Open source  ·  MIT  ·  local-first

Memory for agents
that shows its work.

Alice is an open-source, local-first memory and continuity layer for AI agents. One command, one SQLite file, three MCP tools by default: remember, recall, continue. The rest stay available behind a flag. No account, no API key, no server.

shell
$ uvx alice-memory install

Needs uv. No uv? pip install alice-memory && alice-memory install with Python 3.12 or later. Either way, it writes the MCP config for you.

Alice gives an AI agent a memory that survives the session: what it learned, what was decided, what is still open.

It runs on your machine as an MCP server over stdio, reading and writing one local SQLite file.

When a memory is corrected, later recall reflects the correction and can explain why it changed.

  1. It remembers what the agent commits.

    An agent connected to Alice stores a fact with one tool, alice_memory_commit, and finds it again in a later session with alice_recall. The tool is meant for ordinary facts, not only the ones you ask it to keep. Whether the agent calls it is up to the agent and its instructions. Alice does not silently mine your transcripts: a memory comes from an explicit commit, a reviewable proposal, or a source you import or capture.

  2. Retrieval is hybrid, and falls back on purpose.

    Full-text and vector search run together, fused by reciprocal rank. If no embeddings endpoint is configured, Alice drops to full-text alone rather than failing.

    query full-text (FTS5) vector (cosine) rank fusion ranked optional: with no embeddings endpoint, retrieval runs on full-text alone
    Both retrievers run; the fusion is by reciprocal rank. The vector leg is optional by design.
  3. Corrections are first class.

    When a memory is superseded, later recall reflects the correction and can explain why. Memories carry provenance and an audit chain, so an agent can say where a belief came from instead of just asserting it.

  4. Work resumes where it stopped.

    Alice tracks open loops (blockers, waiting-fors) and writes resumption briefs: here is where work stopped, and what should happen next. The next session starts from there, not from a transcript. The brief carries current facts only. A long note is cut at 1,500 characters rather than dropped, and the whole brief stays under 9,500 characters, below Claude Code’s 10,000-character limit on hook output.

81.2%

mean over three independent full runs
LongMemEval_s  ·  500 questions  ·  zero errors  ·  tag v0.12.0  ·  store_chunks harness

80.0 80.5 81.0 81.5 82.0 mean 81.2 80.8 · 404 81.0 · 405 81.8 · 409
Three independent full runs: 80.8, 81.0 and 81.8, or 404 to 409 of 500 questions. Each run completed all 500 questions with zero errors.

We ran it three times because running it once is a screenshot.

Per-question evidence for all three runs is committed to the repo, alongside the reader, judge and embedding configuration and a script to reproduce the result. It measures the published v0.12.0 tag, run on 2026-07-18 and 19, not the current release. The runs used the privileged store_chunks harness, which reads chunks straight from the store. No MCP tool offers that path, so it is not what your agent gets. The product path, pack_excerpts, has no published score yet.

The weakest category and the noisiest subset are printed in the limits section below, not in a footnote.

One claim on this page, corrected in place

withdrawn Every release ships with artifact digests verified from independent sources.
stands Every release since v0.15.1 ships with artifact digests verified from independent sources.

why The wider claim covered historical releases nobody had re-verified. Narrowed rather than deleted, and left visible. That is the same rule the release notes follow, and the same thing Alice does to a memory when it is superseded.

Read the per-question evidence

You run agents in an MCP-capable host: Claude Desktop, Claude Code, Cursor, Codex, Hermes (Nous Research), OpenClaw, or OpenCode. You want them to stop starting from zero, and you want the memory to live in a file you own rather than in someone else’s database.

Default

Start on SQLite.

One user, one machine, one file. Three MCP tools run against it by default, and eight more when you set ALICE_MCP_FULL_TOOLS=1. There is nothing else to operate. In this mode, memory review happens through the tools themselves.

  • alice_memory_commit
  • alice_recall
  • alice_resume

When you outgrow it

Run the Postgres stack.

Postgres with pgvector adds a web review console, a place to approve, correct and forget memories at a desk rather than through tool calls. It runs from a repo checkout and needs Docker, Node and pnpm. There is no automatic migration from SQLite.

If you are one person with one machine, you do not need it yet.

Every release note since v0.15.1 has its own known-limitations section. When a limitation turned out to be false, it was struck through and withdrawn in place, with the evidence, rather than quietly deleted. The same rule applies to this page, so here is the list.

01

Multi-session recall is the weakest benchmark category, at roughly 63%.

If your workload leans hard on stitching facts together across many sessions, that is the number to look at, not the headline mean. It comes from the same three v0.12.0 store_chunks runs as section 03.

02

The abstention subset is noisy.

The 30-question abstention subset moves between runs, so we do not quote it to one decimal place.

03

The HTTP /v1 surface is loopback-only.

It authenticates but does not yet authorize, so it is documented as loopback-only. Keep it on your local machine; do not put it on a network.

04

There is no OpenClaw plugin. withdrawn

OpenClaw does not support MCP. Connecting Alice would need a plugin built against their SDK.

why Wrong. This was written from OpenClaw’s published docs without running OpenClaw. It ships an MCP client, and Alice connects over stdio with one config entry and no plugin: openclaw mcp probe reports alice: 11 tools. Verified 2026-08-15, before the v0.16.0 default handshake change. Withdrawn in place rather than deleted, under the same rule as the claim in section 03.

05

Security posture, stated exactly.

Automated security scanning and internal adversarial review, findings triaged and fixed. No one outside the project has audited the code.

06

Codex skips the brief until you trust its hook.

Install writes the hook, but only you can trust it, at “Hooks need review” or with /hooks. Codex skips it again each time a re-run changes its command. If your config.toml already defines hooks, install writes no hook: it prints one for you to add by hand and exits 1.

