mrkeyoor.com_
Fri 18 Sept 02:55 UTC
AI Toolsevaluationupdated 26 Aug 2026

agentmemory review

agentmemory is a local memory service for coding agents, with MCP, hooks, skills, a viewer, and APIs for saving and recalling work across sessions. It supports Claude Code, Codex, Cursor, and other clients, while storing persistent state through a bundled iii engine.

+208stars / 7d
Verdict

Our agentmemory run passed build and tests, but its 299-package install used 1,235 MB and npm audit reported 14 known vulnerabilities, including 6 high-severity findings. Try it when cross-session coding context is painful enough to justify a resident service, then restrict capture and inspect recalled records before trusting them. Skip it for sensitive repositories until you have a data-retention policy, dependency remediation plan, and proof that your worktree and multi-instance setup behaves correctly.

We ran it

Lab card: what happened when we ran agentmemoryScreenshot of agentmemory (agent-memory.dev)
Install✓ · 115s299 packages · 1235 MB
Build✓ · 17s
Tests✓ · 31sran, no count parsed
Known vulns140 critical · 6 high · 8 moderate · 0 low (npm audit)
Repo656 files~89,246 lines of source · 35.6 MB · 2 CI workflows · tests dir

Answers from our run

Does agentmemory build from source?

Dependencies installed in 115 seconds (299 packages), and the build succeeded in 17 seconds. We cloned commit 2d38daf into a clean Debian container with 3 CPUs and no project-specific setup.

Do agentmemory's tests pass?

The test command failed in our container, and its output did not report a pass or fail count.

Does agentmemory have known vulnerabilities in its dependencies?

npm audit flagged 14 known advisories in the dependency tree at the time of our run.

Who should not use agentmemory?

Users who cannot allow coding-session data into a persistent local store: hooks can capture prompts, tool use, summaries, and project paths.

What are the alternatives to agentmemory?

Mem0, Letta, Graphiti. Our agentmemory run passed build and tests, but its 299-package install used 1,235 MB and npm audit reported 14 known vulnerabilities, including 6 high-severity findings.

Setup3/5Tests pass, but 1,235 MB and four local ports add weight
Docs5/5Install, agents, ports, storage, providers, and Windows are covered
Community4/527,493 stars and active issue work on August 26, 2026
Maturity3/5v0.9.29 is capable, with audit and state-management concerns

Who it’s for

Developers who repeatedly explain the same repository decisions to coding agents.
People using several MCP-capable agents who want one shared local memory store.
Claude Code and Codex users willing to inspect hook capture and tune what enters memory.
Teams comfortable operating a four-port local service and backing up its state directory.

Who it’s NOT for

Users who cannot allow coding-session data into a persistent local store: hooks can capture prompts, tool use, summaries, and project paths.
Codex users who depend heavily on temporary worktrees: issue 515 reports that worktree paths can split one repository's memories into separate projects.
Claude Code users who cannot tolerate recall pollution: issue 993 says memory tool calls can be captured as new observations and then returned later.
Operators needing multiple daemons on one host without manual workarounds: issue 1245 reports that v0.9.29 ignores documented instance ports in generated engine config.
Paid-LLM users unwilling to audit background calls: issue 1244 reports repeated summarization of already summarized sessions and excess API use.
Security-sensitive teams that require a clean dependency audit before trial: our npm audit found 14 known vulnerabilities, including 6 high-severity findings.

Setup reality

Our sandbox install succeeded in 115 seconds, adding 299 packages and using 1,235 MB on disk. The build passed in 17 seconds, and the tests passed in 31 seconds. Npm audit found 14 known vulnerabilities: 6 high and 8 moderate, with none critical or low.

The first-run CLI configures agent adapters, starts the pinned iii engine, chooses keyless or model-backed features, and may install a global command. The local runtime uses 4 ports and persistent state outside the repository. Local vector search downloads a model on first use; hosted embeddings or LLM features require provider keys.

Node.js 20 or newer is required. Automatic engine installation on macOS and Linux also needs curl, a POSIX shell, and tar; native Windows needs a manually installed pinned engine binary, WSL2, or Docker Desktop. Back up the resolved data directory and review every enabled hook before letting it observe private repositories.

One local service remembers work across coding agents

agentmemory captures coding sessions, turns selected material into persistent records, and lets later sessions search or receive that context. MCP gives compatible clients a shared interface, while hooks and skills add deeper behavior for tools such as Claude Code, Codex, and Cursor. The service can run without an LLM key using keyword search. Local embeddings add semantic retrieval after a model download, and hosted providers can supply embeddings or summarization. A viewer exposes the stored sessions and records.

