SAIHM — memory for AI agents

Portable memory for AI agents. Your assistant remembers what matters — across sessions, across models, across vendors. Share a memory with someone else's agent, take it back, or erase it for good.

AI assistants forget everything when the session ends. SAIHM gives yours a memory that doesn't — one that follows you to a different assistant, a different model, or a different company's product.

Everything is encrypted on your own machine before it goes anywhere, so nobody else can read your memories. Not the storage, not SAIHM.

Start free — one command

npx -y @saihm/mcp-server-pro free-join

That's it. No card, no account to fill in, nothing to invent. It sets up your identity on this machine and prints a one-time sign-in to confirm you're a real person. Open the link, enter the short code, approve.

Then point your AI tool at it. This works in Claude Desktop, Claude Code, Cursor, Cline, and anything else that speaks MCP — add the "saihm" entry inside your existing mcpServers section:

{
  "mcpServers": {
    "saihm": {
      "command": "npx",
      "args": ["-y", "@saihm/mcp-server-pro"],
      "env": {
        "SAIHM_ENDPOINT_URL": "https://saihm.net/mcp"
      },
      "timeout": 60
    }
  }
}

Restart the connection and say "Recall my SAIHM memories." You're running.

Two details in that config are load-bearing:

• Keep timeout: 60. Some tools allow as little as 1.5 seconds for a server to start, which isn't long enough for npx to fetch and launch a package. A server that misses the deadline is skipped silently — the tools simply never appear, and nothing in the chat says why.
• No trailing commas. These files are strict JSON. A stray comma doesn't just break this entry; it invalidates the whole file and every other tool you had configured disappears with it.

Prefer not to touch a terminal? Add the config above first, then say "Join SAIHM" to your assistant. It does the same setup for you.

Things to say

You don't call tools by name — you talk to your assistant. Some starters:

Liberally use SAIHM protocol to maximize token economy.

Recall my SAIHM memories before you start.

Remember that I prefer short answers and no preamble.

Set an invariant to doubly confirm before any SAIHM forget action.

Share that note with my colleague's agent until 5:00 pm today.

How much of my SAIHM allowance is left?

Forget everything I told you about the Henderson account.

Every tool is labelled for your AI tool to read, including which are read-only and which one destroys data — so hosts that ask "are you sure?" before destructive actions know when to ask. Two further tools, saihm_governance_propose and saihm_governance_vote, are registered for a roadmap feature and are not yet active.

"Forget" really means forget. The key to that specific memory is destroyed, so the stored copy becomes permanently unreadable — by you, by SAIHM, by anyone holding a backup of it. This is how SAIHM answers a GDPR Article 17 erasure request, and it is why there is no undo.

Your memories follow your key

Your memory belongs to your key, not to a computer — that's what makes it portable. The key is created on your machine during setup and never sent anywhere, which is exactly why nobody else can read your memories. Keep a copy of the key file somewhere safe. SAIHM cannot make you another one.

Setup prints the file's location when it runs — that's the line to keep. The same key carries through if you upgrade to a paid plan: same identity, same memories, nothing migrated.

Using a second computer? Two ways:

• Same memory, both machines — put your key file on the second machine, set up the config there, and say "Recall my SAIHM memories."
• Work and personal kept apart — start fresh on the second machine and share across instead: "Share these notes with my work agent until 5:00 pm." A share can be revoked or given an expiry, so the two stay separate.

See it run

• Live demos across every major model — offline, about a minute each, no account: https://citw2.github.io/saihm-demos/. Store a memory in Claude, GPT, DeepSeek, Qwen, Kimi, or GLM, then prove you can erase it.
• Token benchmark — recalling a bounded set of memories instead of re-sending the whole conversation cut input tokens by 62.8%–85.9% across a realistic multi-session task. Open, offline, reproducible: https://github.com/citw2/saihm-token-benchmark.

What it costs

Start free. The free tier is a fixed, one-time allowance of writes, reads, and shares for trying SAIHM on real infrastructure — it doesn't reset or refill. No card, and nothing to cancel. Your assistant shows what's left and warns you as it runs low, so nothing fails by surprise.

Paid plans are monthly. Upgrading keeps the same key and every memory you already have:

SAIHM_MASTER_SECRET_FILE=$HOME/.saihm/free-identity.key \
SAIHM_TIER=FREE \
  npx -y @saihm/mcp-server-pro upgrade PRO

That prints a checkout link tied to your identity. Pay, then add two lines to your config's env block and restart:

"SAIHM_TIER": "PRO",
"SAIHM_PAYMENT_METHOD": "stripe"

Both are needed — a paid plan without SAIHM_PAYMENT_METHOD refuses to start, because that setting names which payment rail to check. stripe is one option; stablecoin is another, and your assistant can tell you what your operator accepts.

