thedotmack/claude-mem
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
How claude-mem is put together
claude-mem is a persistent memory-compression system for AI coding assistants (primarily Claude Code), written in TypeScript and distributed as an npm package plus a Claude Code plugin. It captures tool-use observations via lifecycle hooks, stores them in a local SQLite database (bun:sqlite with FTS5) plus a Chroma vector store, and serves them back through a local 'worker' HTTP service (default 127.0.0.1:37777) with a web viewer UI, an MCP stdio server, and skills/search commands. An alternative 'server' runtime talks to a remote REST API secured by better-auth API keys, backed by Dockerized Postgres+Redis with BullMQ queues, and a Cloudflare Workers 'sync-hub' handles cloud sync. An OpenClaw gateway plugin consumes worker SSE observations and relays them to chat channels (Telegram, Discord, Slack, etc.) behind a circuit breaker.
Languages
Frameworks
Datastores
Infrastructure
Major components
Lifecycle hooks system
Registers SessionStart/UserPromptSubmit/PostToolUse/Stop/SessionEnd hook scripts (plugin/hooks/hooks.json) that capture session activity and feed it to the worker.
Worker service
Local HTTP API plus web viewer (src/services/worker-service.ts) that ingests observations, manages sessions, exposes search/timeline APIs, and auto-starts/stops via PID files.
MCP server
Stdio MCP server (src/servers/mcp-server.ts) exposing search/memory/observation tools that proxy to the worker API or, in server runtime, to the remote /v1 REST core, with per-runtime tool visibility filtering.
SQLite persistence layer
SessionStore (plugin/sqlite/SessionStore.js) implements schema, WAL pragmas, user-prompt dedup, private-tag stripping, and cloud-sync canonical mutation validation over bun:sqlite.
npx CLI installer/runtime manager
src/npx-cli/index.ts provides install/uninstall/update/doctor/telemetry/server/api-key/transcript-watch commands across many IDE targets (Claude Code, Cursor, OpenCode, Antigravity, etc.).
OpenClaw gateway plugin
openclaw/src/index.ts registers services/commands/event handlers that consume worker SSE observations and forward them to Telegram/Discord/Slack/Signal/WhatsApp/LINE with a circuit breaker around worker calls.
Server runtime & auth
Runtime selector and ServerClient (runtime-selector, server-client) switch between local worker mode and remote server mode using URL + API key configuration managed via better-auth/@better-auth/api-key.
Sync hub (Cloudflare Worker)
workers/sync-hub is a separately deployed Cloudflare Worker (vitest-pool-workers tests, miniflare e2e) providing cloud sync/WebSocket relay for memories.
A quiet week focused on rebranding external attribution to Claude-Mem and releasing version 13.15.3.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A quiet week focused on rebranding external attribution to Claude-Mem and releasing version 13.15.3.
Week of 2026-08-10
The 7-day Pro trial was woven throughout the product, with new alerts when memory tracking stops working.
Week of 2026-08-03
The installer began promoting CMEM Pro as a first-class memory option, with live pricing and a new customization skill.
Week of 2026-07-27
A small week adding sensitive-memory notifications and fixing a database write bottleneck.
Week of 2026-07-20
A massive cleanup week: nearly 100 commits merged dozens of outstanding pull requests and fixed several data-integrity bugs across four patch releases.
Over the past month, Claude-Mem's development shifted from a big housekeeping push (merging dozens of old pull requests and fixing database and shutdown bugs) into a commercial push, introducing a 7-day Pro trial that is pitched during installation and surfaced throughout the product. Alongside the monetization work, the team shipped reliability fixes — keeping users informed when memory observations stop flowing or quota errors occur — and polished branding by renaming the OpenRouter attribution to Claude-Mem.
Week by week
2026-08-17A quiet week focused on rebranding external attribution to Claude-Mem and releasing version 13.15.3.latest2 changes
Refactor
Unified app identity
External attribution previously labeled 'OpenRouter' was renamed to Claude-Mem so the product presents one consistent identity everywhere (#3660).
Chore
Version 13.15.3 release
The version number was bumped to 13.15.3 and the changelog updated to document the release.
2026-08-10The 7-day Pro trial was woven throughout the product, with new alerts when memory tracking stops working.6 changes
Feature
Trial offer shown everywhere
The 7-day Pro trial promotion now appears anywhere in the interface where a viewer link is displayed (#3613).
