Compartment: an offline encrypted memory vault for MCP agents
Encrypted, fully offline agentic memory. One click install, GUI w/ memory map, all OS and agents. Superior memory creation, storage and retrieval.
At a glance
- What is it?
- Compartment stores what an agent learns in a single encrypted file on your machine and serves it back to any MCP client over a hybrid vector and keyword index. The design is opinionated about what a memory is, and that opinion is the main thing to evaluate before adopting it.
- Who is it for?
- Compartment fits engineers who run several MCP clients on one machine and want recall to survive across them without a hosted account or an LLM key in the loop. It is the wrong tool if you need graph-shaped memory, if your agents write long structured notes, or if you cannot accept that the embedding model, the vault and the index all live on one host.
- Can I use it commercially?
- Yes. Apache-2.0 is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 5 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem Compartment is aimed at: memory that dies with the session
Most agent setups forget. A session ends, the context window is discarded, and the next session starts from nothing. The workarounds are familiar: paste notes into a system prompt, keep a scratch file the agent reads at the start, or send everything to a hosted memory service. Each has a cost. Prompt stuffing does not scale and is not searchable. Scratch files are plaintext and unversioned. Hosted services mean an account, an API key, and your notes leaving the machine.
Compartment targets the third option's convenience without the network. The README describes it as persistent memory stored on your own computer, where what an agent learns in one session is available in every later session, in every project, to every agent on the machine, and nothing leaves the machine. The intended user is someone running more than one MCP client on a single box: Claude Code, Claude Desktop, Hermes Agent, OpenClaw, Cursor, Codex, and any other MCP client. The pitch is not better reasoning. It is that the same fact, learned once, is reachable from all of them.
The repository is Python, licensed Apache-2.0, and distributed on PyPI as compartment. The latest release listed is v4.9.6, dated 2026-09-06, with v4.9.5 and v4.9.4 landing in the days before it. That cadence tells you the project is moving quickly, which cuts both ways for anyone pinning a version.
One claim per memory, and why the store rejects your agent's notes
The most consequential design decision is that a memory is a single claim. The store rejects anything longer than 200 characters, controlled by a setting called max_memory_chars, and it rejects anything containing lists, headings or paragraphs. The error message is supposed to tell the agent how to split the content.
The README is unusually candid about why this rule exists. Instructions alone did not work: on a real vault, the median memory written by an agent was 1,938 characters of bulleted session notes. So the constraint is enforced at the storage layer rather than requested in a prompt. If you have used a memory tool that slowly fills with pasted transcripts, this is the failure mode Compartment is built to prevent.
The trade-off is real. Agents that naturally produce structured output will now hit an error path and have to retry with split content. Whether that retry is reliable depends on the client, and the README does not describe what happens when an agent fails to reformat. If your workflow depends on storing a multi-step procedure as one retrievable unit, you will be storing it as several claims and hoping recall reassembles them. That is a different guarantee than a document store gives you.
Importance is assigned by fixed tiers rather than inferred: decisions and consent at 0.90, personal facts and preferences at 0.80, the user's machine and configuration at 0.75, other substantive statements at 0.55, small talk at 0.20. The README states that importance multiplies a match score rather than adding to it, so it can break near-ties but cannot surface a memory that did not match the query. That is the right choice, and it is worth noting because additive scoring is a common way for memory systems to return confident nonsense.
Hybrid recall, in-memory index, and the expiry field
Recall is a hybrid of vector and keyword search over an in-memory index, and the README claims answers in about 12 ms. Treat that number as a claim from the project rather than a measured result; the index lives in RAM, so the figure will depend on vault size and machine. The embedding model ships inside the package, which removes the usual setup step of pointing at a provider.
Memory lifecycle is handled by an expires field. Set it and the memory is removed after that date. Separately, when a preference changes, the new memory replaces the old one, so the vault does not accumulate contradictory preferences. The README also states that almost everything is stored: only empty turns are dropped, and a bare acknowledgement is kept together with the question it answered, on the reasoning that a one-word reply to a yes or no question is a decision. Small talk is retained but ranked last by the importance tier.
The release notes for v4.9.6 mention one embedding model per machine and an encoder that gives its memory back, which suggests the model lifecycle has been a source of resource pressure. A new vault also arrives with roughly 6,700 reference facts covering hardware, operating systems, ports, encodings and shell tools. The README is explicit that these are ordinary memories and that one switch removes them from search, so if the default seed set pollutes your recall you can turn it off rather than deleting rows.
Getting it running: init, integrate, and the one-click deeplinks
The documented path starts with two commands: pip install compartment, then compartment init. After that, clients that have a deeplink can be wired from the README's install buttons for Cursor, VS Code, VS Code Insiders, LM Studio, goose and Kiro. The underlying MCP configuration is the same shape in each case, a command of compartment with arguments that name the caller and the serve subcommand, for example compartment --caller cursor serve. Naming the caller is how the server knows which client it is talking to.
