by caura-ai
Governed shared memory for AI agent fleets — multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0.
# Add to your Claude Code skills
git clone https://github.com/caura-ai/caura-memclawGuides for using ai agents skills like caura-memclaw.
Last scanned: 6/12/2026
{
"issues": [
{
"file": "README.md",
"line": 77,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "README.md",
"line": 172,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "README.md",
"line": 178,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "README.md",
"type": "secret-exfiltration",
"message": "…and 3 more similar matches in this file",
"severity": "low"
},
{
"file": "README.md",
"line": 411,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -s \"http://localhost:8000/api/v1/install-skill\" | bash\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-06-12T08:26:32.039Z",
"npmAuditRan": true,
"pipAuditRan": false,
"promptInjectionRan": true
}caura-memclaw is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by caura-ai. Governed shared memory for AI agent fleets — multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0. It has 379 GitHub stars.
Yes. caura-memclaw passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/caura-ai/caura-memclaw" and add it to your Claude Code skills directory (see the Installation section above).
caura-memclaw is primarily written in Python. It is open-source under caura-ai on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh caura-memclaw against similar tools.
No comments yet. Be the first to share your thoughts!
MemClaw is open-source memory for multi-tenant, multi-agent AI fleets. Your agents store what they learn, find what the fleet knows, and get smarter with every interaction — learning from each other instead of repeating mistakes.
Agents write plain text. MemClaw turns it into searchable, governed, self-improving memory.
One loop, three pillars: write, recall, compound — every interaction makes the next one smarter.
Built for fleets, not single agents. Public agent-memory benchmarks (LoCoMo, LongMemEval) measure one agent, one user, one long conversation — the single-chatbot shape. The deployment shape we see in production is the opposite: dozens or thousands of agents working on behalf of a company, sharing what they learn under governance. MemClaw is architected around that shape from day one — scoped memory, cross-agent outcome propagation, fleet-wide trust tiers — and competes on the axes that compound with agent count: latency, token efficiency, and governance. See Performance for the numbers, or read the benchmarks write-up.
In production at eToro (NASDAQ: ETOR): 300+ AI agents on one governed memory — 26,500+ memories, 1,372 shared skills, 23 ms p50 search. Architecture deep-dive →
The fastest way to see MemClaw work. Standalone mode runs single-tenant with auth bypassed — write and recall a memory in four commands. (It boots with dummy embeddings so there's nothing to configure; add an AI provider key for semantic search — see Self-Hosted below.)
git clone https://github.com/caura-ai/caura-memclaw.git
cd caura-memclaw
cp .env.example .env && echo "IS_STANDALONE=true" >> .env # single-tenant, no API key
docker compose up -d # Postgres + pgvector + Redis + API (~30s)
# Write a memory — no API key needed
curl -X POST http://localhost:8000/api/v1/memories \
-H "X-API-Key: standalone" -H "Content-Type: application/json" \
-d '{"tenant_id": "default", "content": "Our auth service uses JWT with 15-minute expiry."}'
# Search for it
curl -X POST http://localhost:8000/api/v1/search \
-H "X-API-Key: standalone" -H "Content-Type: application/json" \
-d '{"tenant_id": "default", "query": "authentication token lifetime"}'
The write response comes back enriched with an LLM-inferred memory_type, title, summary, tags, status, and weight — all from a single content field.
Ready for semantic recall, multi-tenant, a managed host, or an OpenClaw fleet? Pick a path below.
Three paths — pick the one that matches your setup:
| Path | When | Time to first memory |
|---|---|---|
| Managed platform | Quickest. We host the DB + scaling. | ~2 min |
| Self-hosted (Docker) | Privacy / on-prem / air-gapped. | ~5 min |
| OpenClaw plugin | You already run an OpenClaw fleet — install MemClaw as a plugin against any of the above. | ~3 min |
Get up and running in minutes — no infrastructure, automatic updates, usage analytics, and enterprise-grade security included.
