memalyze

MCP · self-hosted · AGPL-3.0

Agent memory your security team will approve.

One static binary. Redaction before write. An append-only audit log for every read. Local embeddings. No cloud, no Python, no SaaS.

Request a pilot Read the code

v0.1.0 · Linux / macOS / Windows · 14 MB · 4 MCP tools

See the governance story in 30 seconds.

No Ollama, no network, no config. The demo writes a memory containing a phone number, an e-mail and a national ID, then shows what is actually stored and what the audit log says.

memalyze demo
$ memalyze demo
[1] write two memories (one contains a phone, e-mail, national ID)
    redacted=true hits=3 rules=[email id_card_cn phone_cn]

[2] what is actually stored
    content = 客户张伟的手机是 [REDACTED:phone]，邮箱 [REDACTED:email]，身份证 [REDACTED:id_card]
    ok  plaintext never reaches the database

[3] search for the original phone number
    hits = 0
    ok  no index can recover the raw value

[5] audit export
    time,action,actor,tenant_id,scope,memory_id,query_hash,query_len,result_count,degraded
    2026-10-25T06:52:06Z,add,demo,acme,crm,01M5R...,,0,1,false
    2026-10-25T06:52:06Z,search,demo,acme,,,a6942f97...,11,0,true

Most agent memory is a vector table. Fine, until someone asks.

Which customer data did the agent read last Tuesday? Can you show it without exporting the whole database? Can you deploy this inside a network with no outbound access? Those are the questions memalyze is built around.

Before write

Redact, then index

Phone numbers, e-mail, national IDs, bank cards, API keys and PEM blocks are replaced with stable markers before dedup, FTS and embedding. The plaintext is never stored — not by us, not by you.

Every read

Audit with hashes

Add, search and delete are appended to an audit table. The query is stored as SHA-256 + length, never plaintext. Export one CSV and hand it to an auditor.

Offline

One binary, local vectors

SQLite + Ollama. No model download at runtime, no cloud call. If Ollama is down, search degrades to keyword in ≤3 s and says degraded=true instead of hanging.

Measured, not assumed.

Numbers from a 60-memory Chinese corpus with 16 queries. The full experiment and the failed alternatives are in the repo.

0.94recall@3 · qwen3-embedding
0.92MRR · same run
4MCP tools, total
14 MBstatic binary, no runtime

Three steps. No build toolchain.

The installer downloads a prebuilt binary and verifies its SHA-256 before installing.

  1. curl -fsSL https://raw.githubusercontent.com/mahaoboy/memalyze/main/scripts/install.sh | sh
    Windows: use the .exe from the release page.
  2. ollama pull qwen3-embedding:0.6b
    ~640 MB. Local, 1024-dim, strong on Chinese.
  3. memalyze demo then wire it into Claude Code, Cline or any MCP harness.
Claude Desktop

One-click bundle

Download the .mcpb for your platform and open it. The binary inside is the same v0.1.0 build.

macOS · Windows · Linux →

What it is not.

Written down here, not implied away in a SECURITY.md nobody reads.

  • No per-user auth. One token per process = one trust boundary. If two people must not read each other's memories, run two processes.
  • Pattern-based redaction. Eight families plus your own rules. It will not catch a name, an address, or a photo of an ID card. It is not a compliance certificate.
  • SQLite, single writer. Brute-force vector scan is fine up to roughly 10k memories. There is a store interface, but only SQLite is implemented.
  • Append-only at the SQL level, not WORM. A trigger rejects UPDATE; DELETE is not blocked. Export to object-lock or syslog storage if a hostile DBA is in your threat model.
  • AGPL-3.0. A commercial license is available for teams that cannot use it.

Two-week pilot

We install memalyze in your environment, tune the redaction rules to your data, review the audit export with you, and write down the threat-model gaps we find. You keep the deployment and the notes either way.

Request a pilot Read the threat model