Alice is an open-source, local-first memory and continuity layer for AI agents.
One command, one SQLite file, three MCP tools by default: remember, recall, continue.
The rest stay available behind a flag. No account, no API key, no server.
shell
$uvx alice-memory install
Needs uv. No uv? pip install alice-memory && alice-memory install with Python 3.12 or later. Either way, it writes the MCP config for you.
Alice gives an AI agent a memory that survives the session: what it learned,
what was decided, what is still open.
It runs on your machine as an MCP server over stdio, reading and writing
one local SQLite file.
When a memory is corrected, later recall reflects the correction
and can explain why it changed.
i
It remembers what the agent commits.
An agent connected to Alice stores a fact with one tool, alice_memory_commit,
and finds it again in a later session with alice_recall. The tool is meant for
ordinary facts, not only the ones you ask it to keep. Whether the agent calls it is up to
the agent and its instructions. Alice does not silently mine your transcripts: a memory
comes from an explicit commit, a reviewable proposal, or a source you import or capture.
ii
Retrieval is hybrid, and falls back on purpose.
Full-text and vector search run together, fused by reciprocal rank. If no embeddings
endpoint is configured, Alice drops to full-text alone rather than failing.
Both retrievers run; the fusion is by reciprocal rank. The vector leg is optional by design.
iii
Corrections are first class.
When a memory is superseded, later recall reflects the correction and can explain why.
Memories carry provenance and an audit chain, so an agent can say where a belief came
from instead of just asserting it.
2026-03-04Deploy target is Fly.iosuperseded
2026-06-19Deploy target is Cloudflare Workerscurrent
Alice tracks open loops (blockers, waiting-fors) and writes resumption briefs: here is
where work stopped, and what should happen next. The next session starts from there,
not from a transcript. The brief carries current facts only. A long note is cut at
1,500 characters rather than dropped, and the whole brief stays under 9,500 characters,
below Claude Code’s 10,000-character limit on hook output.
81.2%
mean over three independent full runs LongMemEval_s · 500 questions · zero errors · tag v0.12.0 · store_chunks harness
Three independent full runs: 80.8, 81.0 and 81.8, or 404 to 409 of 500 questions.
Each run completed all 500 questions with zero errors.
We ran it three times because running it once is a screenshot.
Per-question evidence for all three runs is committed to the repo, alongside the reader,
judge and embedding configuration and a script to reproduce the result.
It measures the published v0.12.0 tag, run on 2026-07-18 and 19, not the
current release. The runs used the privileged store_chunks harness, which reads
chunks straight from the store. No MCP tool offers that path, so it is not what your agent
gets. The product path, pack_excerpts, has no published score yet.
The weakest category and the noisiest subset are printed in the limits section below,
not in a footnote.
One claim on this page, corrected in place
withdrawnEvery release ships with artifact digests verified from independent sources.
standsEvery release since v0.15.1 ships with artifact digests
verified from independent sources.
why
The wider claim covered historical releases nobody had re-verified. Narrowed rather than
deleted, and left visible. That is the same rule the release notes follow, and the same
thing Alice does to a memory when it is superseded.
You run agents in an MCP-capable host: Claude Desktop, Claude Code, Cursor, Codex,
Hermes (Nous Research), OpenClaw, or OpenCode. You want them to stop starting from zero,
and you want the memory to live in a file you own rather than in someone else’s database.
Default
Start on SQLite.
One user, one machine, one file. Three MCP tools run against it by default, and eight
more when you set ALICE_MCP_FULL_TOOLS=1. There is nothing else to operate.
In this mode, memory review happens through the tools themselves.
alice_memory_commit
alice_recall
alice_resume
When you outgrow it
Run the Postgres stack.
Postgres with pgvector adds a web review console, a place to approve, correct and forget
memories at a desk rather than through tool calls. It runs from a repo checkout and needs
Docker, Node and pnpm. There is no automatic migration from SQLite.
If you are one person with one machine, you do not need it yet.
