← Back to directory
C

Compartment

Community
Encrypted, fully offline long-term memory for AI agents
GitHub source repository ↗
★ 586 Stars Category · Other Very popular
75FMRS · B

Compartment turns agent memory into a single fully local, encrypted vault and deliberately leaves the question of what to remember to the host model, handling capture, encryption and recall itself. Its pitch is clear: no account, no API key, no network at runtime, encrypted embedding vectors, expiring memories, a relation graph and tags, plus a cross-platform GUI and a read-only dashboard. The README also provides a comparison table against other memory servers (described as each project's own documentation dated 2 September 2026) and documents its ranking formula, weights and measured latencies. The realistic constraints are worth noting: moving between machines means copying the vault file by hand, a lost passphrase or 2FA keyfile cannot be recovered, memory_unlock is deliberately off by default, and the Docker image is headless stdio only. It suits privacy-conscious individuals and small teams, and is not aimed at users who want cloud sync or server-side fact extraction.

Reliability
12/20
Security and permissions
16/20
Maintenance
14/20
Documentation
18/20
Setup experience
15/20
Read the FMRS scoring method →

Compartment is an MCP server that gives AI agents durable memory. It keeps one encrypted vault on the user's own computer, read and written by Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex and any other MCP client. There is no API key, no account, no network at runtime and no telemetry. Each memory is a single claim recorded with a required source and the date it was learned, and memories can expire: set expires to a date or a duration such as 14d, 2w, 3m or 1y and the memory is removed after that date. Recall is a hybrid vector and keyword search over an in-memory index; the documented median for a full hybrid search is about 11.6 ms. The embedding model is bundled (384-dimension int8 ONNX) and everything on disk, embedding vectors included, is encrypted under the user's passphrase. A new vault ships with about 6,700 reference facts about hardware, operating systems, ports, encodings and shell tools, removable from search with one switch. Security primitives include XChaCha20-Poly1305 encryption at rest, Argon2id key slots, a key per record, a hash-chained audit log, and a runtime guard that aborts on any network socket attempt (--assert-offline). The project ships a macOS menu bar app, a Windows notification-area app, a Linux window, a read-only browser dashboard bound to 127.0.0.1, memory packs, and a serve command that speaks MCP over stdio. Installation routes include PyPI (pip, pipx, uv), a Claude Code plugin, Docker, and a Compartment.pkg for macOS. Licensed Apache-2.0.

Tools

memory_search
Hybrid vector and keyword search over the vault, returning memories relevant to the question
memory_store
Store one memory; source is required, with optional expires, namespace, tag, importance and kind (fact or opinion)
memory_store_many
Store a batch of memories in a single call
memory_get
Read a memory by id, including superseded records kept in the audit chain
memory_recent
List the newest memories, hiding the seeded reference facts by default
memory_forget
Remove a memory; --shred destroys its per-record key so the content is unrecoverable
memory_link
Record a relation (subject, predicate, object), optionally tied to a memory and a validity window
memory_relations
Answer relations by entity, by predicate, or as of a date
memory_unlink
Delete a recorded relation
memory_list_namespaces
List the namespaces present in the vault
memory_status
Report vault status, including totals and organic_records
memory_lock
Lock the vault and clear stored unlock credentials
memory_selftest
Run a self-test of the vault and runtime
memory_unlock
Unlock the vault; off by default because enabling it puts the passphrase in the model's context

Setup

1) Install with pip: pip install compartment && compartment init (needs Python 3.11 or newer; pipx install compartment or uv tool install compartment also work). 2) compartment init asks you to choose a passphrase, creates the vault, loads the reference facts and connects Claude Code, Hermes Agent or OpenClaw if they are installed. 3) Wire a specific client: compartment integrate claude, compartment integrate hermes, compartment integrate openclaw, or compartment integrate --all for every installed client it knows. 4) For any other MCP client, use the stdio block: {"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}} (VS Code uses the key servers with "type": "stdio"; Zed uses context_servers; Codex uses TOML under [mcp_servers.compartment]). 5) On a Mac you can instead download Compartment.pkg from the latest release and open it, which needs no command line. 6) Restart your agent and it has a memory.

