Compartment
Encrypted, fully offline long-term memory for AI agents: one local vault shared by every agent, with zero network and zero telemetry at runtime.
Encryption, per-record keys, namespace ACLs, hash-chained audit, pack signature verification against trusted keys only, memory_unlock disabled by default, hook installs back up settings. with --no-hooks and uninstall paths; sensitive-data handling is well evidenced. Deducted: --caller identity is declarative (admitted in SECURITY.md), PostToolUse hook modifies editor config, dependencies are range-pinned with no lock summary.
pyproject comments show dual-major mcp compatibility, VaultStaleError-style specific errors, and CI across three OSes. Deducted: consistency claims (12 ms, 99% recall) are textual assertions unverifiable in a static review.
Docs address per-OS differences (Linux window by design, Windows AF_UNIX absence), multi-agent sharing, and vault migration. Deducted: trigger precision and boundary handling rely on documentation; no adversarial test file visible for host models overriding tool instructions.
Thorough install notes (one-click plus CLI integrate), excellent naming stability (engram alias retained), honest known-limitations section, full Apache-2.0. Deducted: no visible FAQ/examples file, no CHANGELOG file (only a releases link), maintenance reads as a single person ('I') with no governance or collaborator information.
Clear positioning (offline encrypted memory), a comparison table argues marginal value, retrieval math is documented transparently. Deducted: the ~70 MB shared process and ~6,700 seeded reference facts impose default footprint whose cost trade-offs are only indirectly discussed.
Key claims point to concrete files (SECURITY.md, docs/COMPARISON.md, ranking.py); CI's --assert-offline is an executable proof path for the offline claim. Deducted: most performance/security conclusions are self-asserted ('best security of any vector memory'), measurements cannot be verified statically, and some dated narrative (2026) is beyond checking.
- Static review only; no code executed. All performance and security claims are self-reported; confidence is low.
- --caller identity is declarative: a hostile host can claim another caller's namespace grants. For real isolation run one serve instance per host.
- The PostToolUse hook modifies Claude Code's settings.; it backs up first and is uninstallable, but inspect the diff yourself.
- Install ships a ~70 MB resident embedding process and ~6,665 reference facts; switches exist to disable both.
- Losing the passphrase is unrecoverable by design; enable 2FA keyfile if a weak passphrase is a concern.
- Publisher is an unverified individual with no organizational governance; enterprises should independently review dependencies and the crypto implementation before adoption.
What does this agent do, and when should you use it?
Compartment (GitHub: MaxFreedomPollard/Compartment, Apache-2.0) is a fully offline, encrypted memory system for AI agents that runs as an MCP server over stdio. Everything on disk — including embedding vectors — is XChaCha20-Poly1305 encrypted in a single vault file on your machine, opened only by your passphrase. Recall is hybrid vector and keyword search measured at a median of about 11.6 ms. It bundles a local ONNX embedding model with no LLM inside, no API key, no account, and a runtime network guard (--assert-offline) enforced in CI. A menu-bar/tray app, a browser dashboard served only on 127.0.0.1, a relation graph, signed memory packs and a CLI complete the package, wiring into Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, VS Code and 28 MCP clients overall.
Runs as an MCP server via compartment serve, exposing memory_search, memory_store, memory_store_many, memory_get, memory_forget, memory_link, memory_relations, memory_status and other tools. Each memory is a single claim capped at 200 characters with a required source and discovered date, optional expires date, and opinion records that replace older ones via supersedes. At recall, long records are embedded as overlapping 448-token windows (stride 384) scored by best-window cosine, fused with a self-information-weighted keyword channel via a soft OR, then weighted by importance and recency. compartment integrate claude|hermes|openclaw wires those agents in one command; for Claude Code it also installs a PostToolUse capture hook, imports existing memory files, and installs the /compartmentalize skill. The desktop app handles unlock, lock, passphrase change and auto-lock; compartment dash shows the whole vault read-only in a local browser.
- A developer using Claude Code or Cursor who wants the agent to remember decisions, credential locations and preferences across sessions and projects without any cloud memory service.
