← Back to directory
C

Compartment

Community
Encrypted, fully offline long-term memory for AI agents
Category
Other #2 of 230
Stars
★ 583 Very popular
Transport
stdio (local process)
Runtime
Python 3.11+
Credentials
No credential needed
License
Apache-2.0
Last commit
Tools
14
75FMRS · B

Compartment turns agent memory into a single fully local, encrypted vault and deliberately leaves the question of what to remember to the host model, handling capture, encryption and recall itself. Its pitch is clear: no account, no API key, no network at runtime, encrypted embedding vectors, expiring memories, a relation graph and tags, plus a cross-platform GUI and a read-only dashboard. The README also provides a comparison table against other memory servers (described as each project's own documentation dated 2 September 2026) and documents its ranking formula, weights and measured latencies. The realistic constraints are worth noting: moving between machines means copying the vault file by hand, a lost passphrase or 2FA keyfile cannot be recovered, memory_unlock is deliberately off by default, and the Docker image is headless stdio only. It suits privacy-conscious individuals and small teams, and is not aimed at users who want cloud sync or server-side fact extraction.

Strongest · Documentation 18/20 Weakest · Reliability 12/20

Reliability
12/20
Security and permissions
16/20
Maintenance
14/20
Documentation
18/20
Setup experience
15/20
Why each score
Reliability 12/20
Static review sees only the README and server.json. The manifest declares the PyPI package compartment 4.9.6 with uvx runtime, stdio transport and a `serve` positional argument, which is consistent with the README's `compartment serve`, so a clean handshake looks plausible. The README claims extensive internals (evidence-fusion ranking, windowed embeddings, SIMD/HNSW, a shared embedding daemon, tested kill -9 recovery, 800+ tests, three-OS CI badges) and lists thirteen MCP tools with read-only/destructive annotations, but the provided material contains no test files, no CI workflow, no source excerpts and no execution evidence, and README/manifest are explicitly untrusted. Declared tools therefore cannot be checked against real behavior, error/dependency control (bundled ONNX model, file-lock serialization, auto-lock) is only asserted, and per the static calibration the absence of verifiable execution evidence caps this at 12.
Security and permissions 16/20
No red line is crossed: no remote fetch, no embedded token, no real secrets in install examples, stdio-only transport with no open ports, and a runtime offline guard (`--assert-offline`) reportedly run in CI on three platforms. The documented design is strong: XChaCha20-Poly1305 at rest including embedding vectors, Argon2id LUKS-style key slots, per-record keys enabling `forget --shred`, hash-chained audit log, Ed25519-signed manifests and packs verified against a caller-trusted key, per-agent namespace grants (rw/ro/none), and `memory_unlock` disabled by default so the passphrase does not enter model context; unlock credentials are wrapped with a per-boot secret never written to disk. Deductions: every security property is self-reported with no implementation, audit or in-repo threat model (only links out), opt-in keychain persistence and 2FA keyfile-location memory are unverifiable, and prompt-injection mitigation is textual (quarantine marking plus a data-not-instructions notice) while explicitly leaving the host agent responsible. Hence 16, not full marks.
Maintenance 14/20
License is clear (Apache-2.0), the repo is not archived, there are 0 open issues, and 586 stars are treated only as a discovery signal per the rules. The README references RELEASING.md, CONTRIBUTING.md, a SECURITY.md reporting channel and Discussions, and version 4.9.6 plus narrative change notes (4.7 ranking-fusion change, 4.9.6 memory-footprint fix) indicate ongoing iteration with semver-style releases. However, no commit history, release cadence, dependency-update record or independently verifiable maintainer identity is present in the supplied material; the only ownership evidence is the repository id/link in server.json. Governance and update paths are pointed to but not evidenced, so 14 rather than full.
Documentation 18/20
Documentation depth and layering are unusually good: install paths (pip/pipx/uv/Docker/macOS .pkg), auth and lock model, the full MCP tool list with read-only/destructive annotations, a complete settings table with defaults and meanings, environment variables, a command reference table, cross-links to MEMORY/SECURITY/FORMAT/PACKS/INTEGRATIONS/COMPARISON, disclosed limitations (plaintext export safety, encoder token-window truncation, non-comparable cross-query scores, importance only reordering matches), and reproducible benchmark commands (selftest/bench). Deductions: all performance numbers and the competitor comparison table are self-reported, dated in the future (2026-09-02) and unverifiable, and several referenced documents are not included in the supplied material, leaving unproven assumptions. Strong enough for 18.
Setup experience 15/20
The install path is clear and mainstream-client friendly: `pip install compartment && compartment init` or pipx/uv, Docker (vault must be pre-created on the host), plus a no-terminal macOS .pkg; init wires Claude Code/Hermes/OpenClaw and starts the panel. Client config examples are explicit for Claude, Cursor, VS Code (`servers` key with `type: stdio`), Zed (`context_servers`), Codex (TOML), LM Studio/goose/Kiro deeplinks and the generic `{"mcpServers":{...}}` block; `integrate --list/--all` claims 28 clients with byte-exact backups, merge-not-replace atomic writes and a paste-instead-of-touch fallback on unparseable configs. Constraints are stated (Python 3.11+, Windows VC++ runtime, macOS 13+). Because no CI workflow or committed tests are present, the static calibration caps setup at 15: the steps are clear and few, but the automated wiring behavior is unverifiable and the Docker path needs a manual pre-step.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesWrites / deletes local files