Feature
Trial signup funnel in installer
Installation now walks new users through a pitch, email capture, pairing confirmation, and automatic setup for the Pro trial (#3524).
Feature
Session-start health alert
Users are now warned at the start of a session if their memory observations have stopped being recorded (#3538).
Fix
Clearer error handling for quota limits
When a usage quota error occurs, the system no longer retries endlessly, logs it once, and tells the user exactly what to do next (#3601).
Fix
Health warning for empty projects
The observer-health warning now appears even for brand-new projects that have no saved memories yet (#3612).
Chore
Three patch releases
Versions 13.15.0 through 13.15.2 were released with changelog updates to track each change.
2026-08-03The installer began promoting CMEM Pro as a first-class memory option, with live pricing and a new customization skill.4 changes
Feature
CMEM Pro offered at install
During setup, CMEM Pro is now presented as the first choice for a memory provider (#3513).
Fix
Live model pricing
Model pricing information is fetched from the internet at install time instead of using an outdated hardcoded list (#3515).
Feature
Custom mode creator skill
A new skill was added that lets users create their own custom modes (#3487).
Chore
Versions 13.13.1 and 13.14.0 released
Two releases shipped this week, each with its version bump and changelog entry.
2026-07-27A small week adding sensitive-memory notifications and fixing a database write bottleneck.3 changes
Feature
Sensitive observation alerts
A new 'sensitive' category of observation was added, which triggers a Telegram notification when detected (#3468).
Fix
Database write storm prevention
Concurrent writes to the Chroma database were causing pile-ups; they are now prevented (#3462).
Chore
Version 13.13.0 released
The version was bumped to 13.13.0 with a matching changelog update.
2026-07-20A massive cleanup week: nearly 100 commits merged dozens of outstanding pull requests and fixed several data-integrity bugs across four patch releases.6 changes
Fix
Database repair before migration
Orphaned database records are now fixed automatically before migrations rebuild tables, preventing corruption (#3378/#3390).
Fix
Cleaner concept tags
Concept tags are standardized as they're written, with a one-time cleanup applied to existing data (#3379/#3389).
Fix
Graceful shutdown fix
Shutting down the server no longer crashes partway through when the server isn't running, so full teardown completes (#3380/#3387).
Fix
Stale worker killed on recycle
When hooks recycle the background worker, a stuck process is now force-killed rather than asked politely to restart itself.
Fix
Marketplace packaging cleanup
Internal maintainer instructions were accidentally shipping inside CLAUDE.md via marketplace clones and have been removed (#3381/#3391).
Chore
Bulk pull-request merge sweep
Roughly two dozen long-outstanding pull requests were merged into the mainline in a single coordinated effort, followed by rebuilt plugin bundles and four patch releases (13.12.1–13.12.4).
Dependencies and code review
Dependency advisories
Security Watch
3 vulnerable packages (4 advisories) across 56 scanned dependencies.
shell-quote 1.8.3
2 advisories. Fixed in 1.9.0.
How it can be abusedThe vulnerable code can freeze or misbehave when given hostile text: a crafted very long string fed into the parser makes the worker burn CPU and stop responding, and a missing newline escape when building shell commands could let a sneaky character break out and run unintended commands. In this repo that means someone who can plant malicious text in captured tool observations or synced memory content could stall or hijack the local worker service, affecting developers running claude-mem.
- highGHSA-395f-4hp3-45gvshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
- criticalGHSA-w7jw-789q-3m8pshell-quote quote() does not escape newlines in object .op values
better-auth 1.6.16
1 advisory. Fixed in 1.6.22.
How it can be abusedIf your claude-mem server deployment lets users sign in with a magic link or email code, an attacker who knows someone's email can register that email first on your service, then take over the account when the real user tries to sign in, gaining their API keys and access to their synced memory data. This affects anyone running the remote server mode with those sign-in methods enabled; purely local worker setups are not affected.
- highGHSA-qq9h-g4jm-xgf3Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
postcss 8.5.14
1 advisory. Fixed in 8.5.18.
How it can be abusedIf an attacker could get malicious CSS containing a crafted sourceMappingURL comment processed by this app, PostCSS would follow the comment and read any .map file on the machine into the build output, leaking its contents. Here that only matters to developers running the build step on their own code, since claude-mem never processes untrusted user-supplied CSS at runtime.
- highGHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required