If something isn't working

How it works

In plain terms. Everything is encrypted on your machine before it is sent, and decrypted on your machine after it comes back. What's stored is unreadable ciphertext and no key that opens it. To erase something, its key is destroyed — which is why erasure is immediate and final rather than a promise that a copy was deleted somewhere.

For the technically inclined.

• Encrypt before send — remember encrypts client-side; recall decrypts client-side. Your plaintext, master secret, and key-encryption key never leave this process.
• Post-quantum — ML-DSA-65 for identity and signing, ML-KEM-768 for authenticated sharing, via @saihm/client-pro.
• Crypto-shred erasure — forget destroys the endpoint-side wrapped data-encryption key, rendering the cell undecryptable (GDPR Art. 17).
• Erasure that travels — forget also appends one line to a per-identity feed, so anything that derived from a cell — an index, a mirror, an extracted fact — can be told to drop it too. An erasure that stops at this substrate is not an erasure. On by default; SAIHM_ERASURE_FEED=0 turns it off.
• Standard transport — POST {method, params} with Authorization: Bearer <JWT>; the endpoint binds your tenant from the JWT. HTTPS only, with loopback http permitted for local development.
• Self-onboarding — with no SAIHM_AUTH_HEADER set, the client proves control of your identity and mints its own short-lived token, refreshing transparently. You paste one config once and never re-paste a token. Cancelling a subscription stops the next refresh, so access ends naturally.

Security model

Where encrypted cells are stored

This client encrypts cells and hands the ciphertext to whichever operator endpoint SAIHM_ENDPOINT_URL points at; that operator chooses and configures the durable storage behind it — typically a local IPFS / Kubo node first, then a Filecoin deep-archive provider. Storage is operator-configured by design: the protocol never locks anyone to a single provider. Running your own endpoint means provisioning that storage yourself.

Prefer not to run storage at all? The hosted operator at https://saihm.net provides durable storage and is non-custodial — because this client encrypts every cell locally, the hosted operator only ever stores ciphertext and never holds a key.

Configuration

Most people need none of this: the setup above sets one variable and the rest have working defaults.

Note: a master secret is required, from one source or the other — but setup creates and configures it for you, which is why the config above has neither.

For developers

npm install @saihm/mcp-server-pro

import { SaihmProClient } from '@saihm/mcp-server-pro';

// Boot from env: SAIHM_ENDPOINT_URL, SAIHM_MASTER_SECRET_FILE (or _HEX)
//   self-onboard (recommended): + SAIHM_PAYMENT_METHOD + SAIHM_TIER (omit SAIHM_AUTH_HEADER)
//   static token (advanced):    + SAIHM_AUTH_HEADER="Bearer <JWT>"
const saihm = SaihmProClient.bootFromEnv();

// Store — encrypted before it leaves the process.
const { cellId } = await saihm.remember('remember this');

// Recall — decrypted after it returns.
const cell = await saihm.recallOne(cellId);
console.log(cell?.plaintext); // 'remember this'

// Recall everything (client-side keyword filter; the endpoint has no plaintext to filter on).
const matches = await saihm.recall('this');

// Update an existing cell (a fresh monotonic sequence is issued automatically). When the endpoint reports
// shares of the cell left on the previous version, `shares` in the result reports their re-issue.
await saihm.remember('new contents', { cellId });

// Forget — crypto-shred.
await saihm.forget(cellId);

// Share a cell with another agent, end-to-end authenticated. Pin the grantee's agentIdHash
// out-of-band; the library rejects directory key-substitution.
await saihm.share({
  cellId,
  recipientRecord, // the grantee's published identity record (hex)
  recipientPinnedAgentIdHashHex, // pinned out-of-band
  expiryEpoch, // optional; omit or null for no time bound
});
await saihm.revokeShare(cellId, recipientPinnedAgentIdHashHex);

// Read a cell another agent shared TO you (the recipient side of `share`). Pin the
// sharer's agentIdHash out-of-band; the library verifies the sharer's signature and
// returns null when there is no live grant (e.g. revoked, or the sharer crypto-shredded it).
const shared = await saihm.recallShared({
  sharerPinnedAgentIdHashHex, // the sharer's agentIdHash, pinned out-of-band
  sharerRecord, // the sharer's published identity record (hex)
  cellId,
});
console.log(shared?.plaintext);

// Operator-observable metadata only (no plaintext).
const status = await saihm.status();

The derived saihm.agentIdHash is the sub the endpoint binds your tenant to — when self-onboarding the client proves it via ML-DSA; with a static SAIHM_AUTH_HEADER it must equal the JWT sub. Publish saihm.identityRecord so other agents can share to you.

