mrkeyoor.com_
Tue 03 Nov 07:15 UTC
AI Toolsevaluationupdated 24 Oct 2026

agentmemory review

agentmemory is a persistent memory service for coding agents. Its README documents shared access through client integrations, hooks, MCP and a REST API, plus a viewer for recorded sessions. Our recorded source-checkout run verified dependency setup, a build and a test command, not working recall across those clients.

+115stars / 7d
Verdict

agentmemory is worth a controlled evaluation when several coding clients need shared history and you can manage a persistent local service. Our September 27, 2026 run at bcf4f0d completed dependency setup, build and the test command; it did not verify installed-CLI behavior or useful recall. The 11 recorded audit advisories describe that dependency snapshot, not a current security assessment. Start with a disposable repository and verify capture, scoping, restart persistence and deletion through your actual client before committing private history.

We ran it

Lab card: what happened when we ran agentmemoryScreenshot of agentmemory (agent-memory.dev)
Install✓ · 96s294 packages · 1193 MB
Build✓ · 15s
Tests✓ · 27s1812 passed · 0 failed · 1 skipped of 1813 (vitest)
Known vulns110 critical · 2 high · 9 moderate · 0 low (npm audit)
Repo684 files~94,430 lines of source · 35.8 MB · 2 CI workflows · tests dir

Answers from our run

Does agentmemory build from source?

Dependencies installed in 96 seconds (294 packages), and the build succeeded in 15 seconds. We cloned commit bcf4f0d into a clean Debian container with 3 CPUs and no project-specific setup.

Do agentmemory's tests pass?

Yes. The project's own test command finished in 27 seconds and reported 1812 passed, 0 failed, 1 skipped (vitest).

Does agentmemory have known vulnerabilities in its dependencies?

npm audit flagged 11 known advisories in the dependency tree at the time of our run.

Who should not use agentmemory?

People who only need a small, manually maintained context file and do not want another service.

What are the alternatives to agentmemory?

Mem0, Letta. agentmemory is worth a controlled evaluation when several coding clients need shared history and you can manage a persistent local service.

Setup3/5Source dependency setup and build succeeded in the September 27 run; the 1,193 MB recorded install, four documented ports and unverified first launch leave operational checks.
Docs4/5The supplied README explicitly covers prerequisites, keyless versus semantic recall, compression opt-in, state-path precedence and restart validation. Integration correctness was not verified.
Community2/5Supplied issue exchanges show reporter and maintainer participation, but do not establish adoption, response-time consistency or a current community-size measurement.
Maturity3/5The recorded build and test command succeeded, and historical issues have maintainer follow-up. Current audit status, installed-runtime behavior, retrieval workloads and recovery remain unverified.

Who it’s for

Developers evaluating shared memory across coding clients such as Claude Code, Codex and Cursor.
Self-hosters willing to operate a local service and manage its persistent state.
People prepared to verify capture, project scoping, recall and deletion in a disposable repository before using private work.

Who it’s NOT for

People who only need a small, manually maintained context file and do not want another service.
Teams that cannot retain prompts or tool activity without first checking capture and retention behavior.
Operators who require independently verified client compatibility, retrieval quality or recovery behavior: our recorded run did not establish these.
Teams requiring a clean current dependency audit: the September 27, 2026 run recorded 11 advisories, and no newer audit is supplied.
Native Windows users unwilling to perform the README's manual pinned-engine installation or use its WSL2 or Docker Desktop routes.

Setup reality

In our recorded run on September 27, 2026 at commit bcf4f0d, dependency setup completed in 96 seconds after an initial npm ci error about the required lockfile. The subsequent install output says "added 267 packages"; the stored dependency metric is 294. These are different recorded counts, so neither establishes that the CLI was installed. Recorded install size was 1,193 MB.

The build step succeeded in 15 seconds. The test step succeeded in 27 seconds, with a recorded Vitest summary of 1,812 passed, 0 failed and 1 skipped out of 1,813. These are reported counts, not independently reconciled exhaustive unique coverage. The local-embedding smoke test was skipped. Npm audit recorded 11 advisories: 2 high and 9 moderate. Audit coverage is unknown; the record does not establish an audited-package count or production exposure.

