Zettelkasten memory.

Long-term memory for AI agents, kept the way a Zettelkasten keeps notes: every memory is a note that is tagged, scored by importance and linked to related notes. It is encrypted at rest, and personal data is replaced before it reaches the index or an embedding API.

Released and MIT-licensed

A Python library that works on its own or plugs into Claude Code (as an MCP server), CrewAI and LangGraph, and serves fleets of agents over SMCP.

Source on GitHub

How it works

Notes that find each other

Memories link themselves

Each new memory is linked to the memories it is most similar to, so the store grows into a graph an agent can walk.

Search ranks what matters

Results are ranked by text similarity, importance, recency and how well connected a memory is, so important, well-linked memories come first.

Keywords, meaning, or both

Keyword search that needs no API key and works offline; embeddings from a local model or a provider; a hybrid that fuses both rankings; and a FAISS index for very large stores.

Tools an agent can call

Store, search, fetch and delete memories, follow their links, gather what is known about a topic, and find stale, low-value memories to prune (a dry run unless asked).

Security

Built for memory that holds secrets

Encrypted at rest

The store is encrypted with AES-256-GCM; a server can be told to refuse to run without it.

Personal data stays out of the index

Personal data is replaced by deterministic tokens before it is indexed, saved or sent to an embedding API, and turned back into plain text on the way out, or not, as you choose.

One store, many tenants

Each API key maps to its own namespace, carried inside the session token and enforced at the storage layer. A namespace a client asks for is ignored.

Secrets only from the environment

No secret is ever passed on the command line, there are no default credentials, and the networked server will not start without a secret and at least one API key.

With SMCP and malgra

Memory over an encrypted channel

Over SMCP the same tools run on an authenticated, encrypted channel that existing SMCP clients connect to unchanged, and a memory server can join other SMCP nodes as a federation peer. With malgra as its embedding provider, a workspace holds no embedding credentials at all: malgra holds them and applies its rules and personal-data checks to every embedding request.