Constructing SaihmProClient directly writes nothing to your home directory; the per-restart bookkeeping is opted into by the MCP server's boot path, or by setting SAIHM_SEQ_STATE_PATH explicitly.

Following shares (optional). With SAIHM_EVENTS=1, or saihm.startShareEvents() in your own process, the client long-polls the endpoint and keeps a map of the shares made to you: saihm.shareStates(), and shareStates in the saihm_recall result. The summary is on every recall that lists memories: since, complete, asOf, stopped, startedAt and counts (live, stale, ended, erased). The entries are added only when the call passes shareEntries: true; without it they are absent, which is not the same as empty. Each entry names the sharer and cell, a status (live, stale, ended or erased), the grant, the sharer's latest seq and commitment when known, and senderVerified, which is true only after a read checked the sharer's signature. Every time is ISO-8601 UTC with milliseconds (YYYY-MM-DDTHH:MM:SS.sssZ). To read it safely:

• Treat a cached copy of a shared memory as erased when its entry is erased, or when the copy was made before the entry's copiesInvalidBefore (count a copy made up to 5 minutes after that time as made before it, for clock skew).
• An entry whose endedBy is reconciliation may have been erased rather than revoked: treat its copies as possibly erased.
• Conclude anything from a missing entry only when since is set and complete is true. Until then the map may still be catching up, and a live entry may be out of date. A map with since null or complete false is no baseline to compare a later map against: only a complete map replaces one.
• The map is as of asOf, the time of the latest answer from the endpoint or completed catch-up; it is null until the first. While the network is down asOf stops advancing and complete stays as it was, so compare asOf with your clock when you need a current map.
• stopped says why the client stopped following: unsupported (the endpoint offers no feed), tier (the plan has none) or erased (the identity was erased). complete is then false until a later catch-up completes. startedAt is when this process started following, so a null asOf reads as starting or as stopped.
• The map and the position in the feed survive a restart, so since carries over and a new process asks the endpoint for what it missed rather than for the whole listing. since may therefore be EARLIER than startedAt: it is when the map this process resumed was first complete, not when this process began. Before 0.11.0 since always followed startedAt; do not use the two together to tell one run from another. A restored map is NOT complete until this process has had an answer: complete is false and asOf null until then, which is exactly the state above in which nothing may be concluded from a missing entry. saihm.stopShareEvents() ends the polling.

For other processes, the client writes the summary and every entry to <root>/tenants/<agentIdHash>/share-states.json, beside the erasure feed and under the same root (SAIHM_ERASURE_FEED_DIR, then SAIHM_HOME, then ~/.saihm). It is owner-only (file 0600, directory 0700), replaced whole, written soon after the map, since, complete or stopped changes and at least once a minute, and left in place when the process ends; its asOf shows its age. The client never reads it back. Several processes of one identity each keep their own map and may each write the file: it is replaced under a lock and only by a map whose asOf is not older, and its since is the writer's. Until a new process has its first answer, the file may still be an earlier process's. No file means no feed has run for that identity under that root; it asserts nothing.

The position itself is kept in <root>/tenants/<agentIdHash>/feed-state.json, in the same directory and with the same owner-only modes, and this file the client does read back. Nothing in it is trusted: a state that is missing, unreadable, malformed, too large or older than the endpoint keeps events for is ignored, and the client starts cold as it always did. Set SAIHM_SHARE_MAP_STORE=off to keep the position in memory only; a root that cannot be written does the same without being asked. Several processes of one identity may each write the file, and each write holds a position and the map that goes with it together, so whichever was written last is a pair a later process can resume from.

A shared read (saihm_recall with the sharer and cell) returns the commitment of the version it opened and, when the endpoint sends it, the grant that served the read, named as in the entries, so a copy compares with its entry exactly.

Errors. Non-2xx responses throw SaihmEndpointError carrying status and a typed code (e.g. BLIND_BAD_EXPIRY, BLIND_STALE_SEQ, governance_unavailable). Branch on the code rather than the message.

License

Apache-2.0 © SAIHM