AI Memory

ai-memory universal AI memory

ai-memory is a persistent memory system for AI assistants. It works with any AI that supports MCP -- Claude, ChatGPT, Grok, Llama, and more. It stores what your AI learns in a local SQLite database, ranks memories by relevance when recalling, and auto-promotes important knowledge to permanent storage. Install it once, and every AI assistant you use remembers your architecture, your preferences, your corrections -- forever.

Choose your installation path

Configuring the LLM backend (xAI Grok, OpenAI, Anthropic, Gemini, DeepSeek, Kimi, Qwen, Mistral, Groq, Together, Cerebras, OpenRouter, Fireworks, LMStudio, vLLM, llama.cpp server, or local Ollama)? See docs/integrations/llm-backends.md — the MCP env-block recipe is the same regardless of installation path.

v0.9.0 — current release. A security-hardening and code-review release: 49 fixes from a 5-lane adversarial review (#1885–#1935) plus a smaller set of additive features. The headline change is a secure-default flip: agent attestation is required by default on HTTP direct-write (#1751, surface-scoped by #1985) — an unsigned HTTP POST /api/v1/memories (+/bulk) is rejected (403 ATTESTATION_FAILED) instead of landing attest_level="claimed", unless the operator sets the explicit opt-out AI_MEMORY_REQUIRE_AGENT_ATTESTATION=0. The MCP memory_store and CLI store surfaces are the operator-as-actor path and stay permissive by default (an unsigned write lands claimed); =1 forces strict on every surface. (The v0.9.0 GA shipped this as require-*everywhere*, which was unsatisfiable on MCP hosts — corrected to surface-scoped in the current release.) Alongside it, the mandatory-hook-presence enforcement gate now fires on both the MCP write path (#1885) and the HTTP write path (#1924), closing a silent-bypass gap where a configured mandatory hook could be skipped on one surface but not the other. The hardening pass also closes bulk_create per-row attestation gating (#1919), routes inbound federated PENDING approvals through the registered-approver gate (#1920), tightens team/unit/org visibility scope so it is no longer over-broad across the namespace hierarchy (#1921), and confines skill_register's folder_path import under the configured root with a symlink jail (#1923). A new non-argv credential channel — AI_MEMORY_STORE_URL / AI_MEMORY_STORE_URL_FILE (a 0600 file) — keeps the postgres/store password off world-readable /proc/ /cmdline and ps (#1927). Additive feature work: agent-authored skill memories with a parameters_schema + invocation_record (B7-SKILL, #1865), the recall_observations shadow-feedback loop (#1706), a memory-derivation lineage DAG (memory_lineage, #1859), and an opt-in vector-search minimal slice (#1005). Surface: schema v78, 101 MCP tools at --profile full (100 callable + the always-on memory_capabilities bootstrap) / 7 at --profile core, 92 HTTP route registrations (78 unique URL paths), 89 CLI subcommands under --features sal/sal-postgres (87 in the default build), 9 typed MemoryLink relations, a 28-field Memory. Runs on two production backends behind one identical API — embedded SQLite and PostgreSQL + Apache AGE — across desktop, server, and on-device (iOS + Android). Everything is additive over v0.8.1 except the attestation and hook-enforcement flips, which are secure-by-default breaking changes — review them before upgrading. Full changelog: CHANGELOG.md §"[0.9.0] — 2026-07-08".

v0.8.0 (`distributed-coordination`) — prior release. This is the release where the memory substrate becomes a coordination substrate. It adds the distributed-coordination machinery from #1709: a typed action DAG with a real state machine (memory_action_*), TTL-bounded single-holder leases (memory_lease_*), Ed25519-signed signals (memory_signal_*), Ed25519-attested checkpoints (memory_checkpoint_*), and frozen, replayable routines (memory_routine_*) — so a heterogeneous fleet of agents can take turns, hand off work, and prove who said what without having to trust each other. It layers typed cognition on top (the Goal/Plan/Step memory kinds, a lifecycle_state machine, and the decomposes_into / depends_on / advances link relations), hardens federation secure-by-default (peer enrollment ON by default #1789, per-transition signatures #1718, per-write content attestation #1464, transition-replay nonces #1805, outbound peer-cert pinning #1678), and ships governance that actually blocks — the Claude Code PreToolUse hook is reworked to a type:command wrapper so a substrate Refuse truly denies the tool (#1811). At the v0.8.0 release, surface was: schema v70, 100 MCP tools at --profile full (99 callable + the always-on memory_capabilities bootstrap) / 7 at --profile core, 91 HTTP route registrations (78 unique URL paths), 83/85 CLI subcommands, 9 typed MemoryLink relations, a 27-field Memory. Runs on two production backends behind one identical API — embedded SQLite and PostgreSQL + Apache AGE — across desktop, server, and on-device (iOS + Android). Everything is additive over v0.7.0; review the secure-default flips before upgrading. Full release notes: docs/v0.8.0/release-notes.md.

v0.7.0 (`attested-cortex`) — prior release. Rolled together the cortex-fluent legibility work with the full v0.7 trust + A2A scope from ROADMAP §7.3, plus (per operator directive 2026-05-09) the originally-v0.7.1 postgres+AGE first-class work, plus the post-grand-slam ship-readiness wave (Batman Forms 1-6 + 7th-form Option-B foundation + QW-1/2/3 + reconciliation security sweep). The substrate becomes both more articulate (capabilities v3, named loader tools, compacted schemas, Batman MemoryKind vocabulary, persona/atomisation/multistep-ingest primitives) and cryptographically trustworthy (Ed25519 attestation, sidechain transcripts, programmable 25-event hook pipeline, enforced namespace inheritance, V-4 cross-row signed-events hash chain). v0.7.0 also ships postgres + Apache AGE as a first-class storage backend — ai-memory serve --store-url postgres://… for live daemon use, schema parity across both backends (at the v0.7.0 release, sqlite + postgres converged on logical schema v57, where CURRENT_SCHEMA_VERSION was 57; the v0.8.0 release substrate has advanced this lockstep to schema 70, with the additive v58–v70 coordination + visibility tables landed on both backends — see CLAUDE.md §Database for the v58–v70 ladder) (canonical anchors: src/storage/migrations.rs for sqlite + src/store/postgres.rs for postgres); on-disk migration files end at migrations/sqlite/0047_v56_list_composite_indexes.sql and the postgres in-process migrate_v57() ladder arm (file-name counters lag the logical schema version because both ladders apply post-v34