Compartment
Encrypted, fully offline long-term memory for AI agents: one local vault shared by every agent, with zero network and zero telemetry at runtime.
- Source repo
- MaxFreedomPollard/Compartment
- Stars
- ★ 584
- Last updated
- 2d ago
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 76/100 · Good
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer using Claude Code or Cursor who wants the agent to remember decisions, credential locations and preferences across sessions and projects without any cloud memory service.
- Not a fit if
- Users who want to dump long transcripts as single memories; entries cap at 200 characters
- Teams needing agents to unlock the vault themselves; memory_unlock is off by default
- Anyone needing a different embedding model; one bundled model per vault
- Source review
- 76/100 · Good
What does this agent do, and when should you use it?
Compartment (GitHub: MaxFreedomPollard/Compartment, Apache-2.0) is a fully offline, encrypted memory system for AI agents that runs as an MCP server over stdio. Everything on disk — including embedding vectors — is XChaCha20-Poly1305 encrypted in a single vault file on your machine, opened only by your passphrase. Recall is hybrid vector and keyword search measured at a median of about 11.6 ms. It bundles a local ONNX embedding model with no LLM inside, no API key, no account, and a runtime network guard (--assert-offline) enforced in CI. A menu-bar/tray app, a browser dashboard served only on 127.0.0.1, a relation graph, signed memory packs and a CLI complete the package, wiring into Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, VS Code and 28 MCP clients overall.
Runs as an MCP server via compartment serve, exposing memory_search, memory_store, memory_store_many, memory_get, memory_forget, memory_link, memory_relations, memory_status and other tools. Each memory is a single claim capped at 200 characters with a required source and discovered date, optional expires date, and opinion records that replace older ones via supersedes. At recall, long records are embedded as overlapping 448-token windows (stride 384) scored by best-window cosine, fused with a self-information-weighted keyword channel via a soft OR, then weighted by importance and recency. compartment integrate claude|hermes|openclaw wires those agents in one command; for Claude Code it also installs a PostToolUse capture hook, imports existing memory files, and installs the /compartmentalize skill. The desktop app handles unlock, lock, passphrase change and auto-lock; compartment dash shows the whole vault read-only in a local browser.
- A developer using Claude Code or Cursor who wants the agent to remember decisions, credential locations and preferences across sessions and projects without any cloud memory service.
- A consultant or firm handling sensitive client information that needs compliance-grade local encryption (XChaCha20-Poly1305, Argon2id, 2FA keyfile).
- A team running multiple agents (Claude, Hermes, OpenClaw, CLI) on one machine that should share one vault, isolated by namespaces and rw/ro grants.
- A user operating agents on an air-gapped machine, served by
compartment setup airgap-bundlefor offline installation. - A maintainer distributing curated knowledge to agents via signed read-only memory packs (
compartment pack build/install). - Anyone who needs auditable memory: every claim carries source and date, can expire, and sits behind a hash-chained audit log (
compartment audit verify).
How do you install or deploy this agent?
No terminal needed: on macOS download Compartment.pkg from the latest release and open it — it prompts for a passphrase, creates the vault and installs to the menu bar. CLI route on any system: pip install compartment && compartment init (Python 3.11+), or pipx install compartment / uv tool install compartment then compartment init. Claude Code plugin: after pip install and init, run /plugin marketplace add MaxFreedomPollard/Compartment then /plugin install compartment@maxfreedompollard. Docker: docker build -t compartment . from a checkout. init asks for a passphrase, creates the vault, loads ~6,700 reference facts, and connects any installed agents.
How do you use this agent?
Wire an agent: compartment integrate claude (or hermes, openclaw); for any other MCP client add {"mcpServers":{"compartment":{"command":"compartment","args":["serve"]}}} to its config, or run compartment integrate --list for the 28 supported clients. Everyday commands: compartment unlock/lock to open and close the vault; status, selftest, verify for health; store/get/forget/search/recent to manage memories by hand; compartment dash for the browser dashboard; compartment 2fa enable to require a keyfile as a second factor; compartment export --plaintext / import for lock-in-free migration; lock --sign adds an Ed25519 manifest for machine-to-machine copies. Restart any connected agent and it can read and write the shared memory.
What are this agent's strengths and limitations?
- The offline guarantee is CI-enforced: the whole test suite runs under the --assert-offline network guard on Linux, macOS and Windows, with no network calls at runtime.
- Encryption is thorough: even embedding vectors are encrypted (vectors can be inverted to text), with per-record keys so
forget --shredis unrecoverable, Argon2id key slots, and optional 2FA. - Measured retrieval performance: median 11.6 ms (p95 14.7 ms) hybrid search and p95 0.68 ms HNSW vector search at 20k records on an 8 GB laptop.
- Multi-agent sharing is nearly free: one shared embedding process (~68 MB) serves all agents, writes are serialized by a file lock, and each agent gets its own namespace.
- The ranking math is transparent: all scoring lives in src/compartment/ranking.py, and the project publishes a sourced comparison table (docs/COMPARISON.md) and accepts corrections by PR.
- The embedding model is fixed to the bundled 384-dimension ONNX model, one model per vault; changing requires
compartment reindex --re-embed. - The pip route needs Python 3.11+; the Windows app requires the Microsoft Visual C++ runtime; the macOS app requires 13+.
