Caura
Governed shared memory for AI agent fleets: multi-tenant, cross-agent recall, trust tiers, and audit trails — so every interaction makes the next one smarter.
Least privilege is well designed on paper: agent-scoped credentials, four trust tiers, scope_agent/team/org visibility, trust-gated keystone writes. Deduction: these are README/documentation claims; the auth code itself was not in review scope, and CI comments reference two real tenant-isolation advisories (GHSA-xw4x-jwf5-8m9h, GHSA-wgvw-28pq-jc36), showing this surface has had real vulnerabilities. User confirmation: Skills Inbox approval gates and default-off Skill Factory/Interviewer are good, but no confirmation mechanism is documented for deletes/transitions. Data-flow transparency rests on audit-log and PII-flagging claims without visible implementation. Dependency security is genuinely evidenced: argued version floors in requirements.txt, digest-pinned actions and oasdiff image in CI; no dependency-scanning step visible. External effects (third-party LLM calls, plugin pushing skill files to node disk) are disclosed. Rollback covers memory lifecycle/supersession only, not deployment rollback. Source attribution: recall results identify the authoring agent; LICENSE names the copyright holder, but publisher identity is unverified.
Self-consistency is mostly good — tool names, dual credential paths, and legacy aliases are described consistently — but the root package. carries version 0.0.0, a placeholder test script, and a description pitched at 'OpenClaw agents' that sits awkwardly with the mature-platform narrative; deducted. Dependency availability: version floors are argued from verified behavior (uvicorn 0.37 floor, GCP SDK alignment), which is real evidence; the stack is broad (Postgres+pgvector+Redis+LLM providers) with an explicit fallback only for Redis. Failure messages: two CI guards (MCP error envelope via _error_response, ban on str(e.detail)) show the error channel is systematically maintained — a 2; no error-code catalogue is in evidence.
Audience and scenarios are the repository's strongest suit: keyless local trial, self-hosted, managed, OpenClaw plugin, and single-agent-to-fleet scaling all have explicit paths with time estimates — 3. Capability boundaries are partially stated (Interviewer memories are approximations; single-agent benchmarks don't measure fleet axes) but headline numbers and comparisons are self-reported. Trigger precision: the 12 MCP tools have clear division of responsibility and keystone precedence over conflicting user instructions, yet tool behavior cannot be statically verified. Environment fit is thorough: Docker Compose, offline/air-gapped, local embedder, manual deployment.
Information architecture is excellent: layered README, deep docs/ links, CI comments carrying operational history — 3. Install notes cover three paths and per-client MCP registration — 3. Naming stability is exemplary: the MemClaw→Caura rename ships with legacy-name annotations, a legacy_name_ratchet in CI, and dual-read secret aliases — 3. Examples are rich but no FAQ is in evidence. Known limitations are partially and candidly stated. Apache-2.0 license text is present in full — 3. Versioning/changelog is the weakest point: root package. at 0.0.0, no CHANGELOG in the reviewed files, Semver commitment only inside SECURITY.md; deducted. Maintenance responsibility: SECURITY.md gives response SLAs and a supported-versions table and CI shows active upkeep, but publisher identity is unverified — 2.
Output usability: structured write responses (memory_type/title/status/weight) and supersession-aware ranking are documented adequately, but unverified by execution — 2. Marginal value: the comparison table and governed-fleet positioning are clear, yet the comparison is the author's own reading of public docs — 2. Cost benefit: 96–98% token savings and 23ms p50 are self-reported; BENCHMARKS.md was not in the reviewed files so methodology cannot be checked — 2.
Claim traceability is moderate: performance figures point to BENCHMARKS.md and docs/performance.md, dependency floors carry per-line arguments, and the eToro case links a blog — but most of those corroborating files are outside the reviewed set; deducted. Cross-source corroboration is weak: all performance, customer, and competitor claims are self-sourced with no independent confirmation — 1. Fact/inference separation is decent: the docs mark 'our reading of public docs', distinguish deterministic local heuristics from model-inferred outputs, and flag Interviewer approximation risk; still, marketing language ('self-improving') is interwoven with technical fact — 2.