07

Codex and the Claude Code plugin were tested on Linux only.

Both ran in CI, on Linux, at pinned versions: codex-cli 0.158.0 and Claude Code 2.1.281. The Codex hook ran against a local mock, not a real model. No other version or platform was run.

08

A very long query makes recall fail.

alice_recall and alice_context_pack return a tool error for a query with about 991 or more distinct search terms, roughly 30,000 bytes of ordinary prose. Keep queries short. The session brief no longer fails this way.

The full list lives in the known-limitations doc and the v0.19.0 release notes.

Alice is a plain MCP server over stdio, so any MCP client can use it. The installer configures Claude Desktop, Claude Code, Cursor and OpenClaw for you. Hermes, OpenCode and Codex are opt-in, with --host hermes, --host opencode and --host codex. On Claude Code you can use a plugin instead of the installer. OpenCode has no session hook. Run alice-memory brief to see the brief.

1 Install it.

shell
$ uvx alice-memory install

Or, without uv:

shell
$ pip install alice-memory && alice-memory install

The first command needs uv. The second needs Python 3.12 or later: with no uv, install points your hosts at the alice-memory program pip installed. Your notes go in ~/.alice; to keep them somewhere else, add --data-dir with an absolute path, or one that starts with ~/, the first time you install. The installer writes config for Claude Desktop, Claude Code, Cursor and OpenClaw, and adds a SessionStart hook for Claude Code and Cursor. Hermes, OpenCode and Codex are opt-in, and any --host replaces the default set: alice-memory install --host hermes writes Hermes only. To add Hermes to the four defaults, pass all five: --host claude-desktop --host claude-code --host cursor --host openclaw --host hermes. It serves three MCP tools over stdio against a single SQLite file in the directory you chose: remember, recall, continue. Capture, the context pack and the other tools are not in the default set. Set ALICE_MCP_FULL_TOOLS=1 in the same config to list them.

Using Codex? Codex is opt-in. This writes Codex only:

shell
$ uvx alice-memory install --host codex

It adds the MCP entry to config.toml in Codex’s home (~/.codex, or CODEX_HOME when set) and a SessionStart hook to hooks.json there. Codex skips that hook until you trust it: open Codex, choose Review hooks at “Hooks need review” and trust alice-memory-session-start, or use /hooks. Check the entry with codex mcp get alice.

Alice is now also a Claude Code plugin:

shell
$ claude plugin marketplace add samrusani/AliceMemory
$ claude plugin install alice-memory@alicememory

Or keep using alice-memory install. Pick one, not both.

The plugin keeps notes in ~/.alice. For another folder, add --config data_dir=/ABSOLUTE/PATH/TO/.alice to the install command. Already ran alice-memory install? Remove its Claude Code entries first: run claude mcp remove alice --scope user and delete the alice-memory-session-start hook from ~/.claude/settings.json. To update, run claude plugin update alice-memory@alicememory.

New in v0.19.0. Codex support, opt-in with --host codex. A Claude Code plugin. A session brief that cuts a long note at 1,500 characters instead of dropping it, stays under 9,500 characters and leaves out superseded facts. A --data-dir that is empty or relative now stops the server; v0.18.0 accepted a relative one and made a vault in whatever folder the host started in. The v0.19.0 release notes have the rest.

Upgrading from v0.18.0? With pip, run pip install -U alice-memory==0.19.0. With uv, run uvx alice-memory@0.19.0 --version once; it prints the version your hosts get. Then restart your hosts. Check every --data-dir in your host config: it must be an absolute path or start with ~/. A relative path, or the literal text ${HOME}/.alice, now stops the server. Your SQLite vault opens as it is; there is no schema change. Run alice-memory doctor: it now also lists a stored source that holds a key shaped like an AWS access key id. If it lists one, rotate that key. On Hermes, a re-run keeps comments in the alice block, or refuses and prints the block when it has a change to make. Scripts that read folder import receipts will see the file name in each withheld item. Coming from v0.17.0? Read the v0.18.0 release notes too.

2 Or wire it by hand.

Prefer to edit the config yourself? These snippets still run the MCP server directly.

Add to your MCP client config:

claude_desktop_config.json
{
  "mcpServers": {
    "alice": {
      "command": "uvx",
      "args": ["alice-memory", "mcp", "--data-dir", "/ABSOLUTE/PATH/TO/.alice"]
    }
  }
}

3 See it work.

shell
$ uvx alice-memory demo --vault ~/Notes

It imports a Markdown folder and prints the one passage a new session will quote back.

Already have notes? alice-memory import-markdown --from ~/Notes or alice-memory import-chatgpt --from conversations.json. A line that holds a credential is stored as withheld, and the rest is imported. The receipt says where each withheld item was: the file and line for a notes folder, the conversation for ChatGPT. The check is a pattern check: it misses some formats and refuses some harmless notes.

4 Then talk to your agent.

That is the whole setup. On Codex, the brief starts once you trust the hook. Configure an embeddings endpoint if you want vector search; without one, retrieval runs on full-text alone.

5 Give the agent instructions. optional

The repo ships skill packs for Hermes and OpenClaw. They are written to tell the agent when to reach for memory. Nothing in the repo measures whether a pack changes what an agent does. Run these from a clone of the repo, and copy the directory, not the file:

shell
$ cp -R agent-skills/openclaw/alice-project-memory ~/.openclaw/skills/
$ cp -R agent-skills/hermes/alice-memory ~/.hermes/skills/

Copied them before v0.17.0? Copy them again. The old packs tell the agent to confirm a memory with a tool the default setup does not list.

A skill grants no tools on its own. It tells the agent how to use the ones the MCP server already provides.

Small print the PyPI package is alice-memory. The name alice-core on PyPI belongs to an unrelated project.

Copied