- Memories are capped at 200 characters (max_memory_chars), so long session logs must go through
compartment atomizeor memory_store_many — a workflow change for users used to dumping transcripts. - memory_unlock is off by default (the passphrase would enter model context), so agents cannot unlock the vault themselves; automation needs scripts or COMPARTMENT_PASSPHRASE in CI.
- The official comparison table is dated 2 September 2026; competitors' capabilities may have changed since.
How does this agent compare with similar options?
The project's docs/COMPARISON.md compares it against @modelcontextprotocol/server-memory (plaintext JSONL, no encryption), mem0, Graphiti (Zep)/Letta, claude-mem, basic-memory, Hindsight, Supermemory, Cognee and MemOS: Compartment is the only entry in that table with encryption at rest including vectors, no account/API key, and zero network at runtime; most competitors make LLM calls and enable telemetry by default.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Compartment This agent | 76 · Good | CLIFree | ★ 584 | 2d ago | Python | Codex · Claude Code |
| Mnemo Cortex | 75 · Good | Self-hosted serviceFree | ★ 159 | today | Python | Codex · Claude Code · Claude.ai |
| Remnic Agent Memory | 85 · Good | CLIFree + model costs | ★ 227 | today | TypeScript | ChatGPT · Codex · Claude Code · OpenAI API |
| Emulo | 78 · Good | Agent plugin / skillFree + model costs | ★ 298 | 10d ago | HTML | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Encryption, per-record keys, namespace ACLs, hash-chained audit, pack signature verification against trusted keys only, memory_unlock disabled by default, hook installs back up settings. with --no-hooks and uninstall paths; sensitive-data handling is well evidenced. Deducted: --caller identity is declarative (admitted in SECURITY.md), PostToolUse hook modifies editor config, dependencies are range-pinned with no lock summary.
pyproject comments show dual-major mcp compatibility, VaultStaleError-style specific errors, and CI across three OSes. Deducted: consistency claims (12 ms, 99% recall) are textual assertions unverifiable in a static review.
Docs address per-OS differences (Linux window by design, Windows AF_UNIX absence), multi-agent sharing, and vault migration. Deducted: trigger precision and boundary handling rely on documentation; no adversarial test file visible for host models overriding tool instructions.
Thorough install notes (one-click plus CLI integrate), excellent naming stability (engram alias retained), honest known-limitations section, full Apache-2.0. Deducted: no visible FAQ/examples file, no CHANGELOG file (only a releases link), maintenance reads as a single person ('I') with no governance or collaborator information.
Clear positioning (offline encrypted memory), a comparison table argues marginal value, retrieval math is documented transparently. Deducted: the ~70 MB shared process and ~6,700 seeded reference facts impose default footprint whose cost trade-offs are only indirectly discussed.
Key claims point to concrete files (SECURITY.md, docs/COMPARISON.md, ranking.py); CI's --assert-offline is an executable proof path for the offline claim. Deducted: most performance/security conclusions are self-asserted ('best security of any vector memory'), measurements cannot be verified statically, and some dated narrative (2026) is beyond checking.
- Static review only; no code executed. All performance and security claims are self-reported; confidence is low.
- --caller identity is declarative: a hostile host can claim another caller's namespace grants. For real isolation run one serve instance per host.
- The PostToolUse hook modifies Claude Code's settings.; it backs up first and is uninstallable, but inspect the diff yourself.
- Install ships a ~70 MB resident embedding process and ~6,665 reference facts; switches exist to disable both.
- Losing the passphrase is unrecoverable by design; enable 2FA keyfile if a weak passphrase is a concern.
- Publisher is an unverified individual with no organizational governance; enterprises should independently review dependencies and the crypto implementation before adoption.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v4.13.0 Compartment 4.13.0
Release notes excerpt
Compartment 4.13.0 is a compatibility release: it is about Compartment installing, starting and staying connected on every system and in every agent, including the places it used to fail quietly - agents' sandboxed shells, Windows on ARM, Intel Macs, containers, and GUI apps that cannot see your PATH. 4.12.0 was merged but never published, so its 79 stability fixes ship here too. Downloads | File | For | |---|---| | Compartment-4.13.0.pkg | macOS on Apple silicon, one click, with the menu bar app | | Compartment-4.13.0.dmg | macOS on Apple silicon, drag to Applications | …View on GitHub ↗ -
v4.11.0 4.11.0 - the menu bar opens at once, and one rule for what to store
Release notes excerpt
The menu bar panel no longer opens your vault every time you click it, every agent now gets the same, narrower rule for what to store, and a race that could lose a memory while the vault was being opened is fixed. The menu bar Every click on the icon used to start two fresh Compartment programs, compartment status and then compartment recent. Each one loaded Python and decrypted the whole vault, thousands of starting memories included, to show a count and five lines. The second one then rewrote the vault file on its way out, which made every running agent's server read the whole vault …View on GitHub ↗ -
v4.10.1 4.10.1 - error corrections
FAQ
Does it need a network connection or a paid account?
What happens if I lose my passphrase?
Will multiple agents conflict on the same vault?
How do I move it to a new machine?
export --plaintext writes JSONL so you are never locked in.