Compartment

What it does

Compartment keeps an assistant's memories in a single encrypted vault file on your own machine and serves it over stdio to any MCP client, so Claude Code, Cursor, Codex and others read and write the same store. Everything in the vault is encrypted with XChaCha20-Poly1305, embedding vectors included, under a key derived from a passphrase you choose; nothing is sent over the network and there is no account or API key. Search combines a bundled local embedding model with keyword matching, and memories can be tagged, linked into an entity graph, given an expiry date, or replaced when an opinion changes.

The store is opinionated about what a memory is: each record must be a single claim of at most 200 characters (the max_memory_chars setting) and must name its source, and lists or headings are rejected with an error explaining how to split them. memory_store_many writes a batch in one call. Forgetting with shred destroys the record's own key, so the content cannot be recovered from the current vault.

The server exposes 14 tools in version 4.13.0, but memory_unlock refuses to run unless unlock_tool_enabled is set in the vault's config file, so a default install offers 13. If no unlock credential is found at start, the server still starts but every memory tool returns a locked error until you run `compartment unlock` on the machine (src/compartment/server.py). A desktop panel (menu bar on macOS, tray on Windows, a window on Linux) and a read-only browser dashboard on 127.0.0.1 come with the package.

What it needs

Python 3.11 to 3.14 for the pipx (recommended), uv or pip install. Intel Macs stop at Python 3.13 and Windows on ARM needs 3.12 or newer. A system-wide pip install is refused on Debian 12+, Ubuntu 23.04+, Fedora, Arch and Homebrew Python, so use pipx, uv or a virtual environment. A macOS .pkg bundles Python instead. Run `compartment init` once before connecting a client: it asks for a passphrase and creates the vault at ~/.compartment/memory.vault. The vault must be unlocked (`compartment unlock`, the app, or COMPARTMENT_PASSPHRASE) for tools to work. A client started from the Dock or Start menu may not see your PATH, so give it the full path that `which compartment` prints.

Limits

• Size cap Each stored memory is capped at 200 characters and one claim unless max_memory_chars is changed (0 turns the check off)
• Size cap memory_search returns 8 results by default (top_k), memory_recent 20 by default, memory_relations at most 500 by default (limit)
• Limit The vault locks after 30 idle minutes by default (auto_lock_minutes, 0 turns it off) and at each reboot unless the macOS Keychain option is chosen
• Limit No recovery: losing the passphrase (and the 2FA keyfile, if enrolled) leaves the vault permanently unreadable
• Not covered The --caller name that scopes namespace grants is self-declared, so a client can claim another client's name
• Platform Pip wheels cover macOS 13.4+, Windows 10/11 and glibc 2.28+ Linux; Alpine, FreeBSD and Termux need the system's onnxruntime
• Limit No Docker image is published; the image is built from a checkout

Each authored memory is capped at 200 characters and one claim unless max_memory_chars is changed (0 turns the check off). memory_search returns 8 results by default (top_k); memory_recent 20 by default; memory_relations at most 500 relations by default. The vault locks after 30 idle minutes by default and always on reboot, unless macOS Keychain unlock is opted into. There is no recovery: losing the passphrase (and the 2FA keyfile, if enrolled) makes the vault permanently unreadable. The --caller identity that scopes namespace grants is self-declared, so a client can claim another's name. The Docker image is built from a checkout; none is published.

Who it suits

Suits a developer who wants one private memory shared across several local coding assistants, and who is willing to manage a passphrase and unlock the vault after each reboot. Because everything runs and stays on one machine, it fits offline or privacy-sensitive setups. It is a poor fit for a team that needs a shared memory across machines through a hosted service, or for anyone who wants long free-form notes or documents stored as single entries, since records are limited to short single claims.