Best for

  • Individuals or teams who prioritise privacy and offline operation and do not want data leaving the machine
  • Users who share memory across multiple MCP clients such as Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex and Gemini CLI
  • Scenarios that need encrypted storage, a hash-chained audit log and verifiable vault migration
  • Users who want low-latency recall, a bundled embedding model and no extra LLM calls inside the memory layer

Not for

  • Users who need cloud multi-device sync or a hosted team memory service; moving between machines means locking the vault and copying the file
  • Users who expect the server itself to run an LLM that extracts facts and decides what to remember; Compartment explicitly keeps no LLM inside and leaves that to the host model
  • Users who cannot keep a passphrase safe or who need a recovery path if it is lost, since Compartment never generates a password, seed or recovery phrase
  • Deployments that require network transports such as SSE or streamable-http; this server is stdio only and opens no ports

Required permissions

  • Read and write the vault file under the user's home directory, by default ~/.compartment/memory.vault, and its sibling settings file
  • Access the session directory holding the unlock credential (configurable with COMPARTMENT_SESSION_DIR), which also carries the shared embedding process's Unix socket
  • Optionally use the macOS keychain (compartment unlock --keychain is an explicit opt-in, and it survives reboots)
  • Write or merge an mcpServers entry into each MCP client's own configuration file, taking a byte-exact backup first
  • Install a PostToolUse hook for Claude Code that captures memory files the agent writes
  • Serve a read-only dashboard on 127.0.0.1 behind a one-time random URL token

Risks and side effects

  • A leaked passphrase means the encrypted content can be decrypted; Compartment generates no recovery phrase and cannot recover a lost passphrase
  • Enabling the memory_unlock tool places the passphrase in the model's context, which is why it is off by default
  • If a 2FA keyfile is lost, for example a USB stick, the vault cannot be opened even with the passphrase
  • `export --plaintext` writes the vault as unencrypted JSONL, so that file must be handled carefully
  • Memory content can come from untrusted sources; recall wraps memories with a notice that they are stored data and content can be marked quarantined, but the host agent must still treat memory as data to limit prompt-injection risk
  • The capture hook and client integration write into the user's own settings files, although the implementation backs up and merges rather than replacing

Setup

Before you start

Runtime:Python 3.11+

COMPARTMENT_PASSPHRASE optionalsecret Vault passphrase for scripts and CI; a secret normally entered interactively.
Other optional settings (7)
COMPARTMENT_VAULT optional Path to the vault file; defaults to ~/.compartment/memory.vault.
COMPARTMENT_SESSION_DIR optional Directory where the unlock credential lives.
COMPARTMENT_UI_SCALE optional UI scale for the menu bar / tray panel.
COMPARTMENT_ASSERT_OFFLINE optional Aborts on any network socket attempt to enforce offline operation.
COMPARTMENT_EMBED_DAEMON optional Set to 0 to load the embedding model in-process instead of the shared daemon.
COMPARTMENT_EMBED_SOCKET optional Overrides the shared embedding process's socket path.
COMPARTMENT_EMBED_IDLE optional Seconds the shared embedding process survives after its last client (default 300).

1) Install with pip: pip install compartment && compartment init (needs Python 3.11 or newer; pipx install compartment or uv tool install compartment also work). 2) compartment init asks you to choose a passphrase, creates the vault, loads the reference facts and connects Claude Code, Hermes Agent or OpenClaw if they are installed. 3) Wire a specific client: compartment integrate claude, compartment integrate hermes, compartment integrate openclaw, or compartment integrate --all for every installed client it knows. 4) For any other MCP client, use the stdio block: {"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}} (VS Code uses the key servers with "type": "stdio"; Zed uses context_servers; Codex uses TOML under [mcp_servers.compartment]). 5) On a Mac you can instead download Compartment.pkg from the latest release and open it, which needs no command line. 6) Restart your agent and it has a memory.

claude_desktop_config.json
{"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "compartment": {
      "command": "compartment",
      "args": [
        "serve"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add compartment -- compartment serve

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After `pip install compartment && compartment init` and registering the MCP config block, restart your client and confirm memory_search and memory_store appear in the tool list; store a fact and recall it in a new session to prove the connection.

