MemPalace is a local-first, persistent memory system for AI agents. It stores and retrieves structured 'drawers' (memory chunks) organized into wings, rooms, and closets, with hybrid vector+BM25 search, a temporal knowledge graph, and agent coordination via a logstream. The system provides a CLI, an MCP server (both full and lightweight), and shell hooks for integration with Claude Code, Cursor, Codex, Antigravity, and DeepSeek Harness. It supports multiple storage backends (ChromaDB, SQLite exact, pgvector, Qdrant, Milvus, and a Rust native backend) and offers privacy-first operation with no mandatory API keys or internet connectivity. Architecturally, MemPalace is a modular Python package with optional Rust acceleration (PyO3). The core is split into several packages: `mempalace.cli` (fragment-exec-based CLI), `mempalace.mcp_server` (MCP tool server), `mempalace.palace` (palace operations and locks), `mempalace.searcher` (hybrid ranking and filters), and `mempalace.backends` (pluggable storage). The knowledge graph is SQLite-backed with temporal validity windows. A write-ahead log provides an audit trail. The system uses a hybrid logical clock (HLC) for causal ordering and a source adapter system for pluggable ingest. Although primarily an application, the project includes extensive benchmarking and model evaluation suites, giving it a mild hybrid character.
claude-mem is a persistent memory system for AI coding assistants, primarily targeting Claude Code but also supporting Codex, Cursor, Windsurf, OpenClaw, and other platforms. It captures observations, summaries, and user prompts from coding sessions via lifecycle hooks (SessionStart, PostToolUse, etc.), stores them in SQLite (local) or Postgres (server), and injects relevant context into future sessions to maintain continuity across agent interactions. The system operates as a background worker daemon (Bun) or a multi-user server (Express + BullMQ + Valkey) with API key authentication, team/project scoping, and rate limiting. Architecturally, claude-mem is a hybrid of a CLI plugin and a standalone server. The CLI component integrates into IDEs via hook scripts and MCP servers, while the server component provides REST APIs for memory management, search, and cloud sync. It features a dual-storage backend (SQLite for local, Postgres for server) with vector search via ChromaDB and full-text search via SQLite FTS5. The system includes a React-based viewer for browsing memory feeds, telemetry (opt-out PostHog), and a Cloudflare Workers-based sync hub for cross-device synchronization. The codebase demonstrates strong engineering practices with well-abstracted components (search strategies, provider abstraction, atomic file operations, telemetry scrubbing) but carries some technical debt from its dual-runtime evolution (legacy worker vs. server-beta) and extensive Windows-specific workarounds. It is actively maintained with frequent releases and comprehensive test coverage.
Yeti is a threat intelligence platform that ingests, enriches, correlates, and stores cyber threat observables, entities, indicators (YARA, Sigma, Suricata, regex, forensic artifacts), and DFIQ investigative questions. It provides a FastAPI-based REST API for CRUD operations, graph traversal, semantic search (via ChromaDB), and RBAC. The system uses ArangoDB as its primary graph/document database, Redis for message brokering, and Celery for background task scheduling. It includes a plugin architecture for feeds (30+ public sources like MITRE ATT&CK, CISA KEV, MISP, AbuseIPDB) and analytics (Shodan, Censys, VirusTotal, etc.). The codebase is well-structured with clean abstractions (ArangoYetiConnector, event system, polymorphic schemas, migration framework) but contains deprecated plugins and some configuration drift. It is primarily an application, not a data research project.