Compartment: Encrypted Local AI Agent Memory That Never Leaves Your Machine

Most agent memory tools ask for a leap of faith: send your conversation history to someone else's server, trust their retention policy, hope the embeddings of your private decisions stay private. Compartment is an encrypted local AI agent memory tool built for the opposite instinct. It stores an agent's long-term memory as AEAD-encrypted vectors in a single file on disk, runs entirely offline with a runtime guard that aborts on any network call, and gives Claude Code, Claude Desktop, Hermes, OpenClaw, or any MCP-capable client the same persistent recall without a cloud account anywhere in the chain.

What Compartment actually does

Compartment is a Python package (pip install compartment && compartment init, or a bundled .pkg installer on macOS) that runs a local MCP server plus a menu bar or system tray app. Once wired to an agent, it stores what the agent decides is worth remembering: decisions, preferences, machine and configuration details, tagged into a graph rather than a flat log. memory_link records explicit relations between entities, memory_relations answers queries about who did what and when, and everything supports validity windows so a fact that was once true doesn't quietly override one that replaced it.

The retrieval side is a hybrid of semantic and keyword search, claimed at roughly 11.6 milliseconds per query and a p95 of 0.68 milliseconds for vector search over 20,000 records, with peak memory reported at 319 MB on an 8 GB laptop. Those are the maker's own benchmark numbers rather than independently verified figures, but the test suite (566 tests, covering crypto, tamper detection, crash recovery, and offline enforcement) ships in the repository, so they can be rerun rather than taken on faith.

AEAD encryption, in plain terms

The scan flagged this project for its "AEAD-encrypted embeddings," and it's worth being precise about what that buys a reader. AEAD, authenticated encryption with associated data, is encryption that also authenticates: it doesn't just scramble the content, it detects if a single bit of the ciphertext was altered after the fact. Compartment uses XChaCha20-Poly1305 for this, via the well-established libsodium library rather than a custom cipher the maintainer wrote. Keys are derived with Argon2id, an intentionally slow, memory-hard hashing function designed to resist brute-force guessing of a passphrase. Every embedding vector gets this same treatment, not just the raw text, which matters because vector embeddings can be partially reversed back toward the original content if left in plaintext.

Deletion is cryptographic rather than a soft flag: forget --shred destroys the per-record key, and the content becomes unrecoverable from that vault going forward. There's a real tradeoff attached to this design worth stating plainly. There is no password recovery. The passphrase (plus an optional keyfile for two-factor unlock) is the only credential, and losing it makes the vault permanently unreadable by design, not by bug.

The local dashboard and memory map

The GUI the scan referenced is compartment dash, a one-command local dashboard bound to 127.0.0.1, gated by a random one-time token, and read-only. It opens a browser page showing memories by kind, growth over time, tags, per-agent counts, live search, and a relation graph, the closest thing here to a visual memory map, rendering the links between stored entities rather than a flat list. No open ports beyond that local bind, and the maker states zero telemetry throughout.

Setup and agent integration

For Claude, compartment integrate claude wires both Claude Code and Claude Desktop. For Hermes, compartment integrate hermes installs a provider plugin that shows up in Hermes's own memory picker as the only option marked "no setup needed," alongside alternatives like mem0 that do require a cloud account. OpenClaw and any other MCP-capable client connect over the same stdio transport, using the standard memory_search, memory_store, and memory_forget tools. A vault can also be shared across multiple hosts at once, with each caller getting its own namespace permissions rather than blanket access to everything stored.

Where it fits next to deja-vu and HUMAN.md

AIOS Guide has covered two other approaches to agent memory that are worth distinguishing from this one, since all three solve "the agent forgets everything" in genuinely different ways. deja-vu indexes the raw session logs an agent already writes to disk and searches them lexically, with no embeddings and no encryption layer, built for developers re-finding a past coding fix. A HUMAN.md-style file is a single hand-written context document an agent reads fresh each session, authored once by the user. Compartment is neither: it's a live, continuously updated, embeddings-based semantic memory store that the agent writes to and queries automatically, encrypted at rest by default. The three aren't competitors so much as different layers, and nothing stops someone from running more than one at once.

License and other honest limits

The scan's note to check the license before client-facing use turned out to be worth following, if only to rule it out. The repository ships an unmodified Apache License 2.0, both in the LICENSE file and in pyproject.toml. There's no Commons Clause, no non-commercial carve-out, and no additional restriction layered on top of the standard text. Apache 2.0 is one of the more permissive open source licenses available: it allows commercial use, modification, and redistribution, including inside a client-facing product, and it comes with an explicit patent grant. The only real catch is the standard one attached to almost all open source software, an "as is" warranty disclaimer, meaning nobody is on the hook if something breaks.

The bigger caution is age, not licensing. The repository was created on 2026-07-20, has one visible maintainer, and while it uses established cryptographic primitives rather than homemade ones, it does not currently show a third-party security audit. For anyone considering it for client work involving genuinely sensitive data, that's worth weighing independently of the license being clear. It's also worth knowing the seeded starter pack of roughly 6,700 general reference facts, some of it drawn from an external dataset, installs by default but is fully editable and deletable like anything else in the vault.

The verified numbers

As of today, the Compartment GitHub repository shows 674 stars and 3 forks, up from the 599 stars at the scan's last snapshot, and it's climbing fast enough to justify the "rising" flag. It's a legitimate pick for anyone who has been avoiding cloud-based agent memory tools specifically because the memory itself, not just the chat transcript, would otherwise sit on someone else's server by default.