{
"mcpServers": {
"memclaw": {
"url": "https://memclaw.net/mcp",
"headers": { "X-API-Key": "mc_your_api_key_here" }
}
}
}
Production / team use: the quickstart key above is a tenant-scoped credential — fine for personal use, but a fleet of agents should bind each one to its own agent-scoped credential for trust gating, fleet membership, and per-agent keystones. Provision agent-scoped credentials atomically via
POST /api/v1/admin/agent-keys/provision, or through the dashboard at/settings/organization/api-credentials. Both kinds use themc_prefix on the wire — scope is bound at mint time on the credential itself. The MCP server accepts the credential on eitherX-API-Key: mc_…orAuthorization: Bearer mc_…. (Pre-existingmca_…andmci_…keys continue to authenticate via back-compat.)Using a tenant-scoped credential? Pass an explicit
agent_idon every MCP tool call — the gateway refuses the reserved default (mcp-agent) on the tenant-scoped path.
The fastest path is Docker Compose — one command brings up Postgres + pgvector + Redis + the API.
Prefer not to use Docker? Skip to Manual deployment (Python + Postgres) below for the bare-Python path.
No cloud API key, no external calls? v2.0+ supports a self-hosted local embedder (
BAAI/bge-m3via HuggingFace TEI) — seedocs/local-embedder.md. The setup below walks through the OpenAI default; the local-embedder doc walks through the alternative.
docker --version.docker compose version.git clone https://github.com/caura-ai/caura-memclaw.git
cd caura-memclaw
cp .env.example .env
Set your AI provider in .env — minimal setup with OpenAI:
EMBEDDING_PROVIDER=openai
ENTITY_EXTRACTION_PROVIDER=openai
USE_LLM_FOR_MEMORY_CREATION=true
OPENAI_API_KEY=sk-...
Without any AI keys the stack still starts — dummy providers return non-semantic embeddings, useful for testing the API surface.
💡 Want zero cloud API calls? v2.0+ ships a self-hosted embedder profile (
BAAI/bge-m3on a HuggingFace TEI sidecar). Bring up the stack withdocker compose --profile embed-local up -dand set the fourOPENAI_EMBEDDING_*envs from.env.example— seedocs/local-embedder.mdfor the full setup. Combined withIS_STANDALONE=true(below) this is a fully self-contained deployment with no external API calls.
| Provider | .env settings |
Required key |
|---|---|---|
| OpenAI (default) | EMBEDDING_PROVIDER=openaiENTITY_EXTRACTION_PROVIDER=openai |
OPENAI_API_KEY |
| Google Gemini | EMBEDDING_PROVIDER=openaiENTITY_EXTRACTION_PROVIDER=gemini |
GEMINI_API_KEY + OPENAI_API_KEY |
| Anthropic | EMBEDDING_PROVIDER=openaiENTITY_EXTRACTION_PROVIDER=anthropic |
ANTHROPIC_API_KEY + OPENAI_API_KEY |
| OpenRouter | EMBEDDING_PROVIDER=openaiENTITY_EXTRACTION_PROVIDER=openrouter |
OPENROUTER_API_KEY + OPENAI_API_KEY |
| Self-hosted (TEI / bge-m3) | --profile embed-local + OPENAI_EMBEDDING_BASE_URL=http://tei:80/v1+ OPENAI_EMBEDDING_MODEL=BAAI/bge-m3+ OPENAI_EMBEDDING_SEND_DIMENSIONS=false |
none — runs locally |
Anthropic, Gemini, and OpenRouter don't offer embedding APIs here — pair them with OpenAI (or with TEI) for embeddings. You can mix providers freely. Gemini uses the Google AI Studio key-auth Developer API (no GCP project/ADC required). The self-hosted TEI row keeps EMBEDDING_PROVIDER=openai because TEI speaks the same OpenAI-compatible API; see docs/local-embedder.md for hardware sizing, GPU setup, and model swapping.
docker compose up -d
By default this pulls the multi-arch images from ghcr.io (linux/amd64 + linux/arm64) on first run — takes ~30 seconds. Subsequent up commands re-use the cached image (no registry round-trip, works offline). To pin a specific version, set MEMCLAW_VERSION=v1.2.3 in your .env. To build from local source instead (e.g. when iterating on a fork), run docker compose up --build --no-pull.
To upgrade to a newer image at the same tag (e.g. :latest after we cut a new rel