ai-memory is a dependable endpoint memory substrate for AI agents — from a single agent to a cluster, swarm, or hive — with encryption, cryptographic attestation, and a forensic audit trail of exactly what each agent did, and when.
ai-memory is a single, lean Rust binary. Install it, run serve, and point any HTTPS/MCP client at it.
curl -fsSL https://raw.githubusercontent.com/alphaonedev/ai-memory-mcp/main/install.sh | sh
Copy
cargo install ai-memorybrew install alphaonedev/tap/ai-memorycargo install --git https://github.com/alphaonedev/ai-memory-mcp.gitdocker run -p 9077:9077 -v data:/data ai-memoryai-memory serve --host 127.0.0.1 --port 9077ai-memory install claude-code --applyFull installation, configuration, and upgrade guide → docs/INSTALL · Requires Rust (rustup) for source builds.
When a task ends, an AI agent loses what it did — because there is no reliable place to keep it. No continuity, no shared context across a fleet, no accountability. ai-memory is that place: a durable, integrity-first memory the whole fleet can trust.
Drawn from 2,200+ real issues and audited against the shipping code: the failures that make an AI agent — one, a cluster, a swarm, or a whole hive — act on wrong, leaked, resurrected, or unauthorized memory as if it were the truth. Each is answered by a real, shipping feature and maps to a North-Star pillar — data integrity · security · performance · reliability.
You tell a customer their data is erased — then a lagging machine somewhere in the fleet quietly brings the record back to life. ai-memory guarantees a delete destroys the data's own encryption key and replicates the erasure itself, so no copy on any node can resurrect it — forgotten stays forgotten, fleet-wide. For engineers: filter-required forget + per-record crypto-erase + replicated erasure outbox with restore-supersede guards.
Your compliance case rests on the memory's own records — so a forged signature must never be filed as merely "unsigned," and a trimmed or edited history must be caught, not pass a green check. ai-memory guarantees a bad signature is permanently marked forged, and the event history is a tamper-evident chain anyone can independently verify — breaks, gaps, and truncation are convicted; approvals can require a quorum of distinct signers. For engineers: attest_write→Forged + hash-chained signed_events + composite verify_audit_trail verdict + m-of-n quorum verify.
A momentary database or network hiccup must never be read as "no policy — allow it," and a human's most explicit control — a Deny — must never flip back to Allow. ai-memory guarantees every permission check fails closed on an outage, an unreadable rule refuses rather than waving traffic through, and an operator's Deny is final — no token can override it. For engineers: governance gates fail-closed by default + inert-matcher refuses + operator Deny terminal at the capability gate (#3111).
You need to hand a sub-agent or a partner a narrow, time-boxed slice of access — this area, read-only, expires Friday — without giving away your master key or phoning a server on every call. ai-memory guarantees attenuable capability tokens: a signed grant anyone can further narrow (never widen) with no key at all, verified offline against a closed list of trusted issuers. For engineers: cap1 macaroon-style tokens — Ed25519 root + HMAC caveat chain, constant-time verify, closed issuer allowlist, keyless attenuation.
You run one agent thousands of times over shared memory for throughput — and two copies race to grab the same task: both win, both do it. Double-charges, duplicate side effects, lost work. A plain database gives you no way to stop it. ai-memory guarantees claims and hand-offs run through atomic, exactly-one-winner transitions with holder leases, so under any amount of concurrency a job is claimed once — and every claim is signed and attributable. For engineers: compare-and-swap action transitions + holder leases + dependency frontier + signed A2A signals.
On production Postgres, one customer's agents — or a scoped partner node — must never read, delete, or forge records outside their lane. The isolation that holds in testing has to hold on the exact backend and federation paths you run live. ai-memory guarantees reads are private-by-default behind a fail-closed visibility gate, permission rules resolve deny-first, and every peer is default-deny — scoped to exactly the data it may send or pull, on both backends alike. For engineers: caller-visibility gate + deny-first permission rules + default-deny PeerScope + SQLite/Postgres parity handlers.
One node accepts a write, returns "202 accepted," and the peer silently never gets it — the failure vanishes into a log line while your dashboard shows zero problems and your nodes quietly drift apart. ai-memory guarantees a write that can't reach the required copies says so loudly at the source, with the exact record to reconcile, and every failed hand-off lands in a durable retry queue drained until it succeeds — no silent divergence. For engineers: quorum broadcast + durable-local 202 with reconcile id + never-terminating federation DLQ replay + resumable /sync, SQLite/Postgres parity.
You swap or upgrade your AI embedding model and your agents start silently recalling the wrong memories — the scores still look confident, nothing errors, the results are just wrong, and the agents act on them as truth. ai-memory guarantees every memory carries a fingerprint of the exact model space it was built in, and it refuses to compare across incompatible spaces — at worst it falls back to keyword recall, never confidently wrong. For engineers: embedding_space_fingerprint + semantic-withheld + recall_index_coverage + opt-in strict dim-match.