For Claude Code, Claude Desktop, Hermes Agent and OpenClaw, the README gives a single integration command instead: compartment integrate claude, hermes or openclaw. That is the shortest path if one of those is your client.
Two details in the install material are worth reading closely. First, the one-click buttons are described as available after pip install compartment && compartment init, so they are a convenience layer over a Python install, not a replacement for it. Second, the deeplinks encode a command and argument list, which means the client will launch the compartment binary from its own environment. If your client runs in a different shell or virtualenv than the one where you installed the package, that path resolution is the first thing to check when the server does not appear.
The README's headline privacy claim is no API key, no account, no network, no telemetry, and it says the no-network property is CI-enforced. A CI check is a stronger statement than a promise, because it fails a build rather than relying on review. It is still a claim about the project's own pipeline, not something you can verify from the README alone.
What encryption covers, and what the README does not say
The README states that everything on disk is encrypted, including the embedding vectors, and that only your passphrase opens it. That the vectors are encrypted is the distinguishing detail, because vectors are invertible enough in practice that leaving them in plaintext weakens the rest of the scheme. The comparison table in the README lists Compartment as encrypted with vectors too, against several alternatives marked not documented.
The README does not specify the cipher, the key derivation function, or how the passphrase is entered at server start. It also does not describe what happens if you forget the passphrase, whether there is any recovery path, or how the vault behaves when two MCP clients write at the same time. Those are the questions to answer before you put anything you care about into it. The repository links to docs/COMPARISON.md for the full table, and the README invites corrections as a pull request against that file, so the comparison is maintained as a document rather than as marketing copy.
One structural point matters for backup. The README describes memory at rest as one encrypted file with the index in RAM. A single file is easy to copy, but it is also a single point of loss, and because the index is rebuilt in memory rather than persisted, restore means restoring that file and reopening it with the passphrase. There is no documented export format in the material provided.
Where Compartment is the wrong tool
If you need relationships between facts, Compartment is not that. The comparison table places it against Graphiti, which uses Neo4j, and Letta, which uses a server and database. Those systems model entities and edges, and the difference is architectural rather than a matter of features. Compartment stores claims in one encrypted file; a graph store lets you ask how two things connect. The release notes for v4.9.4 mention that the graph names everyone, which suggests some graph-shaped view exists in the GUI, but the README describes storage as claims plus a hybrid index, not as a graph database. Do not adopt it expecting traversal queries.
A second boundary is the 200-character rule. If your agents produce long structured notes and you cannot change that, every write becomes a reformatting round trip, and the README does not document the failure behaviour when reformatting does not happen. A Markdown plus SQLite tool such as basic-memory, which the comparison table lists under AGPL, takes the opposite approach: the notes stay as documents, and search sits on top. If your memory is really a knowledge base, that model fits better, at the cost of a different licence and, per the table, telemetry on by default.
A third boundary is single-machine scope. Nothing in the README describes syncing a vault across machines or sharing one between people. If your agents run on a server fleet or your team needs a common memory, the local-file design is a mismatch, and the hosted options in the comparison table exist precisely because that is a common requirement.
Maintenance cost and the licence position
Compartment is Apache-2.0, which is a permissive licence that allows commercial use and modification, and it is not a copyleft licence. The comparison table flags basic-memory as AGPL, which is a materially different obligation if you plan to redistribute a modified version or offer it as a service. That is a factual difference between the licences; it is not legal advice, and if redistribution is part of your plan, read the Apache-2.0 text and the AGPL text rather than this summary.
Upgrade cost is the more practical concern. Releases v4.9.4 through v4.9.6 landed within four days of each other, and the v4.9.6 notes describe a change to how embedding models are handled per machine, with an encoder that releases memory. A change to the embedding model is the kind of upgrade that can invalidate a previously built index, and the README does not state whether an existing vault is re-encoded automatically on upgrade or whether recall degrades until it is rebuilt. Pin a version, keep a copy of the vault file before upgrading, and check that recall still returns the same memories afterwards. The README also notes that the importance tiers are fixed values in code, so if your notion of what matters differs from the published tiers, you are editing the project rather than configuring it.
Editorial conclusion
Compartment fits engineers who run several MCP clients on one machine and want recall to survive across them without a hosted account or an LLM key in the loop. It is the wrong tool if you need graph-shaped memory, if your agents write long structured notes, or if you cannot accept that the embedding model, the vault and the index all live on one host. Before adopting it, run compartment init on a scratch directory, write a few memories through your client, and confirm two things for yourself: that recall still works after you stop and restart the server, and that the passphrase prompt behaves the way your workflow needs. Those two checks decide whether the rest of the design matters to you.
Community notes