GBrain stores agent memory as Markdown plus a database index
GBrain keeps knowledge in ordinary Markdown inside a Git repository, then indexes it into PGLite or Postgres for retrieval. Agents can write memories, search pages, follow typed graph relationships, synthesize an answer with citations, and report gaps in the stored material. The file repository remains the system of record, while the database supplies faster lookup and derived structure. That arrangement makes export and inspection easier than a memory service that hides everything behind an API.
The project is much larger than the phrase "memory layer" suggests. Our checkout contained 4,290 files, roughly 812,029 lines of source, and 110.4 MB. It includes CLI commands, an MCP server, OAuth, retrieval modes, two database engines, jobs, schema mutation, importers, agent skills, hooks, evaluation tools, and background maintenance. Adopting all of it means adopting a platform.
Local PGLite and shared Postgres serve different trust models
A personal installation can use PGLite, a Postgres-compatible database embedded through WebAssembly. Keyword search works without provider credentials. Adding an embedding or extraction provider enables semantic retrieval and automatic facts, with documented choices that include hosted APIs and local model servers. Markdown remains readable even if the index needs rebuilding.
Shared deployments use Postgres plus pgvector and can expose GBrain over HTTP MCP. OAuth clients receive read, write, or admin scopes, and sources can restrict which parts of a brain each caller sees. The README says PGLite is aimed at personal brains and Postgres at shared or larger installations. The 237 MB installed project does not include the operational cost of Postgres, provider calls, object storage, or an always-running agent.
What happened when we ran it
Our sandbox installed commit e5dc5a3 in 50 seconds, adding 300 packages and using 237 MB on disk. The build succeeded in 7 seconds. This ran inside an unprivileged container with 3 CPUs, 8 GB of RAM, Node 22 with Bun, and no secrets. The repository had 7 CI workflow files, no Dockerfile, and a tests directory.
The full test command ran for 869 seconds and exited with code 1. Bun's summary reported 7,152 passed, 0 failed, and 1 skipped, while also showing 7,153 tests across 473 files plus several smaller batches. The supplied log tail contains passing cases and completed batch summaries. It does not reveal why the wrapper returned 1, so blaming a timeout, cleanup hook, or hidden assertion would be guesswork.
The result is close to green in visible test terms but still failed as an executable gate. We did not initialize a brain, connect an MCP client, import private data, call a model, or measure retrieval quality. The 50-second install and 7-second build show that source setup is manageable. They do not validate the security of a shared brain or the relevance of synthesized answers.
Codex and Claude Code are first-class clients with broad permissions
GBrain can install an MCP server and curated skills into Codex or Claude Code. Its full surface exposes more than 100 operations, while a smaller verbs surface limits the agent to a memory protocol. The bootstrap path can create a private GitHub repository, write identity files from an interview, configure hooks, and persist work across sessions. That is convenient and also a lot of authority to grant from one pasted instruction.
Issue #4574 reports a concrete integration failure with Codex CLI 0.149.x: a bootstrap-generated inline bearer_token key makes Codex reject its configuration before any chat opens. The issue says a later harness run can restore the bad block after a manual fix. Test bootstrap in a disposable Codex home, inspect the generated configuration, and verify a fresh session before applying it to a daily environment.
Shared-brain privacy still has a measurable metadata gap
Release v0.46.30.0, published August 25, 2026, added a sweep intended to catch private content leaking through remote operations. Open issue #4592 then showed that scoped callers could receive brain-wide aggregate counts from health and statistics endpoints. By comparing those totals with visible sources, the reporter inferred the count and page type of an excluded source without reading its pages.
That is narrower than exposing page content, but source-level confidentiality promises must include metadata when counts reveal activity. The issue also explains why sentinel-string tests miss numeric leaks. Company deployments should test every remote operation with two clients holding different source grants, then compare structured fields, text, errors, and metadata rather than checking only for a seeded secret string.
Git history helps recovery but does not replace delete semantics
The README presents the brain repository as the durable body: clone it, inspect it, and remove it when the memory should disappear. GBrain also has soft deletion in its database. Issue #4587 reports that deleting a Git file and running sync --repo can hard-delete the row before the documented 72-hour database recovery window finishes. Git history was the reporter's remaining undo path.
Back up both the repository and database before bulk renames or cleanup. Test restore after the same sync command used by automation, not only after a direct delete command. This matters more as the system adds scheduled ingestion and overnight maintenance, because one mistaken file operation can quickly reach the index.
Fast releases reward active operators, not passive adopters
GitHub recorded 29,126 stars, 185 combined issues and pull requests, and a last push on August 26, 2026. Version 0.46.30.0 arrived one day earlier. That pace shows sustained work and quick fixes, while the current privacy, deletion, and Codex configuration reports show why release notes and acceptance tests must be part of operating GBrain.
The product makes the most sense for someone who wants agent memory enough to manage it like a database service. Start with a local, low-value corpus and the smaller MCP verbs surface. Confirm cross-session recall, visibility, deletion, export, and restore before importing email or meetings. Our failed 869-second command is not a reason to dismiss 7,152 passing cases, but it is a reason to withhold a carefree recommendation.