Every release note since v0.15.1 has its own known-limitations section. When a limitation turned out
to be false, it was struck through and withdrawn in place, with the evidence, rather than
quietly deleted. The same rule applies to this page, so here is the list.
01
Multi-session recall is the weakest benchmark category, at roughly 63%.
If your workload leans hard on stitching facts together across many sessions, that is
the number to look at, not the headline mean. It comes from the same three
v0.12.0store_chunks runs as section 03.
63%
02
The abstention subset is noisy.
The 30-question abstention subset moves between runs, so we do not quote it to one
decimal place.
03
The HTTP /v1 surface is loopback-only.
It authenticates but does not yet authorize, so it is documented as loopback-only.
Keep it on your local machine; do not put it on a network.
04
There is no OpenClaw plugin.withdrawn
OpenClaw does not support MCP. Connecting Alice would need a plugin built against
their SDK.
why
Wrong. This was written from OpenClaw’s published docs without running OpenClaw.
It ships an MCP client, and Alice connects over stdio with one config entry and no
plugin: openclaw mcp probe reports alice: 11 tools. Verified
2026-08-15, before the v0.16.0 default handshake change. Withdrawn in place rather
than deleted, under the same rule as the claim in section 03.
05
Security posture, stated exactly.
Automated security scanning and internal adversarial review, findings triaged and fixed.
No one outside the project has audited the code.
06
Codex skips the brief until you trust its hook.
Install writes the hook, but only you can trust it, at “Hooks need review”
or with /hooks. Codex skips it again each time a re-run changes its command.
If your config.toml already defines hooks, install writes no hook: it prints
one for you to add by hand and exits 1.
07
Codex and the Claude Code plugin were tested on Linux only.
Both ran in CI, on Linux, at pinned versions: codex-cli 0.158.0 and Claude Code 2.1.281.
The Codex hook ran against a local mock, not a real model. No other version or platform
was run.
08
A very long query makes recall fail.
alice_recall and alice_context_pack return a tool error for a
query with about 991 or more distinct search terms, roughly 30,000 bytes of ordinary
prose. Keep queries short. The session brief no longer fails this way.
Alice is a plain MCP server over stdio, so any MCP client can use it. The installer
configures Claude Desktop, Claude Code, Cursor and OpenClaw for you. Hermes, OpenCode and
Codex are opt-in, with --host hermes, --host opencode and
--host codex. On Claude Code you can use a plugin instead of the installer.
OpenCode has no session hook. Run alice-memory brief to see the brief.
1 Install it.
shell
$uvx alice-memory install
Or, without uv:
shell
$pip install alice-memory &&alice-memoryinstall
The first command needs uv. The second needs Python 3.12 or later: with no
uv, install points your hosts at the alice-memory program pip installed. Your
notes go in ~/.alice; to keep them somewhere else, add --data-dir with
an absolute path, or one that starts with ~/, the first time you install. The
installer writes config for Claude Desktop, Claude Code, Cursor and OpenClaw, and adds a
SessionStart hook for Claude Code and Cursor. Hermes, OpenCode and Codex are opt-in, and any
--host replaces the default set: alice-memory install --host hermes
writes Hermes only. To add Hermes to the four defaults, pass all five:
--host claude-desktop --host claude-code --host cursor --host openclaw --host hermes.
It serves three MCP tools over stdio against a single SQLite file in the directory you chose:
remember, recall, continue. Capture, the context pack and the other tools are not in the
default set. Set ALICE_MCP_FULL_TOOLS=1 in the same config to list them.
Using Codex? Codex is opt-in. This writes Codex only:
shell
$uvx alice-memory install--hostcodex
It adds the MCP entry to config.toml in Codex’s home (~/.codex,
or CODEX_HOME when set) and a SessionStart hook to hooks.json there.
Codex skips that hook until you trust it: open Codex, choose Review hooks at
“Hooks need review” and trust alice-memory-session-start, or use
/hooks. Check the entry with codex mcp get alice.
