `.cursorrules`. Graph analysis never replaces schema validation, tests, checks, builds, or language validation.
+
+## Failure behavior
+
+- If the graph is missing, stale, degraded, or lacks coverage for a relevant path, fall back to direct source search/read and continue safely.
+- Dynamic behavior not represented in the graph must be verified from source and tests.
+- A clean graph result means only that no relationship was recorded; it is not proof that no dependency exists.
+- Never modify code solely from graph summaries without reading the target implementation.
+
+## Persistence
+
+- `auto_index=true` is recommended.
+- `auto_watch=true` is recommended.
+- Do not commit `.codebase-memory/graph.db.zst` or any generated graph artifact unless the user explicitly requests a team-shared graph snapshot.
+
+## Invariant
+
+SOURCE + PROJECT RULES + TESTS = SSOT.
+CODEBASE MEMORY = DERIVED NAVIGATION AND IMPACT INTELLIGENCE ONLY.
diff --git a/scripts/setup-codebase-memory.ps1 b/scripts/setup-codebase-memory.ps1
new file mode 100644
index 000000000..fb6233b81
--- /dev/null
+++ b/scripts/setup-codebase-memory.ps1
@@ -0,0 +1,25 @@
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = (git rev-parse --show-toplevel).Trim()
+if (-not $repoRoot) { throw 'Unable to resolve repository root.' }
+
+if (-not (Get-Command codebase-memory-mcp -ErrorAction SilentlyContinue)) {
+    $installer = Join-Path $env:TEMP ("cbm-install-{0}.ps1" -f [guid]::NewGuid().ToString('N'))
+    try {
+        Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.ps1' -OutFile $installer
+        Unblock-File $installer -ErrorAction SilentlyContinue
+        & powershell -NoProfile -ExecutionPolicy Bypass -File $installer
+    }
+    finally {
+        Remove-Item $installer -Force -ErrorAction SilentlyContinue
+    }
+}
+
+codebase-memory-mcp config set auto_index true
+codebase-memory-mcp config set auto_watch true
+codebase-memory-mcp config set auto_index_limit 50000
+codebase-memory-mcp cli --progress index_repository --repo-path $repoRoot
+codebase-memory-mcp cli list_projects
+
+Write-Output 'Codebase Memory is installed and this repository is indexed.'
+Write-Output 'Restart Cursor so the MCP server and managed agent configuration are loaded.'
diff --git a/scripts/setup-codebase-memory.sh b/scripts/setup-codebase-memory.sh
new file mode 100644
index 000000000..be87189ab
--- /dev/null
+++ b/scripts/setup-codebase-memory.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+if ! command -v codebase-memory-mcp >/dev/null 2>&1; then
+  INSTALLER="$(mktemp)"
+  trap 'rm -f "$INSTALLER"' EXIT
+  curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
+    https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh \
+    --output "$INSTALLER"
+  bash "$INSTALLER"
+fi
+
+codebase-memory-mcp config set auto_index true
+codebase-memory-mcp config set auto_watch true
+codebase-memory-mcp config set auto_index_limit 50000
+codebase-memory-mcp cli --progress index_repository --repo-path "$REPO_ROOT"
+codebase-memory-mcp cli list_projects
+
+printf '%s\n' \
+  'Codebase Memory is installed and this repository is indexed.' \
+  'Restart Cursor so the MCP server and managed agent configuration are loaded.'