- Publisher identity is unverified; the eToro production claim and all performance figures (77.6%/72.5%, 23ms p50, 96–98% token savings) are self-reported and could not be checked in this static review — re-benchmark independently before adopting.
- Tenant isolation is the core security claim, yet CI comments disclose two prior tenant-boundary advisories (GHSA-xw4x-jwf5-8m9h, GHSA-wgvw-28pq-jc36); run your own isolation testing rather than trusting the documentation.
- Root package. is at version 0.0.0 with no CHANGELOG in evidence; pin an exact commit for traceability.
- The OpenClaw plugin writes skill files to node disk (reconciler push) and the Interviewer disk-parser reads harness transcripts; review both locally-impacting paths before integration.
- Keystone rules are documented to override conflicting user instructions — the model is told to prefer stored governance rules; confirm this semantics matches your trust model before deployment.
What does this agent do, and when should you use it?
Caura (formerly MemClaw) is an Apache-2.0 open-source shared memory layer for multi-tenant, multi-agent AI fleets. The core service is a FastAPI-based REST/MCP API backed by PostgreSQL + pgvector with optional Redis caching, deployable via Docker Compose or the managed platform. Every write undergoes single-pass LLM enrichment: classification into one of 14 memory types, title/summary generation, importance scoring, PII detection, and entity extraction. Retrieval is hybrid — pgvector semantic similarity, full-text keyword matching, and knowledge-graph expansion up to two hops — ranked by a composite of similarity, importance, freshness, and graph boost. Governance includes row-level tenant isolation, three visibility scopes (scope_agent/scope_team/scope_org), four agent trust tiers, keystone policies, and full audit logging on every operation. It runs in production at eToro with 300+ agents and 23 ms p50 search latency.
Agents read and write memory via the MCP endpoint at /mcp or REST under /api/v1. caura_write takes plain text and performs server-side LLM enrichment (type, title, summary, tags, embedding, PII flags); caura_recall runs hybrid semantic + keyword search with graph expansion; caura_manage handles memory lifecycle (read, update, transition, delete, lineage); caura_doc provides CRUD and semantic search over named JSONB document collections; caura_evolve reports outcomes (the Karpathy Loop), adjusting weights and auto-generating rule-type memories on failure; caura_tune optimizes per-agent retrieval parameters (top_k, min_similarity, graph_max_hops, blend weights); caura_keystones reads mandatory governance rules for the current scope. Contradiction detection combines RDF triple comparison with LLM semantic analysis to automatically supersede outdated memories. Deployment paths: a Docker Compose stack (docker compose up -d --wait), the caura.ai managed platform, or an OpenClaw plugin; clients ship as pip install caura-client and npm install @caura/client.
- Platform engineers running a multi-agent dev team: a deploy-agent's rollback steps recalled cross-agent by an incident-agent via scope_team visibility and agent_id attribution.
- Developers connecting multiple coding agents (Claude Code, Cursor, Codex) to one memory plane: via an MCP config block (URL + API key) or the local caura-daemon Broker.
- Organizations with compliance requirements: tenant isolation, automatic PII detection and flagging, four trust tiers, and audit logs on every write and delete.
- Teams whose agents share operational skills: via the caura_doc skills collection, or the governed Skill Factory with a candidate→staged→active lifecycle and Skills Inbox approval.
- Self-hosted, offline, or air-gapped environments: the Docker Compose stack or a local embedder gives semantic search with zero cloud calls.
- Individual developers trying it out: standalone mode boots with no API key, so the first write and keyword search take about 30 seconds.
What are this agent's strengths and limitations?
- The only memory layer in its comparison set built fleet-first: multi-fleet support, agent trust tiers + keystone policies, cross-vendor memory sharing, contradiction detection with supersession, and per-agent retrieval tuning — none of which Mem0, Zep, or Letta offer per the README table.