- A consultant or firm handling sensitive client information that needs compliance-grade local encryption (XChaCha20-Poly1305, Argon2id, 2FA keyfile).
- A team running multiple agents (Claude, Hermes, OpenClaw, CLI) on one machine that should share one vault, isolated by namespaces and rw/ro grants.
- A user operating agents on an air-gapped machine, served by
compartment setup airgap-bundlefor offline installation. - A maintainer distributing curated knowledge to agents via signed read-only memory packs (
compartment pack build/install). - Anyone who needs auditable memory: every claim carries source and date, can expire, and sits behind a hash-chained audit log (
compartment audit verify).
What are this agent's strengths and limitations?
- The offline guarantee is CI-enforced: the whole test suite runs under the --assert-offline network guard on Linux, macOS and Windows, with no network calls at runtime.
- Encryption is thorough: even embedding vectors are encrypted (vectors can be inverted to text), with per-record keys so
forget --shredis unrecoverable, Argon2id key slots, and optional 2FA. - Measured retrieval performance: median 11.6 ms (p95 14.7 ms) hybrid search and p95 0.68 ms HNSW vector search at 20k records on an 8 GB laptop.
- Multi-agent sharing is nearly free: one shared embedding process (~68 MB) serves all agents, writes are serialized by a file lock, and each agent gets its own namespace.
- The ranking math is transparent: all scoring lives in src/compartment/ranking.py, and the project publishes a sourced comparison table (docs/COMPARISON.md) and accepts corrections by PR.
- The embedding model is fixed to the bundled 384-dimension ONNX model, one model per vault; changing requires
compartment reindex --re-embed. - The pip route needs Python 3.11+; the Windows app requires the Microsoft Visual C++ runtime; the macOS app requires 13+.
- Memories are capped at 200 characters (max_memory_chars), so long session logs must go through
compartment atomizeor memory_store_many — a workflow change for users used to dumping transcripts. - memory_unlock is off by default (the passphrase would enter model context), so agents cannot unlock the vault themselves; automation needs scripts or COMPARTMENT_PASSPHRASE in CI.
- The official comparison table is dated 2 September 2026; competitors' capabilities may have changed since.
How do you install or deploy this agent?
No terminal needed: on macOS download Compartment.pkg from the latest release and open it — it prompts for a passphrase, creates the vault and installs to the menu bar. CLI route on any system: pip install compartment && compartment init (Python 3.11+), or pipx install compartment / uv tool install compartment then compartment init. Claude Code plugin: after pip install and init, run /plugin marketplace add MaxFreedomPollard/Compartment then /plugin install compartment@maxfreedompollard. Docker: docker build -t compartment . from a checkout. init asks for a passphrase, creates the vault, loads ~6,700 reference facts, and connects any installed agents.
How do you use this agent?
Wire an agent: compartment integrate claude (or hermes, openclaw); for any other MCP client add {"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}} to its config, or run compartment integrate --list for the 28 supported clients. Everyday commands: compartment unlock/lock to open and close the vault; status, selftest, verify for health; store/get/forget/search/recent to manage memories by hand; compartment dash for the browser dashboard; compartment 2fa enable to require a keyfile as a second factor; compartment export --plaintext / import for lock-in-free migration; lock --sign adds an Ed25519 manifest for machine-to-machine copies. Restart any connected agent and it can read and write the shared memory.
How does this agent compare with similar options?
The project's docs/COMPARISON.md compares it against @modelcontextprotocol/server-memory (plaintext JSONL, no encryption), mem0, Graphiti (Zep)/Letta, claude-mem, basic-memory, Hindsight, Supermemory, Cognee and MemOS: Compartment is the only entry in that table with encryption at rest including vectors, no account/API key, and zero network at runtime; most competitors make LLM calls and enable telemetry by default.
FAQ
Does it need a network connection or a paid account?
What happens if I lose my passphrase?
Will multiple agents conflict on the same vault?
How do I move it to a new machine?
export --plaintext writes JSONL so you are never locked in.