Compartment

Compartment

Encrypted, fully offline memory for AI agents. One vault on your own computer, read and written by Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex and any other MCP client. No API key, no account, no network, no telemetry.

One-click install (after installing and running compartment init):

Claude Code, Claude Desktop, Hermes Agent and OpenClaw are wired by one command instead: compartment integrate claude, hermes or openclaw.

Compartment is persistent memory for AI agents, stored on your own computer. What an agent learns in one session is available in every later session, in every project, to every agent on the machine, and nothing leaves the machine.

Each memory is a single claim, recorded with its source and the date it was learned. Memories can expire: set expires and the memory is removed after that date. When a preference changes, the new one replaces the old one. Recall is a hybrid vector and keyword search over an in-memory index. It answers in about 12 ms and returns only what is relevant.

The embedding model is included in the package. Everything on disk is encrypted, including the embedding vectors, and only your passphrase opens it. A new vault comes with about 6,700 reference facts about hardware, operating systems, ports, encodings and shell tools. They are ordinary memories, and one switch removes them from search.

How it compares with other memory servers

Where each server keeps memory and what protects it, as documented by each project on 2 September 2026. Sources and the full table are in docs/COMPARISON.md; corrections are welcome as a PR against that file.

The memory logic

Almost everything is stored. Only empty turns are dropped. A bare "OK" is a decision, not noise: when the agent asks *"Want me to send this reply to the client now?"* and the user answers *"OK"*, Compartment stores the decision together with the question it answered. Small talk is kept but ranked last.

Importance is assigned by fixed tiers. Decisions and consent 0.90, personal facts and preferences 0.80, the user's machine and configuration 0.75, other substantive statements 0.55, small talk 0.20. Importance multiplies a match score rather than adding to it, so it breaks near-ties in favour of what matters and can never surface a memory that did not match the question.

One claim per memory, enforced. The store rejects anything longer than 200 characters (the max_memory_chars setting), and anything containing lists, headings or paragraphs, with an error that says how to split it. Instructions alone did not work: on a real vault, the median memory written by an agent was 1,938 characters of bulleted session log. memory_store_many stores a batch in one call. compartment atomize splits over-limit memories in an existing vault; each piece keeps the original's dates, and the original is marked superseded but stays readable by id.

Every memory records its source and date. source is required: "from chat", "read from pyproject.toml", "web search". discovered is the date the fact was learned, separate from the date it was saved. Both are appended to the text as a short clause, for example [web search, 2026-08-01].

Memories can expire. For a fact that stops being true on a known date, such as a sale price, a booking or a door code, set expires to that date (2026-09-03) or to a duration (14d, 2w, 3m, 1y). The memory is removed after that date. compartment expire runs the sweep by hand; expire_memories turns it off. Most facts should not expire; a wrong expiry deletes a memory the user wanted.

Facts accumulate; opinions update. A new fact is added beside the others: the door code changed, a script lives at a path, a release shipped. An opinion replaces one. When a preference is stored with kind="opinion", the vault looks for a similar live opinion first. If it finds one, it returns the old record instead of inserting, and the caller resends with supersedes=[old id] to replace it, or supersedes=[] to keep both. Restating a live opinion refreshes its date instead of storing a copy. Superseded records are removed from search but kept in the audit chain and readable by id, with a pointer to their replacement. supersedes also works on facts, for corrections. Opinion ranking carries a recency bonus that fact ranking does not, so the newest opinion wins. compartment opinions audit finds overlapping live opinions in older vaults and keeps the newest, or reports them for manual merging.

Capture does not depend on the model. A host that declares its own memory in its system prompt can override any tool instruction. So integrate claude installs a PostToolUse hook that writes each memory file Claude Code saves into the vault, whether or not the model calls the tool. The hook leaves your other hooks untouched, backs up settings.json first, always exits successfully so it can never break your editor, and does nothing while the vault is locked. compartment hook status | install | uninstall, or integrate claude --no-hooks. compartment import-claude imports anything the hook missed.

Search returns what is relevant, not a fixed number. Compartment returns every memory whose score holds up against the best result for the same question, up to a generous cap. The cut is relative because scores are not comparable between questions: on a real vault, the nonsense query "how to bake sourdough bread" scored higher than the real query "what did Max decide about Airtable". A question the vault knows nothing about returns nothing. Pass top_k to get exactly that many.

Tags are kept current. What a memory is about never changes; what it is relevant to does. Suppose that while working on a project called Northwind you learn that the client wants figures before conclusions. The agent tags the memory northwind. Two years later the same client, now called Harbour, hires you again, and the agent searches with the tag harbour. The memory is still true, but a tag filter cannot find it. So a background pass gives every memory the tags its nearest neighbours in embedding space were stored with, weighted by similarity: as Harbour memories accumulate near that old one, it picks up the harbour tag. Two more signals run alongside: tags that almost always occur together imply each other, and an existing tag whose phrase appears in a memory's text is attached. The pass writes only tags, never text, dates or embeddings. It only adds tags unless you pass --prune, tags_origin preserves the original tags, and compartment retag --dry-run shows what would change.

A graph as well as a list. memory_link records a relation: subject, predicate, object, optionally tied to a memory and to a validity window. memory_relations answers by entity, by predicate, or as of a date. Compartment stores and matches relations deterministically; the host model decides what to link.

Memories are data, not instructions. Recalled memories are wrapped with a notice that they are stored data. Content from an untrusted source can be marked quarantined, which adds a warning to every recall of it. The host agent must still treat memory as data.

One embedding model per vault. The model's SHA-256 is recorded in the vault and checked on open, so similarity scores stay comparable. To change model, run compartment reindex --re-embed.

No LLM inside. Embeddings run locally with a bundled 384-dimension int8 ONNX model, in one shared process of about 70 MB that every agent on the machine uses. The host model decides what to store and forget; Compartment captures, encrypts and reca