ai-memory

universal AI memory

ai-memory is a persistent memory system for AI assistants. It works with any AI that supports MCP -- Claude, ChatGPT, Grok, Llama, and more. It stores what your AI learns in a local SQLite database, ranks memories by relevance when recalling, and auto-promotes important knowledge to permanent storage. Install it once, and every AI assistant you use remembers your architecture, your preferences, your corrections -- forever.

Choose your installation path

Configuring the LLM backend (xAI Grok, OpenAI, Anthropic, Gemini, DeepSeek, Kimi, Qwen, Mistral, Groq, Together, Cerebras, OpenRouter, Fireworks, LMStudio, vLLM, llama.cpp server, or local Ollama)? See docs/integrations/llm-backends.md — the MCP env-block recipe is the same regardless of installation path.

v0.9.0 — current release. A security-hardening and code-review release: 49 fixes from a 5-lane adversarial review (#1885–#1935) plus a smaller set of additive features. The headline change is a secure-default flip: agent attestation is required by default on HTTP direct-write (#1751, surface-scoped by #1985) — an unsigned HTTP POST /api/v1/memories (+/bulk) is rejected (403 ATTESTATION_FAILED) instead of landing attest_level="claimed", unless the operator sets the explicit opt-out AI_MEMORY_REQUIRE_AGENT_ATTESTATION=0. The MCP memory_store and CLI store surfaces are the operator-as-actor path and stay permissive by default (an unsigned write lands claimed); =1 forces strict on every surface. (The v0.9.0 GA shipped this as require-everywhere, which was unsatisfiable on MCP hosts — corrected to surface-scoped in the current release.) Alongside it, the mandatory-hook-presence enforcement gate now fires on both the MCP write path (#1885) and the HTTP write path (#1924), closing a silent-bypass gap where a configured mandatory hook could be skipped on one surface but not the other. The hardening pass also closes bulk_create per-row attestation gating (#1919), routes inbound federated PENDING approvals through the registered-approver gate (#1920), tightens team/unit/org visibility scope so it is no longer over-broad across the namespace hierarchy (#1921), and confines skill_register's folder_path import under the configured root with a symlink jail (#1923). A new non-argv credential channel — AI_MEMORY_STORE_URL / AI_MEMORY_STORE_URL_FILE (a 0600 file) — keeps the postgres/store password off world-readable /proc/<pid>/cmdline and ps (#1927). Additive feature work: agent-authored skill memories with a parameters_schema + invocation_record (B7-SKILL, #1865), the recall_observations shadow-feedback loop (#1706), a memory-derivation lineage DAG (memory_lineage, #1859), and an opt-in vector-search minimal slice (#1005). Surface: schema v78, 101 MCP tools at --profile full (100 callable + the always-on memory_capabilities bootstrap) / 7 at --profile core, 92 HTTP route registrations (78 unique URL paths), 89 CLI subcommands under --features sal/sal-postgres (87 in the default build), 9 typed MemoryLink relations, a 28-field Memory. Runs on two production backends behind one identical API — embedded SQLite and PostgreSQL + Apache AGE — across desktop, server, and on-device (iOS + Android). Everything is additive over v0.8.1 except the attestation and hook-enforcement flips, which are secure-by-default breaking changes — review them before upgrading. Full changelog: CHANGELOG.md §"[0.9.0] — 2026-07-08".