Looking for the AI employee system? This page documents the alpha pip install ragleap-memory package, a long-term memory store for LLM applications. To install and run ragleap-core (AI employees, channels, Docker), see the install documentation.

Alpha · 51 test functions · not independently audited

ragleap-memory

Open-source (MIT), durable, tenant-scoped long-term memory for LLM applications, stored in one SQLite file. Every call takes a Scope from ragleap-security and is filtered by it inside the SQL. Its threat model says exactly what is and is not defended.

0.1.0

PyPI version

Runtime dependency

Test functions

Install

Python 3.10 or newer. The only dependency is ragleap-security 0.1.0 or newer. It needs a SQLite build with FTS5; the store refuses to start without it.

pip install ragleap-memory
# or, with uv
uv add ragleap-memory

from ragleap_memory import SQLiteStore
from ragleap_security import Scope

store = SQLiteStore("memory.db")
alice = Scope("acme", subject="alice")

old = store.add(alice, "Alice prefers email", trust="owner")
new = store.supersede(alice, old.id, "Alice prefers phone calls", trust="owner")

for hit in store.search(alice, "how should we contact alice", k=3, min_trust="model"):
    print(hit.entry.trust, hit.entry.text)

SQLiteStore

add(scope, text, trust=...)

Adds an entry. Entry types are episode, fact and summary; trust labels are untrusted (the default for new entries), model and owner. Entries can expire and can link to the entries they were derived from.

search(scope, query, k=..., min_trust=...)

FTS5 keyword search, filtered by the scope inside the SQL and by a minimum trust label. Search quality has not been measured on any benchmark.

supersede(scope, entry_id, text, trust=...)

Replaces a fact that changed. History is kept.

erase(...)

Removes the text from the file. After erase(), a byte-level search of the database file and its journal found no trace of the deleted text, on the two SQLite builds tested.

get, forget, export, sweep_expired, compact, count

Also available and scoped the same way. See the source and the changelog for details.

The store labels trust but does not decide what to do with retrieved text. Code that puts memory into a prompt must treat anything below owner as untrusted input. An optional audit log records ids and counts only.

Verified

0.1.0 (from its changelog): 89 tests pass on Python 3.10 and 3.12, the CI test job passes on 3.10, 3.11 and 3.12, and all 27 deliberate breaks of a protection are caught by the mutation check.

Known limitations

Alpha, not independently audited. Read the threat model before relying on it.
Not in 0.1.0: embeddings and vector search, consolidation and retention policies, importance-based ranking, Postgres, encryption at rest, a review queue and the ragleap-agents adapter. These are planned and not available.