Troubleshooting

  1. The agent cannot see memories: confirm the vault is unlocked and the client was wired with `compartment integrate <agent>`, then restart the agent
  2. The vault will not open: check the passphrase; if 2FA is on, make sure the keyfile is present (or pass --keyfile). A restart or power loss always locks the vault, so it must be unlocked again
  3. Results are missing: check the search_starter_facts and include_packs_in_search settings, and any namespace, tag or date filters, since those filters run after ranking
  4. Too many or too few results: pass top_k to get exactly that many; by default the server returns every memory whose score holds up against the best result for the question
  5. Suspecting corruption or tampering: run `compartment verify`, `compartment selftest` and `compartment audit verify`
  6. Confirming there is no network activity: run with `--assert-offline` or set COMPARTMENT_ASSERT_OFFLINE, which aborts on any network socket attempt
  7. Similarity scores look wrong or the model changed: run `compartment reindex --re-embed`; note that a vault records one embedding model and checks its SHA-256 on open
  8. A store is rejected: memories longer than max_memory_chars (default 200 characters) or containing lists, headings or paragraphs are refused, so split them or use memory_store_many

Things to try

Once connected, you can ask your AI assistant things like:

  • Remember that the client wants figures before conclusions in every report.
  • Search my memory for what I decided about the Airtable migration.
  • Show me the memories you stored most recently.
  • Forget the outdated door code I told you last week.

Tools 14

memory_search
Hybrid vector and keyword search over the vault, returning memories relevant to the question
memory_store
Store one memory; source is required, with optional expires, namespace, tag, importance and kind (fact or opinion)
memory_store_many
Store a batch of memories in a single call
memory_get
Read a memory by id, including superseded records kept in the audit chain
memory_recent
List the newest memories, hiding the seeded reference facts by default
memory_forget
Remove a memory; --shred destroys its per-record key so the content is unrecoverable
memory_link
Record a relation (subject, predicate, object), optionally tied to a memory and a validity window
memory_relations
Answer relations by entity, by predicate, or as of a date
Show 6 more tools
memory_unlink
Delete a recorded relation
memory_list_namespaces
List the namespaces present in the vault
memory_status
Report vault status, including totals and organic_records
memory_lock
Lock the vault and clear stored unlock credentials
memory_selftest
Run a self-test of the vault and runtime
memory_unlock
Unlock the vault; off by default because enabling it puts the passphrase in the model's context

Use cases

Share one long-term memory between several AI agents on the same machine
Give agents memory in a fully offline environment with no API key
Store sensitive facts, credential locations and decisions encrypted at rest
Set automatic expiry for facts that stop being true on a known date, such as prices, bookings or door codes
Record and query typed relations in a graph alongside the memory list
Inspect growth, tags, the relation graph and live search read-only in a browser

Supported clients

Claude Desktop
Claude Code
Hermes Agent
OpenClaw
Cursor
VS Code
Codex
Gemini CLI
Cline
Roo Code
Zed
OpenCode
LM Studio
AnythingLLM
BoltAI
Goose
Kiro

Listed from the project's documentation, not tested by this site.

Overview

Compartment is an MCP server that gives AI agents durable memory. It keeps one encrypted vault on the user's own computer, read and written by Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex and any other MCP client. There is no API key, no account, no network at runtime and no telemetry. Each memory is a single claim recorded with a required source and the date it was learned, and memories can expire: set expires to a date or a duration such as 14d, 2w, 3m or 1y and the memory is removed after that date. Recall is a hybrid vector and keyword search over an in-memory index; the documented median for a full hybrid search is about 11.6 ms. The embedding model is bundled (384-dimension int8 ONNX) and everything on disk, embedding vectors included, is encrypted under the user's passphrase. A new vault ships with about 6,700 reference facts about hardware, operating systems, ports, encodings and shell tools, removable from search with one switch. Security primitives include XChaCha20-Poly1305 encryption at rest, Argon2id key slots, a key per record, a hash-chained audit log, and a runtime guard that aborts on any network socket attempt (--assert-offline). The project ships a macOS menu bar app, a Windows notification-area app, a Linux window, a read-only browser dashboard bound to 127.0.0.1, memory packs, and a serve command that speaks MCP over stdio. Installation routes include PyPI (pip, pipx, uv), a Claude Code plugin, Docker, and a Compartment.pkg for macOS. Licensed Apache-2.0.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →

Source revision be47c40ce1e7 Data synced 2026-10-19 Read the FMRS scoring method