Compartment

Durable agentic memory, encrypted at rest.

Your AI agent forgets you the moment the session ends. Compartment ends that. With Compartment, your AI agent gets better with experience: it keeps every decision, preference and detail you give it, permanently, encrypted, on your own computer. Hermes, Claude, OpenClaw and other AI Agents can install in one command. One fully-transferable memory store is shared simultaneously by all agents on the computer. 100% offline: no network, no API key, no cloud account, no telemetry. The embedding model ships inside the package, and a full search returns in about 12 ms, beating the round-trip a hosted memory charges you for. Every byte at rest is AEAD-encrypted, the embedding vectors included, and only your passphrase opens it.

Unlike other agentic memory, we offer an option to start off with memory - 6,718 curated facts seeded at install: the physical constants and unit conversions, 800+ hardware facts with real specs (Apple silicon, PCs, CPUs and GPUs, phones, game consoles, Raspberry Pi, storage, displays, connectors) to provide a map of computer geography, operating system versions and release names, network ports and HTTP, file signatures, character encodings, shell and Unix internals, git, regex, SQL and hashing, ISO country, currency and time codes, and more. Allows an offline agent to operate better without internet, and an online agent to operate faster and more accurately.

More secure, by construction. Every byte at rest is authenticated-encrypted, the embedding vectors included (most tools leave those in the clear, and vectors can be inverted back toward text). Deletion is cryptographic: destroy the record's key and it is gone, unrecoverable. Tampering is detected, history is hash-chained, and the vault locks itself on restart or power loss. It runs fully offline: a runtime guard aborts on any network attempt, and CI proves it on three operating systems.

Not one step harder. One command installs it, creates the vault, and wires your agent. No API key, no cloud account, no daemon. Unlock when you want to use it; lock when you want it closed. By default an unlock stays open for weeks (until restart or you lock it), like any app you leave running. The security is free at the point of use because it falls out of the architecture, not out of your patience: keeping plaintext off disk forces the index into RAM, and a RAM-resident index is also the fastest one there is. Secure and fast are the same choice here, and neither costs you a configuration step.

Install

One line install, works on all operating systems.

pip install compartment && compartment init

Then connect it to the agent you use:

compartment integrate claude

claude, hermes and openclaw are the three auto-connect targets. Each one also gets the /compartmentalize skill installed into its own skills directory.

/compartmentalize saves the conversation before it is thrown away. Every agent eventually compacts or summarizes a long session, and the summary is written by a pass that has no tools, so nothing can be stored from inside it: whatever the model did not think to save is simply gone. Type /compartmentalize and the whole conversation is swept into the vault first - people and contacts, credentials and where they live, URLs and hosts, decisions and the reasoning behind them, and a narrative of the session itself. Then compact, and nothing is lost. It works on its own at any point too.

One click install (for people not good with command line). Download Compartment.pkg from the latest release and open it. Python, the embedding model and every dependency are inside it. macOS only.

After install, everything is managed from the app: the menu bar on macOS, the notification area on Windows, and a window from your applications menu on Linux.

Compartment is an MCP server, so it works with all MCP capable agentic AI out of the box. Every option is in Configuration.

What sets it apart

Install it in one step

• One command installs it, creates the vault, and wires your agent. No API key, no cloud account, no daemon.
• On the Mac, open one .pkg and you are done. Python, the embedding model and every dependency are inside it.
• An app runs the whole thing without a terminal on all three systems: vault state, unlock, lock, and the last five memories it saved. The macOS menu bar, the Windows notification area, a window on Linux.
• Every feature toggles in that panel instead of a config file: model-independent capture, starter facts in search, auto-lock.
• /compartmentalize is installed into every agent it connects, so one command banks a whole conversation before compaction throws it away.
• Your vault ships full. The 6,718 seeded facts are ordinary memories, editable and forgettable, and one switch keeps them out of search.
• Runs under what you already use: Hermes ("no setup needed"), Claude Code and Desktop over MCP, OpenClaw, every MCP client, plus a CLI for scripts and cron.

Remembers the right things

• "OK" is a decision, and Compartment files it as one, with the question it answered. That is the record you need later.
• Decisions beat preferences, preferences beat machine details, machine details beat chatter. A fixed ranking, not a model's mood.
• It forgets nothing. Small talk is kept and ranked last.
• It replaces your host's built-in memory instead of fighting it: imports what Claude Code already wrote, then supersedes it.
• It captures even when the model does not cooperate. A hook writes the fact whether or not the model calls the tool.
• A graph, not a pile. Explicit relations with validity windows answer who worked where, and when.

Search that beats a network call

• 0.68 ms vector search. About 12 ms for the full hybrid pipeline. A cloud memory spends longer than that saying hello.
• Exact below 20k records: recall = 1.0 by construction, not an approximation.
• Hybrid always: meaning and keywords, fused.
• One pinned embedding space, enforced every time the vault opens, so your comparisons stay valid forever.

Encrypted, offline, and yours

• Every byte at rest is AEAD-encrypted, embedding vectors included. Most tools leave vectors in the clear, and vectors invert back toward text.
• Only your passphrase opens it. Compartment generates no password, no seed, no recovery phrase, and holds no credential you do not.
• Add a keyfile and unlock takes two factors. Both feed Argon2id together, so it is arithmetic, not a policy check.
• forget --shred destroys the record's key. The content is mathematically unrecoverable, not marked deleted.
• Restart or power loss locks it, and the agent has a panic lock that clears every credential instantly.
• 100% offline. A runtime guard aborts on any network attempt, and CI proves it on Linux, macOS and Windows. Zero open ports. No telemetry, ever.
• No LLM inside. Embeddings run locally in under 300 MB, and judgment stays with the model you already pay for.
• Tamper-evident: hash-chained audit log, sealed journal, verified kill-9 crash recovery.
• One portable file. Move a locked vault anywhere, and lock --sign seals it with an Ed25519 manifest anyone can verify without a credential.
• compartment dash puts the entire vault on a local page: 127.0.0.1 only, random token, read-only.

The memory logic

Full write-path, decision math, and comparisons in docs/MEMORY.md. The load-bearing ideas:

Nearly everything is stored; nothing important is buried. Only empty turns are dropped. A bare "OK" is not noise, it is a decision: when the agent asks "Want me to send this reply to the client now?" and the user answers "OK", Compartment resolves the question from the conversation and stores [decision 2026-07-20] Approved (answered "OK"): Want me to send this reply to the client now? at the top importance tier. Asking "did the user say to email the client?" later retrieves exactly that record.

Deterministic importance tiers rank recall: decisions/consent 0.90, personal facts and preferences 0.80, the user's machine and configuration 0.75, other substantive statements 0.55, pleasantries 0.20 (kept, ranked last). Importance multiplies a match rather than adding to it, so it settles near-ties in favour of what matters and can never surface a memory for a question it has nothing to do with. The whole scoring model, and the numbers it was chosen against, are in The mathematics. The agent learns the user and the computer first, the world second, and forgets nothing.

One memory, not two. Agent hosts increasingly ship a memory of their own - Claude Code keeps per-project Markdown files with an auto-loaded index. Two memories means facts land in whichever one the model happened to think of, and neither is complete. Compartment takes over on install: it imports what the file memory already holds, and both the MCP handshake and the managed CLAUDE.md block tell the model that Compartment supersedes it - write every new memory here, treat the files as a read-only archive. One vault, encrypted, shared by every agent and project on the machine. Nothing is deleted; the files stay exactly where they were.

Capture that does not depend on the model. Instructions are a request, and a host that declares its own memory in its system prompt outranks anything a tool says. So `compartment integrate clau