This is a larger installation than the words "local memory" suggest. Our checkout at commit 2d38daf contained 656 files, about 89,246 source lines, and 35.6 MB. The npm install added 299 packages and ended at 1,235 MB on disk. The repository has a tests directory, 2 CI workflow files, and a compose file, but no Dockerfile. The runtime also starts a pinned iii engine rather than storing everything inside the Node process alone.

Four ports and one data directory define the local service

The README assigns REST and MCP HTTP, streams, the viewer, and the iii worker WebSocket to 4 local ports. State lives in a platform-specific directory outside the current repository unless a flag or environment variable overrides it. That separation is helpful because memories survive project cleanup. It also makes backup, deletion, access control, and multi-instance naming explicit operator jobs. Reusing the same data directory on restart is required for persistence.

Fresh setup needs Node.js 20 or newer. On macOS and Linux, automatic engine installation also expects curl, a POSIX shell, and tar. Native Windows uses a manually installed pinned iii binary, WSL2, or Docker Desktop. Our build completed in 17 seconds after the 115-second install. That result did not exercise the first local embedding model download, a hosted provider, agent hook registration, or recovery from a damaged state directory.

What happened when we ran it

We ran commit 2d38daf in an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22, and no secrets. Installation succeeded in 115 seconds. The build passed in 17 seconds, and the available tests passed in 31 seconds. The clean result covers the repository commands we ran, not retrieval quality or memory usefulness across real coding sessions.

Npm audit reported 14 known vulnerabilities in the installed dependency tree: 6 high and 8 moderate, with 0 critical and 0 low. The final dependency footprint was 1,235 MB for 299 packages. Those findings should block an automatic rollout into sensitive repositories. Review the affected dependency paths, decide which are reachable in the deployed configuration, and record an upgrade or mitigation before enabling hooks that observe private code and prompts.

Capture can preserve noise as well as decisions

The useful promise is continuity: an agent can recall project decisions without loading a huge static instruction file. That depends on project identity and capture hygiene. Issue 515 reports that Codex worktree paths can be treated as separate projects, fragmenting context that belongs to one repository. Issue 993 describes Claude Code hooks recording agentmemory's own MCP searches as observations, creating records that can appear in later recall. Both faults can make missing or noisy context look like a retrieval-quality problem.

A passing 31-second test run does not tell you what the store contains after a month. Inspect the viewer, query for known decisions, and check whether deleted or corrected facts still surface. Start with a disposable repository and a separate data directory. Enable only the adapters and hooks you need. If an agent will receive recalled content automatically, treat that content as untrusted project data rather than instructions with authority.

Background processing and graph storage need limits

Issue 1244 reports that v0.9.29 repeatedly summarized sessions that already had summaries, generating far more model calls than new material justified. Issue 1238 says setting GRAPH_EXTRACTION_ENABLED=false still allowed structural graph writes, contrary to what the reporter expected from the flag. These reports are configuration-specific, but they identify costs that are easy to miss because the agent can keep working while memory processing happens in the background.

GitHub recorded the last repository push on August 24, 2026, and release v0.9.29 on August 16. The project had 27,493 stars and 505 combined issues and pull requests when fetched. Active work continued on August 26, including fixes around state, providers, and graph statistics. The 17-second build and 31-second tests make a sandbox trial reasonable. The 14 audit findings, four-port service, and open state-management reports make a cautious, observable rollout the right next step.

Alternatives

ProjectWhat it isPick it when
Mem0 gh↗A general memory layer for agents with hosted and self-managed paths.pick this instead when memory must serve products beyond coding agents and its API model fits your stack.
LettaA stateful agent platform where memory is part of the agent runtime.pick this instead when you want to run the agent and its memory together rather than attach memory to existing coding clients.
Graphiti gh↗A temporal knowledge-graph framework for agent memory and changing facts.pick this instead when a knowledge graph and time-aware retrieval matter more than coding-agent hooks and skills.

What people are saying

  1. [github-trending] rohitg00/agentmemory

Sources

  1. agentmemory repository and README
  2. agentmemory v0.9.29 release
  3. Issue 515: Codex worktree project fragmentation
  4. Issue 993: memory calls captured as observations
  5. Issue 1244: repeated session summarization
  6. Issue 1245: multi-instance port configuration
  7. Issue 1238: graph extraction setting

More ai tools reviews

OpenBitFun · rowboat · skills · superpowers-zh · yolov5 · eve · the whole board →