Hands-on: claude-mem gives AI coding agents cross-session memory at a fixed token cost

What claude-mem does

A hands-on write-up on dev.to takes a measured look at claude-mem, an Apache-2.0 project by Alex Newman that has been on GitHub since August 2025 and, per the author, has accumulated around 116,000 stars. The tool, tested at v15.18.1 released on 12 November 2026, targets a specific gap: a coding agent that fixes a bug with you one day has no idea what you agreed when you open a fresh session the next.

The architecture has three parts. Hooks inside the agent forward every tool call — file reads, edits, shell commands — to a small local worker. A second model, the observer, condenses that activity into short observations and writes a summary when the session ends. The next session starts with a compact index of those observations, and the agent pulls full details only when needed, via a three-step search the project calls mem-search. A separate save_memory tool lets the agent store a note deliberately.

Everything lands in a SQLite file at ~/.claude-mem/claude-mem.db, with Chroma layered on top for semantic search alongside SQLite's keyword search, and the worker serves a local web viewer on port 37700. The README lists Claude Code, Codex, Cursor, OpenCode and 11 other agents, and the observer can run on an Anthropic plan, a hosted plan with a 30-day trial, or your own Gemini or OpenRouter key. The reviewer credits the project for admitting its index-size claim is not a measured end-to-end saving — so he measured it himself.

The test

To spend nothing, the author paired OpenCode 1.19 with a free DeepSeek model and a free-tier Gemini key as observer. Setup was bumpy: the installer insisted on a browser login to cmem.ai even with the online opt-out set, because only the claude and host providers skip sign-in, and the reviewer ended up editing settings.json by hand. Telemetry is on by default. The free Gemini tier also burned through its 20 daily requests mid-session, triggering a 30-minute cooldown that paused capture, and one model identifier was rejected in favour of an alias.

The test repo, ledgerlite, is a small Python invoicing project with a deprecated float-based module. In session one, the agent fixed a failing GST test and was told three rules that existed nowhere in the code: discounts are capped at 30%, stored as basis points and applied to the subtotal before GST; never touch the legacy module; and log new features under the changelog's Unreleased heading. Session two, brand new and at the same commit, asked for discount support following the finance rule agreed previously — run three times with memory, three times without, and three times with the 40-word rule simply re-typed.

Perfect recall, fixed overhead

Recall was the headline. All three memory runs implemented the feature correctly — a 3,000-basis-point cap applied before GST, a changelog entry, no legacy code, and nine to ten passing tests. Without memory, no run produced code: one died on a permission prompt after hunting through git history and the home directory, while the other two stopped and asked the user to restate the rule. Re-explaining manually also scored 3/3.

The savings were narrower than the hype might suggest. Exploration calls dropped from 13.7 to 3.3 per run, but that came almost entirely from not hunting for a chat-only decision — the agent still read the source files before editing, as it should. And memory cost more tokens than re-typing the rule: roughly 126,000 context tokens processed per run versus about 66,000, because the MCP tool definitions alone add around 4,800 tokens to every request, about 5,200 with the plugin's own search tools, dwarfing the roughly 250-token injected memory block. Most of it was provider-cached (uncached input was closer, 16k versus 10k), and wall time was effectively identical at 35.0 versus 34.0 seconds.

An accidental security finding

In a baseline run without the plugin, the memory-less agent told to find the previously agreed rule went looking, then opened the memory database itself with Python's sqlite3 and read the rule straight out of the observations table. The store is a plaintext SQLite file readable by any process running as you, and an agent with shell access will find it — the reviewer had to re-run baselines inside a bwrap sandbox, with home and workspace hidden, to get clean numbers.

Why it matters

This is one of the few tests that prices agent memory in tokens rather than adjectives, and the verdict is balanced. claude-mem delivered perfect, non-blocking recall of decisions that lived only in a previous chat, but its fixed per-request overhead exceeds simply retyping context on small tasks — the value scales with how much project knowledge is trapped in past sessions. The security lesson generalises beyond this tool: whatever an agent remembers on disk is also whatever a shell-equipped agent can go and read.