If you work with code, clients, or data you're not allowed to upload — healthcare, legal, fintech, defense, or anything under an NDA — every AI memory option today asks you to break that rule. Platform memory keeps your context on their cloud, in their walled garden, one platform at a time. Cloud memory layers route your raw conversations through third-party servers and extraction APIs.
sovseal takes the other path: Plaintext never crosses the network. The optional sync tier ships only AES-256-GCM ciphertext — the server cannot read your memories even if it wanted to. And because it speaks MCP and rides a browser extension, it's memory across every AI you use, not six silos.
Local-first, zero-knowledge AI memory across Claude, Cursor, and every MCP client. 0 RTT reads.
2026-11-09
Sterne
—
Tools
—
Uptime
—
all capture, embedding, and recall run on your device.
one
Measured Performance & Benchmarks (May 2026)
Cloud-hosted memory layers force a tradeoff between latency, privacy, and cost. Every recall is a 200–800 ms round-trip to someone else's database. sovseal collapses the tradeoff. LanceDB and Transformers.js run inside your agent's process.
Workload
Operation
p50
p95
p99
Network
10K records · 1K queries
recall_memory (warm)
6.1 ms
10.4 ms
21.8 ms
0 RTT
Cold start
recall_memory (first call)
~1.2 s
—
—
0 RTT
Single write
store_memory
3.8 ms
7.2 ms
12.5 ms
0 RTT (write-behind)
All benchmarks reproduce with: pnpm --filter @sovseal/mcp-server run bench-v2 (10K pre-seeded memories, 1K sequential queries, CPU-bound ONNX embeddings on commodity hardware).
What makes it fast and private:
Sub-25 ms p99 recall — semantic search is a local vector query, not an HTTP call.
On-device embeddings — a pinned, hash-verified 384-dim MiniLM model (~22 MB quantized ONNX) runs locally. No embedding API, no per-call cost.
Zero-knowledge sync — when replication is enabled, AES-256-GCM encryption happens before any byte leaves the device. The server stores ciphertext it cannot decrypt.
Verified Semantic Recall (VSR) — every load re-derives sha256(canonicalize(payload)) and fails closed on mismatch.
Deterministic lineage — snapshot graph enables byte-equal state restoration.
Introduction
sovseal gives AI assistants and autonomous agents persistent, portable context that you actually own. It drops into any MCP-compatible client, captures from the major chat platforms via a browser extension, and keeps your plaintext where it belongs: on your hardware.
Cross-Platform Capture: The browser extension captures and recalls across ChatGPT, Claude, Perplexity, Grok, Gemini, and DeepSeek — one memory, six platforms, ⌘/Ctrl+M anywhere.
Zero-Knowledge Sync (optional): Replication ships only end-to-end AES-256-GCM ciphertext. Local-only mode works fully offline with no account.
Write-Behind Replication: Tool calls return on local commit; ciphertext sync happens asynchronously.
Developer-Friendly: Drop-in MCP server, Node SDK, and self-hosted edge endpoints.
Who it's for:
Privacy-Constrained Teams: Healthcare, legal, fintech, and defense-adjacent teams whose policies require plaintext to stay on-device.
AI Power Users: People working across Claude Desktop, Cursor, ChatGPT, and more who are tired of six AIs with six separate amnesias.
Agent Frameworks: ElizaOS, Hermes, CrewAI, and LangGraph consume the MCP server natively — local memory with no per-call API bill.
Provider's cloud, or your servers (self-host = your ops)
Your device only
Extraction pipeline
Provider-internal
Typically an LLM API call on your raw text
On-device embeddings; no LLM in the loop
Works across platforms
No — each platform is a silo
Yes (via their cloud)
Yes — locally, via MCP + extension
Offline
No
No (cloud) / partial (self-host)
Yes
Sync model
Provider-controlled
Server reads your data
Server sees ciphertext only
Cost per recall
Subscription-gated
API/hosting cost
$0, local compute
What you give up with sovseal, stated plainly: there's no cloud LLM doing clever extraction on your behalf (by design — that's the leak we exist to prevent), and you are responsible for your own key (see Threat Model). If neither of those matters to you and you live inside one platform, its native memory may be all you need. If they do matter, nothing else in this table does what the right-hand column does.
🚀 Quickstart Guide
Choose your path
sovseal exposes one protocol with three delivery shapes. Pick by where your code runs:
MCP Server
Browser Extension
Node SDK / Self-Hosted
Best for
Claude Desktop/Code, Cursor, Windsurf, Zed, agent frameworks
ChatGPT, Claude.ai, Perplexity, Grok, Gemini, DeepSeek in the browser
In-process use in a Node/TS service; full data residency
Install
npx -y @sovseal/mcp-server
Chrome Web Store + local host installer
npm install @sovseal/sdk
Recall latency
0 RTT (local LanceDB)
0 RTT (Native Messaging to local engine)
0 RTT (local LanceDB)
Cost
Free (Hobby)
Free (Hobby)
Paid (Starter or above for self-hosted sync)
MCP Server
The default for AI coding assistants and any agent framework that speaks MCP. One server binary, one config snippet, every client.
Claude Desktop, Cursor, Windsurf, Zed — add to mcp.json or claude_desktop_config.json:
claude mcp add sovseal -- npx -y @sovseal/mcp-server
System Prompt Snippet (Claude Desktop / Cursor Project Instructions):
To ensure the AI natively uses the memory server, paste this into your custom instructions:
This session has persistent memory via sovseal. At conversation start, check the sovseal://context/recent resource. Whenever the user shares preferences, plans, or personal context, store it via store_memory.
For always-on autonomous agents, switch to HTTP/SSE transport so the sovseal process outlives a single tool invocation:
For the AI platforms that don't speak MCP. The extension bridges ChatGPT, Claude.ai, Perplexity, Grok, Gemini, and DeepSeek to the same on-device engine over Native Messaging — capture-on-send as you chat, ⌘/Ctrl+M to recall anywhere, with per-site toggles and one-click delete.
Install from the Chrome Web Store, then run the one-time local host installer.
Confirm the popup shows "On-device engine connected."
Chat normally; press ⌘/Ctrl+M in any supported platform to recall.
Everything the extension captures lives in the same local database the MCP server reads — tell Claude.ai something once, and Claude Code already knows it.
Node SDK (Library)
When you're building a backend service and want to manage agent state persistence programmatically, import the Node SDK client. It performs end-to-end AES-256-GCM encryption client-side and replicates checkpoints to a sync endpoint you choose.
npm install @sovseal/sdk
import { AgentStateClient, CryptoService } from "@sovseal/sdk";
const client = new AgentStateClient({
endpoint: "https://your-project.supabase.co/functions/v1/v2-agent-state",
apiKey: "sov_proj_your_project_uuid",
});
const key = await CryptoService.generateAESKey();
// Client-side AES-GCM encrypted snapshot upload
const receipt = await client.snapshot({
key,
payload: {
agent_id: "agent_a1b2c3",
sequence_number: 0,
parent_snapshot: null,
policy_hash: "0000000000000000000000000000000000000000000000000000000000000000",
timestamp: new Date().toISOString(),
active_context: {
project: "acme-migration",
decisions: ["Postgres over Mongo — team expertise", "Cut scope: no SSO in v1"],
open_question: "Client prefers staged rollout; confirm dates with their ops lead."
}
}
});
// Restore the latest state snapshot
const { receipt: latestReceipt, ciphertextUrl } = await client.restore({
agentId: "agent_a1b2c3",
});
Self-Hosted Edge
The replication endpoint is a Deno edge function — open source, deployable to any Supabase project for full data-residency control.
# From the repo root
supabase functions deploy v2-agent-state
supabase db push # applies the agent_state_snapshots schema
# Point any client at it:
export SOVSEAL_ENDPOINT="https://<your-project>.supabase.co/functions/v1/v2-agent-state"
All of these consume the same MCP server through their first-class MCP support. No sovseal-specific adapter is required:
Framework
How it consumes MCP
ElizaOS
@fleek-platform/eliza-plugin-mcp (config-only, stdio or SSE)
Hermes Agent
Native MCP, stdio + remote HTTP
CrewAI
mcps=[...] field on the agent
LangGraph · LangChain
langchain-mcp-adapters (npm + PyPI)
Microsoft Agent Framework
Built-in MCP workbench
OpenAI Agents SDK
Native MCPServerStdio / MCPServerSse
OpenClaw
Native openclaw mcp consumer
🛠️ MCP Tools Exposed to the LLM
Tool
Args
Behavior
store_memory
{ content: string }
Embed (384-dim, on-device) → write to local LanceDB → return. Ciphertext replication runs write-behind; nothing blocks.
recall_memory
{ query: string, topK?: number }
Embed query (LRU-cached) → vector search local LanceDB → return top-K matches ranked by L2 distance. 0 RTT.
🔒 Threat Model — Read this before depending on it
We publish exactly what is protected, what isn't yet, and what's on us versus on you. Full detail in SECURITY.md.
Guarantees that hold today:
Sync confidentiality. AES-256-GCM with a 96-bit random IV per snapshot, encrypted before transmission. The sync server stores ciphertext it cannot read.
Integrity (VSR). Every recall re-derives sha256(canonicalize(payload)) and compares against the stored client_payload_hash. Corrupted storage fails closed.
No third-party processing. Embeddings are computed on-device by a version-pinned, hash-verified model. Your text is never sent to an embedding or extraction API.
Authentication. Bearer token = sov_proj_<uuid v4> in ~/.sovseal/config.json.
Storage. Ciphertext lands in a Supabase Storage bucket. Object paths are SHA-256-derived and unguessable without your project_id.
Identifier sanitization against query-predicate injection
✅ Shipped
Local database encryption at rest
✅ Shipped v0.3.5 — field-level AES-256-GCM on memory content (embedding vector still in the clear)
Master key in OS keychain (HKDF-separated at-rest & sync subkeys)
✅ Shipped v0.3.5
Programmatic secret redaction before any write
🔄 Planned — today this is enforced at the prompt level only
Model integrity verified strictly before load
✅ Shipped v0.3.5 — incl. the first-run download path
As of v0.3.5, memory content is encrypted at rest and the master key lives in the OS keychain, so local filesystem read no longer exposes your memories. Programmatic secret redaction is still prompt-level only — see SECURITY.md. We'd rather tell you that here than have you find out later.
Key loss (Hobby/Starter/Growth). Lose ~/.sovseal/config.json → lose every synced snapshot ever made. There is no escrow or recovery flow on these tiers.
Key recovery (Pro/Enterprise). Pro tier adds managed key recovery via Shamir-split escrow custody, and Enterprise adds HSM-backed key recovery.
The core open-source modules — the stdio/SSE MCP server, browser extension, Node SDK, and self-hosted Supabase edge functions — are stable, free, and licensed under Apache 2.0.
Next up, in order:
v0.3.5 — Security hardening + first intelligence: local at-rest encryption, OS-keychain key custody, code-enforced secret redaction, and the start of typed memory (episodic / semantic / procedural) with reinforcement-aware recall — so sovseal remembers what you've tried, not just what you've said.
Ambient capture: deterministic session observation for Claude Code and transcript-capable clients — memory that forms without anyone remembering to store it.
Hosted sync tier — managed, high-availability ciphertext replication for teams that don't want to run their own edge function. (Still zero-knowledge: we host bytes we cannot read.)
Wallet-key mode (opt-in) — Arweave permanence via Base L2 and Irys, for users who want their encrypted snapshots to outlive any company, including ours. Entirely optional; the core product has no blockchain dependency.
Track progress in CHANGELOG.md and the issue tracker.
Apache 2.0 — for the entire public surface (MCP server, extension, SDK, core protocol, edge function, docs). Fork it, ship it, run it however you like.
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Fragen
Wie installiere ich Sovseal Memory?
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
Benötigt Sovseal Memory einen API-Schlüssel?
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Welchen Transport verwendet Sovseal Memory?
Sovseal Memory läuft lokal über stdio.
Wann wurde Sovseal Memory zuletzt geprüft?
Zuletzt geprüft: 2026-11-09. Local-first, zero-knowledge AI memory across Claude, Cursor, and every MCP client. 0 RTT reads.