- Low-latency, token-efficient search: 23 ms p50 / 27 ms p95 and 96.6%–98.2% token savings versus full context — metrics that compound as agent count grows.
- Governance is built in, not bolted on: write-time visibility stamps, row-level tenant isolation, PII auto-detection, full audit logs on every operation, and fully local semantic search via a local embedder.
- Memory self-improves: outcome-based Karpathy Loop reinforcement, LLM crystallization of near-duplicates into atomic facts, an 8-status lifecycle, and knowledge-graph entity resolution that preserves aliases and avoids bad merges (e.g. 'new york' never collapses into 'york').
- Heavy runtime dependencies for self-hosting: PostgreSQL 16+ with pgvector and Docker Compose; Redis is optional but needed for rate limits to hold across replicas.
- Key features are opt-in and off by default: Skill Factory and the Interviewer require tenant-level org settings (enabled=true) before they deliver any value.
- The v1→v2 upgrade is a destructive migration (embedding dimension 768→1024) requiring a database snapshot and full re-embedding — a real cost for existing deployments.
- Accuracy is not the differentiator: the authors themselves note LoCoMo (77.6%) and LongMemEval (72.5%) scores cluster with Mem0 and Zep, so single-agent use gains little; also the self-hosted runtime ships no telemetry, so troubleshooting depends on proactively configuring Sentry.
How do you install or deploy this agent?
Self-hosted fast path: git clone https://github.com/caura-ai/caura.git && cd caura, then cp .env.example .env and add IS_STANDALONE=true to .env (single-tenant, no API key); run docker compose up -d --wait to start PostgreSQL+pgvector, Redis, and the API (~30s). Managed path: sign up free at caura.ai and copy an API key from the dashboard. OpenClaw users can install as a plugin via the one-line agent installer. Clients: pip install caura-client (Python) or npm install @caura/client (Node 18+, zero runtime dependencies). Production images are published as multi-arch images such as ghcr.io/caura-ai/caura-memclaw-core-api:v2.5.0. Manual deployment needs Python 3.12+, PostgreSQL 16+ with the pgvector extension, optional Redis, and uvicorn core_api.app:app --host 0.0.0.0 --port 8000 --workers 2. Note: upgrading from v1.x to v2.x is a destructive opt-in migration (embeddings widened from 768 to 1024 dimensions) requiring a database snapshot and re-embedding.
How do you use this agent?
1) Local check: curl -X POST http://localhost:8000/api/v1/memories -H "X-API-Key: standalone" -H "Content-Type: application/" -d '{"tenant_id":"default","agent_id":"quickstart","write_mode":"strong","content":"Our auth service uses JWT with 15-minute expiry."}', then search with POST /api/v1/search and {"tenant_id":"default","query":"JWT expiry"}. 2) Connect an MCP client (Claude Desktop/Cursor/Claude Code): add {"mcpServers":{"caura":{"url":"http://localhost:8000/mcp","headers":{"X-API-Key":"standalone"}}}}; for Claude Code use claude mcp add --transport http -s user caura http://localhost:8000/mcp --header "X-API-Key: standalone". 3) See the fleet effect: agent A records a lesson with caura_write and visibility=scope_team; agent B calls caura_recall with fleet_ids and sees the original author's agent_id. 4) Production: mint one agent-scoped credential (mc_ prefix) per agent atomically via POST /api/v1/admin/agent-keys/provision. 5) Optionally install the usage skill: curl -s "http://localhost:8000/api/v1/install-skill" | bash.
How does this agent compare with similar options?
The README includes a comparison table against Mem0, Zep, and Letta: all three cluster with Caura on accuracy benchmarks, but none support multi-fleet support, trust tiers + keystone policies, cross-vendor memory sharing, contradiction detection with supersession, or per-agent retrieval tuning (Zep has PII detection and a knowledge graph, with partial audit; Letta's MCP support is partial). Mem0 and Zep focus on single-agent memory; Caura targets multiple agents, teams, and vendors sharing one auditable memory plane. The comparison reflects public docs as of June 2026, with corrections welcome.