claude_desktop_config.json
{"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}}

Fit and risk

Best for

  • Individuals or teams who prioritise privacy and offline operation and do not want data leaving the machine
  • Users who share memory across multiple MCP clients such as Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex and Gemini CLI
  • Scenarios that need encrypted storage, a hash-chained audit log and verifiable vault migration
  • Users who want low-latency recall, a bundled embedding model and no extra LLM calls inside the memory layer

Not for

  • Users who need cloud multi-device sync or a hosted team memory service; moving between machines means locking the vault and copying the file
  • Users who expect the server itself to run an LLM that extracts facts and decides what to remember; Compartment explicitly keeps no LLM inside and leaves that to the host model
  • Users who cannot keep a passphrase safe or who need a recovery path if it is lost, since Compartment never generates a password, seed or recovery phrase
  • Deployments that require network transports such as SSE or streamable-http; this server is stdio only and opens no ports

Required permissions

  • Read and write the vault file under the user's home directory, by default ~/.compartment/memory.vault, and its sibling settings file
  • Access the session directory holding the unlock credential (configurable with COMPARTMENT_SESSION_DIR), which also carries the shared embedding process's Unix socket
  • Optionally use the macOS keychain (compartment unlock --keychain is an explicit opt-in, and it survives reboots)
  • Write or merge an mcpServers entry into each MCP client's own configuration file, taking a byte-exact backup first
  • Install a PostToolUse hook for Claude Code that captures memory files the agent writes
  • Serve a read-only dashboard on 127.0.0.1 behind a one-time random URL token

Risks and side effects

  • A leaked passphrase means the encrypted content can be decrypted; Compartment generates no recovery phrase and cannot recover a lost passphrase
  • Enabling the memory_unlock tool places the passphrase in the model's context, which is why it is off by default
  • If a 2FA keyfile is lost, for example a USB stick, the vault cannot be opened even with the passphrase
  • `export --plaintext` writes the vault as unencrypted JSONL, so that file must be handled carefully
  • Memory content can come from untrusted sources; recall wraps memories with a notice that they are stored data and content can be marked quarantined, but the host agent must still treat memory as data to limit prompt-injection risk
  • The capture hook and client integration write into the user's own settings files, although the implementation backs up and merges rather than replacing

Troubleshooting

  1. The agent cannot see memories: confirm the vault is unlocked and the client was wired with `compartment integrate <agent>`, then restart the agent
  2. The vault will not open: check the passphrase; if 2FA is on, make sure the keyfile is present (or pass --keyfile). A restart or power loss always locks the vault, so it must be unlocked again
  3. Results are missing: check the search_starter_facts and include_packs_in_search settings, and any namespace, tag or date filters, since those filters run after ranking
  4. Too many or too few results: pass top_k to get exactly that many; by default the server returns every memory whose score holds up against the best result for the question
  5. Suspecting corruption or tampering: run `compartment verify`, `compartment selftest` and `compartment audit verify`
  6. Confirming there is no network activity: run with `--assert-offline` or set COMPARTMENT_ASSERT_OFFLINE, which aborts on any network socket attempt
  7. Similarity scores look wrong or the model changed: run `compartment reindex --re-embed`; note that a vault records one embedding model and checks its SHA-256 on open
  8. A store is rejected: memories longer than max_memory_chars (default 200 characters) or containing lists, headings or paragraphs are refused, so split them or use memory_store_many

Use cases

Share one long-term memory between several AI agents on the same machine
Give agents memory in a fully offline environment with no API key
Store sensitive facts, credential locations and decisions encrypted at rest
Set automatic expiry for facts that stop being true on a known date, such as prices, bookings or door codes
Record and query typed relations in a graph alongside the memory list
Inspect growth, tags, the relation graph and live search read-only in a browser

Supported clients

Claude DesktopFull support
Claude CodeFull support
Hermes AgentFull support
OpenClawFull support
CursorFull support
VS CodeFull support
Codex CLIFull support
Gemini CLIFull support
ClineFull support
Roo CodeFull support
ZedFull support
OpenCodeFull support
LM StudioFull support
AnythingLLMFull support
BoltAIFull support
gooseFull support
KiroFull support