An upgrade or restore quietly rebuilds a table on zero rows and stamps the schema "up to date" — your whole corpus is wiped, with no error, and a basic health check still shows green. ai-memory guarantees it refuses to certify a migration that lost its data: an unexpected drop to zero rows on a core table fails the upgrade closed instead of blessing an empty database as healthy. For engineers: zeroed-stamp assertion + core-table coverage + corpus row-count guard + fail-closed migration ladder.
You turn on encryption-at-rest and tell your auditors the corpus is sealed — but a mis-set passphrase quietly falls back to writing plaintext, and hot write paths were never sealing at all. ai-memory guarantees that with encryption on, content is actually sealed to the owning key on every write path — and a requested at-rest passphrase it can't honor refuses, rather than silently persisting plaintext. For engineers: seal_content envelope (0x02) + per-record envelope (0x03) + refuse-on-missing-at-rest-passphrase.
A compromised peer, an adversarial input, or a memory with no valid provenance gets written into the shared store — and every agent that reads it is contaminated. ai-memory guarantees any inbound memory that isn't validly signed is quarantined at the door: kept for audit but structurally invisible to recall and to the signed ledger, so it can never be recalled as fact or enter an attested batch — and an operator can inspect and audibly release it. On by default in the certified configuration. For engineers: maybe_quarantine_unattributed → LifecycleState::Quarantined + quarantine tier excluded from recall & the signed ingestion Merkle root + audited /admin/quarantine inspect+release + FED_QUARANTINE_UNATTRIBUTED / CID_ENFORCE certified-profile floors.
Every one is backed by shipping code and tracked, fixed issues — proven from a single agent to a cluster, swarm, or hive. Apache-2.0, self-hostable, auditable from git clone.
Run one agent 5,000 times and a single wrong idea can convince all 5,000 — they burn hours and tens of thousands in tokens before a human notices. Because it spreads through shared memory, it is ai-memory's job to make it survivable. (The internal-groupthink case — a legitimately-signed but wrong belief. External poison is quarantined outright: see #11.)
In its certified enterprise-federation configuration, ai-memory is engineered for organizations that need memory to be correct, private, and provable.
Encrypted in transit, with an option to encrypt data at rest.
Cryptographic attestation + a forensic trail of every memory: who, what, when, and under what authority.
Backend "reflection" AI curates memories across frontier models — agents escape a single model's echo chamber.
Not a flat log — a graph of the relationships between what agents learn.
Security controls and rules set by the operator that agents can never bypass.
The same substrate serves a single agent or a global federated hive.
ai-memory treats memory as regulated data — encrypted, attested, governed, and tamper-evident end to end.
Every API and MCP client connects over HTTPS / TLS.
Federated peers communicate over mutual TLS (mTLS).
Encrypted link to the PostgreSQL data tier.
Attestation is cryptographic proof of provenance. Every memory and agentic action is signed by the authenticated identity that produced it and sealed into an append-only chain — a tamper-evident record of who recorded what, when, and under what authority.
Why it matters: it makes memory non-repudiable and tamper-evident. No agent — or intruder — can forge, backdate, or silently alter a memory without breaking the cryptographic chain. That is the difference between "the log says so" and "we can prove it."
A hardened, locked-down security posture for the certified federation — defense-in-depth for high-assurance deployments.
Security controls on the agent-facing MCP interface aligned to NSA hardening guidance — locked down, not open by default.
When a customer requires it, data is encrypted at rest — machine-verified, not merely asserted.
Every memory signed and sealed into the append-only chain — provable, tamper-evident provenance.
Operator permission rules agents can never bypass — a rule-derived Deny is terminal, even to a valid capability token.
Ambiguous or unsafe states refuse rather than guess — no fail-open, no partial or unsigned commits.
Run it entirely inside your own boundary, or elastically in the cloud. Any networked device can connect as a thin HTTPS client — no substrate hosting required.
ai-memory is not a vibe-coded prototype. It is built by a defined AI-agentic engineering system — a framework deliberately architected so the AI agents doing the coding produce a refined, correct, production-grade result. The system is the reason you can trust the output.
The agent that writes code never reviews or merges it. No agent can self-approve — the failure mode of most AI-assisted codebases is made structurally impossible.
Every difficult decision faces an adversarial panel of independent AI reviewers voting from distinct angles — not one opinion, and not vibes.
Every coding agent works to a versioned, prioritized Rust engineering standard — correctness cited by rule number, safety gated before anything else.
Agents reason over a real knowledge graph of the codebase — call paths and blast radius known before a line is written, not discovered in production.
Nothing lands on "the tests passed." The fix must be present at the tip and proven by a live regression; every commit is cryptographically signed.
AI agents are wired directly into ai-memory to test it live — clusters, swarms, and hives stress-tested on real infrastructure.
Full methodology → How ai-memory is built
Every gate, issue, and test is measured against one bar — that a Fortune 500 or a government could trust it with mission-critical work.
No silent loss; no partial or unsigned commit.
Operator rules never bypassed; no fail-open.
Bounded, non-DoS-able, live under contention.
Cross-backend parity, recoverability, no kill-switch.