The README requires Node.js 20 or newer with npm and npx. It documents an interactive first launch, iii-engine v0.22.1 and four default ports: 3111, 3112, 3113 and 49134. Automatic engine installation on macOS/Linux also needs curl, a POSIX shell and tar. Our run does not establish an installed CLI, a downloaded engine or embedding model, a healthy running service, or successful client capture and recall.

Keyless memory_recall uses BM25; memory_smart_search can also use existing structural graph data. Local semantic recall requires EMBEDDING_PROVIDER=local, a restart and an initial model download. LLM-written observation compression requires both a provider and AGENTMEMORY_AUTO_COMPRESS=true. State normally lives outside the repository, but legacy ./data state can take precedence for instance 0; an explicit data-directory setting overrides that discovery.

Shared coding-agent memory comes with a service to operate

agentmemory is aimed at developers who want coding context to survive sessions and client changes. The README describes one memory server shared through hooks, MCP and REST, with a viewer for session inspection. The decision is whether that shared store is useful enough to justify operating and checking another persistent service.

Our recorded run supports a narrower conclusion than the README's product promises: the source checkout completed dependency setup, built successfully and returned a successful test-command result. We did not measure retrieval quality, cross-client continuity, provider costs or long-running workloads.

What our September 27 run established

The recorded run started on September 27, 2026 at commit bcf4f0d00d1c71e9221287a4778e4122ce2d7574. Its configuration lists 3 CPUs, 8 GB of memory and image lab-node:22. That image label does not establish the actual Node runtime version.

Dependency setup completed in 96 seconds with exit code 0, but its output first records npm ci failing because it required a suitable lockfile. Later output says "added 267 packages". The stored dependency metric is 294, and the recorded install size is 1,193 MB. We retain both counts with their labels rather than describing 294 as packages added. Successful dependency setup does not establish that the published CLI was installed or launched.

The build step completed successfully in 15 seconds. The test step completed successfully in 27 seconds. Its Vitest summary reported 1,812 passed, 0 failed and 1 skipped out of 1,813, with 170 test files passed and 1 skipped. The local-embedding smoke test was skipped. These are recorded summary counts: no new execution or complete-log reconciliation established exhaustive unique test coverage. The runner's 27-second step time also differs from Vitest's own reported duration of 19.78 seconds.

Npm audit recorded 11 advisories: 2 high and 9 moderate, with 0 critical and 0 low. The audited-package coverage is unknown. The record does not identify production reachability or establish the dependency state of a newer release, so these counts cannot support a current safety verdict.

The checkout metrics were 684 files, approximately 94,430 source lines and 35.8 MB. The record also identified two CI workflows, a tests directory and a compose file, with no Dockerfile. Those inventory facts do not verify a deployment path.

What first launch still needs to prove

The README requires Node.js 20 or newer with npm and npx. It describes interactive setup that selects integrations and a provider or keyless mode, starts the memory server and pinned iii-engine v0.22.1, and offers a global installation. Our source-checkout checks did not independently verify those first-launch steps, an installed-binary check, engine download or a running daemon.

The documented default ports are 3111 for REST/MCP HTTP, 3112 for iii streams, 3113 for the viewer and 49134 for the worker WebSocket. Automatic engine installation on macOS/Linux requires curl, a POSIX shell and tar. Native Windows requires manual installation of the pinned engine; the README also describes WSL2 and Docker Desktop routes.

Keyless mode disables vector embeddings. The README says memory_recall uses BM25, while memory_smart_search can also use structural graph matches when graph data exists. Local semantic recall requires EMBEDDING_PROVIDER=local and a restart; the first embedding request downloads Xenova/all-MiniLM-L6-v2. A configured LLM provider alone does not enable observation compression: AGENTMEMORY_AUTO_COMPRESS=true is also required. None of these modes received a measured retrieval workload in our run.