Or keep using alice-memory install. Pick one, not both.
The plugin keeps notes in ~/.alice. For another folder, add
--config data_dir=/ABSOLUTE/PATH/TO/.alice to the install command. Already ran
alice-memory install? Remove its Claude Code entries first: run
claude mcp remove alice --scope user and delete the
alice-memory-session-start hook from ~/.claude/settings.json.
To update, run claude plugin update alice-memory@alicememory.
New in v0.19.0. Codex support, opt-in with --host codex. A Claude
Code plugin. A session brief that cuts a long note at 1,500 characters instead of dropping it,
stays under 9,500 characters and leaves out superseded facts. A --data-dir that
is empty or relative now stops the server; v0.18.0 accepted a relative one and made a vault
in whatever folder the host started in. The
v0.19.0 release notes
have the rest.
Upgrading from v0.18.0? With pip, run
pip install -U alice-memory==0.19.0. With uv, run
uvx alice-memory@0.19.0 --version once; it prints the version your hosts get. Then
restart your hosts. Check every --data-dir in your host config: it must be an absolute
path or start with ~/. A relative path, or the literal text
${HOME}/.alice, now stops the server. Your SQLite vault opens as it is; there is
no schema change. Run alice-memory doctor: it now also lists a stored source
that holds a key shaped like an AWS access key id. If it lists one, rotate that key. On
Hermes, a re-run keeps comments in the alice block, or refuses and prints the
block when it has a change to make. Scripts that read folder import receipts will see the
file name in each withheld item. Coming from v0.17.0? Read the
v0.18.0 release notes too.
2 Or wire it by hand.
Prefer to edit the config yourself? These snippets still run the MCP server directly.
Note
The session hook is what makes a new chat open with a brief instead of a blank slate.
It is optional. Alice works without it; you just start each session by asking.
Plugin
Using the Claude Code plugin from step 1? Skip this tab. The plugin brings its own server
and hook, and adding these as well sets Alice up twice.
Note
The session hook is what makes a new chat open with a brief instead of a blank slate.
It is optional. Alice works without it; you just start each session by asking.
Hermes reads ~/.hermes/config.yaml, YAML under mcp_servers:
Note
Hermes does not pass your shell environment to MCP servers, so anything Alice needs
(an embeddings endpoint, for example) must go in an env block rather than
an export in your shell.
OpenClaw reads ~/.openclaw/openclaw.json. The servers live under
mcp.servers, nested, unlike Hermes’ flat mcp_servers:
Trust
Codex skips the hook until you trust it. Open Codex, choose Review hooks at
“Hooks need review” and trust alice-memory-session-start, or use
/hooks. If the command changes later, trust it again. The hook is optional;
Alice works without it, and you start each session by asking.
Note
If hooks.json already has SessionStart hooks, add this group at the end of the
list, not ahead of yours: Codex keys its trust records by position. If your
config.toml already defines hooks, leave hooks.json alone and run
alice-memory install --host codex instead. It prints the hook to add to
config.toml.
3 See it work.
shell
$uvx alice-memory demo--vault~/Notes
It imports a Markdown folder and prints the one passage a new session will quote back.
Already have notes? alice-memory import-markdown --from ~/Notes or
alice-memory import-chatgpt --from conversations.json. A line that holds a
credential is stored as withheld, and the rest is imported. The receipt says where each
withheld item was: the file and line for a notes folder, the conversation for ChatGPT. The
check is a pattern check: it misses some formats and refuses some harmless notes.
4 Then talk to your agent.
That is the whole setup. On Codex, the brief starts once you trust the hook. Configure an
embeddings endpoint if you want vector search; without one, retrieval runs on full-text alone.
5 Give the agent instructions.
optional
The repo ships skill packs for Hermes and OpenClaw. They are written to tell the agent when
to reach for memory. Nothing in the repo measures whether a pack changes what an agent does.
Run these from a clone of the repo, and copy the directory, not the file: