claude-mem Has 112,014 Stars and Hooks Into Six Agent Events, With Cloud Sync and a Hosted Observer Behind Them
Software / news
claude-mem Has 112,014 Stars and Hooks Into Six Agent Events, With Cloud Sync and a Hosted Observer Behind Them
The Apache-2.0 memory plugin stores sessions in local SQLite. Its README leaves hosted-observer retention and encryption unstated.
claude-mem, an Apache-2.0 plugin that records everything a coding agent does and replays a summary into the next session, had 112,014 GitHub stars on November 4, with the repository created on August 31, 2025. Its README describes six lifecycle hooks, a local database, and an optional cloud sync to cmem.ai.
The repository belongs to Alex Newman, who goes by thedotmack on GitHub and is listed on the page. The README gives the version as 15.9.0, and the API shows 9,746 forks and 160 open issues and pull requests. The last push was November 3 at 21:59 UTC.
What it captures
The README says the plugin "captures everything your agent does during sessions, compresses it with AI" and injects relevant context into later sessions. It lists Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot and OpenCode as supported agents.
It does this through hooks, which are commands an agent runs at set points. Anthropic's Claude Code documentation lists the same six events the README uses.
| Hook event | When it fires, per Anthropic's docs |
|---|---|
| SessionStart | A session begins or resumes |
| UserPromptSubmit | A prompt is submitted, before Claude processes it |
| PreToolUse | Before a tool call executes |
| PostToolUse | After a tool call succeeds |
| Stop | Claude finishes responding |
| SessionEnd | A session terminates |
Each hook runs claude-mem hook claude-code <event>, according to the README. Anthropic's docs say a PostToolUse hook can replace the tool result, so tool output is within its reach.
Where the data goes
Storage is local. The README says "SQLite Database - Stores sessions, observations, summaries", with Chroma handling vector search, and a worker service exposes a local HTTP API with a web viewer. The README does not give a default port; it says the worker's address is "printed on startup."
Three paths can send data off the machine.
- Cloud Sync, optional, backs memories up to cmem.ai. The README says "no daemon, the worker syncs on write."
- Screenshots are off by default and stored under
~/.claude-mem/media-v1/. They upload to cmem.ai only when Cloud Sync is on. - The hosted observer, which compresses the record. Signing in "provisions a memory key for your account" and starts a 30-day free trial. Users can instead supply their own OpenRouter or Gemini key, or use an Anthropic plan.
Setting CLAUDE_MEM_ONLINE_OPTIN=false or passing an explicit --provider flag skips the sign-in. The README does not describe retention, encryption at rest, or what the hosted observer keeps.
The caveats the README itself carries
Because the tool captures "everything", secrets pass through it. The main mitigation named is a <private> tag that excludes marked content from storage, and it depends on the user applying it each time.
One install route for OpenClaw is curl -fsSL https://install.cmem.ai/openclaw.sh | bash, which runs a remote script directly. On Windows the installer adds a folder to the user PATH. The README also warns that npm install -g claude-mem installs only the SDK and does not register hooks or the worker, so a user who does that has no memory feature.
The page promotes a token called CMEM and a contract address. The README says it was created by a third party and is not part of the software.
Stars are not adoption
The star count measures attention. It does not measure how many people run the hooks daily, and the repository exposes no usage figure. The comparison is closer to the plug-in route that Postman 12.33 took when it wrote a self-approved hook into a Codex config, where the question was what a tool is allowed to do inside an agent's session. For another starred agent tool judged on its own claims, see the report on Nvidia's Auto Ontology. The README links a security policy, but the page shows no contents.
Sources
More in Software
- 01Siri AI's Developer Preview Excludes TestFlight and the App Store, With Submissions Not Opening Until SpringApple's November 3 post opens App Intents integration to every developer on the 27.3 betas, but only development builds can use it, and no usage limits or fees are published.
- 02GitHub Copilot Reaches Xcode 27.3 Beta and JetBrains Air in a Day Apart, and Air Admins Cannot Cap SpendingThe November 3 and 4 changelog entries describe two different integrations: a public preview that needs macOS Tahoe 26.6, and an alpha-linked plugin with gaps in governance.
- 03Dependabot Now Bumps APM Agent Manifests, Version Updates Only, While APM's Scanner Misses Plain-Text Prompt InjectionGitHub's November 3 changelog covers git dependencies in apm.yml; Microsoft's APM docs say the package manager does not sign packages.
- 04Apple's Taiwan App Store Fee Falls to 26% While Outside Payment Links Stay Banned and the FTC Probe Is Only SuspendedThe 30% to 26% cut took effect October 31 under Article 28 of Taiwan's Fair Trade Act, and the regulator can reopen the case.