State normally lives in a platform-specific directory outside the repository. There is an important exception: existing ./data/state_store.db or ./data/iii-config.yaml takes precedence over the platform default for instance 0. An explicit --data-dir or AGENTMEMORY_DATA_DIR setting wins over legacy discovery. Resolve that location before planning backups or assuming that deleting a checkout removes its history.

Historical reports need version boundaries

The supplied issue pages provide reasons to test specific behavior, but they do not establish that every reported defect remains present.

Issue 911 reported secrets being preserved verbatim by the remember skill. It is now closed; on October 8, 2026, the maintainer said v0.9.30 scrubs write inputs and other stored text. That is a maintainer's fix statement, not a security result from our September run. Review capture and stored records using synthetic data before retaining private work.

Issue 1432 concerned a custom container running the v0.9.29 CLI with iii-engine v0.11.2. The reporter explicitly did not test the published engine image. The issue therefore does not establish that the supplied compose deployment was broken. The maintainer closed it on October 5, saying the fix would ship in 0.9.30, that compose already selected the Docker engine configuration, and that custom CLI containers should set AGENTMEMORY_III_CONFIG to the appropriate configuration file. Verify host-side health and restart persistence for the deployment you actually choose.

The September run predates those October statements. Its successful checks neither reproduce the historical reports nor verify the later fixes. The supplied v0.9.29 release page is a historical release reference, not evidence that v0.9.29 remains the latest release.

How to decide after a small trial

Use a disposable repository and an explicit data directory. Confirm that your client captures an event, saves a synthetic memory and recalls it in a fresh session. Check separation between two projects, then restart the service with the same directory and verify persistence. Finally, delete the trial data and check the result. These are recommended acceptance checks, not tests we performed.

Choose Mem0 when you are integrating a memory layer into an application: its own README documents SDK, self-hosted and managed routes. Choose Letta when you want the agent harness and runtime to own persistent memory; its repository now points active development to letta-ai/letta-code. Neither alternative was installed or benchmarked in our run, and neither is established here as a drop-in capture replacement.

How the ratings work

The scores are editorial judgments on a 1-to-5 evidence scale: 1 means substantial documented barriers, 2 means limited support for confidence, 3 means a workable basis with material checks outstanding, 4 means strong documented support within the stated scope, and 5 requires broad corroboration across that category. Unknown adoption or compatibility earns no positive evidence.

Setup ease is 3 because source setup and build completed, while first launch, four-port operation and persistent-state management remain separate work. Documentation is 4 for explicit requirements, search-mode distinctions, state-path precedence and validation steps; that rates the supplied documentation, not every integration's correctness. Community is 2 because the supplied issue exchanges show participation but do not establish response-time consistency or adoption. Maturity is 3 because successful repository checks and maintainer follow-up support a trial, while current audit status, workload behavior and recovery remain unverified.

Proceed when shared coding history solves a concrete problem in that trial. Keep the service's captured history, storage location and deletion behavior visible before expanding its use.

Alternatives

ProjectWhat it isPick it when
Mem0 gh↗A memory layer with SDKs, a self-hosted server and a managed service.Choose it when you are adding memory to an application through an SDK or API. Its README describes library, self-hosted and cloud routes; this is an architectural alternative, not a verified drop-in replacement for agentmemory's capture integrations.
LettaA system for stateful agents with memory, with current development in letta-ai/letta-code.Choose it when you want an agent harness and runtime with memory. The supplied repository page directs active projects to letta-ai/letta-code and identifies the archived V1 API server as historical.

What people are saying

  1. [github-trending] rohitg00/agentmemory

Sources

  1. agentmemory repository and README
  2. agentmemory v0.9.29 release
  3. Issue 911: remember skill stores secrets verbatim
  4. Issue 926: MCP project parameter is dropped
  5. Issue 1124: smart search worker failure
  6. Issue 1372: semantic index persistence limit
  7. Issue 1432: containerized CLI network binding

More ai tools reviews

kornia · skills · anarlog · pr-agent · agent-sprite-forge · KiroCrew · the whole board →