zanfiel

Quick update since this got some traction — shipped a few significant things:

*v5.4:* Fixed a privilege escalation bug where rate-limited API keys were silently promoted to admin. Also added RBAC (admin/writer/reader), full audit log, and proper security headers (CSP, HSTS).

*v5.5:* Intelligence layer — server now extracts structured facts, user preferences, and current state from freeform content into dedicated tables. `/context` endpoint does 5-layer retrieval packed to a token budget. More useful for RAG/agent workflows.

*v5.6:* Graphology integration — memories are graph nodes with typed relationship edges. LLM infers "depends_on", "causes", "related_to" etc. You can run centrality, community detection, shortest paths on your memory graph. Also rewrote the MCP server (529 → 168 lines) and added 76 tests.

The codebase was also split from a 5700-line monolith into proper modules with TypeScript strict mode.

OP edit:

big update since I first posted this. Engram went from ~2,300 lines to 6,200+. Main changes: Replaced the flat 30-day exponential decay with FSRS-6 (same spaced repetition algorithm behind modern Anki, 21 parameters, trained on hundreds of millions of reviews). Every memory access is an implicit review now — stuff agents actually use builds stability, stuff they don't fades out naturally. Power-law forgetting curve instead of exponential. Each memory tracks dual strengths (Bjork & Bjork 1992) — storage strength that accumulates and never decays, and retrieval strength that does. A memory can be deeply encoded but temporarily hard to retrieve. Recall scoring got noticeably better after this. Moved from SQLite to libsql for native vector search. Embeddings are FLOAT32(384) with an ANN index now — vector_top_k() instead of cosine similarity loops in JS. O(log n) vs O(n). Conversation storage and search — full chat logs linked to memory episodes. Useful for tracing why a memory exists. Episodic memory — group memories into sessions/episodes. Everything from before still works — local embeddings, auto-linking, versioning, dedup, contradiction detection, time-travel, reflections, graph viz, multi-tenant, MCP server, TypeScript/Python SDKs. Still docker compose up, still MIT. Demo: https://demo.engram.lol/gui

Engram already has namespace isolation — API keys scope memory per-agent, spaces partition further within a user, and key scopes can be set to read-only. One agent's memories don't surface in another's recall unless you deliberately share a key. The prompt injection via recalled content point is fair but that's true of any retrieval system feeding an LLM. The memory layer stores and retrieves text — sanitizing what goes into the context window is the agent framework's job. Same reason you don't expect a database to prevent SQL injection at the storage layer. Always interested in adversarial testing though, feel free to share.

I built Engram because every AI agent I worked with had amnesia. Between sessions, everything was gone. I needed something that could store what agents learn, find it by meaning later, and do it without requiring a vector database, an OpenAI key, or any external service.

What it does: Store memories, search them semantically, recall relevant context automatically — backed by a single SQLite file.

What makes it different from Mem0: - Zero external dependencies — embeddings run locally (MiniLM-L6, 384-dim). No API keys needed. - Auto-linking — memories form a knowledge graph automatically - Versioning, auto-deduplication, auto-forget - Four-layer recall: static facts + semantic matches + high-importance + recent activity - WebGL graph visualization built in

Stack: Bun, SQLite (FTS5), transformers.js, single TypeScript file (2,300 lines).

Deploy: docker compose up -d

Live demo: https://demo.engram.lol/gui (password: demo)

Happy to answer questions about the architecture.