The Perseus Vault Codex server provides persistent, encrypted, local-first memory for OpenAI Codex agents, enabling them to store and retrieve project context across sessions. All memories are stored in an AES-256-GCM encrypted local database.
perseus_remember — Save facts, decisions, conventions, gotchas, or preferences with optional categorization, tagging, importance scoring, and idempotent updates via a stable key.
perseus_recall — Retrieve relevant past memories using natural language queries with FTS5 keyword, semantic, or hybrid ranking modes, and optional category filtering.
perseus_forget — Soft-delete stale or incorrect memories by key and category, hiding them from future recall while keeping them recoverable.
perseus_reflect — Synthesize a grounded answer by recalling relevant memories and passing them to a configured LLM (e.g., GPT-5.6); falls back to raw memory context if no LLM is configured.
perseus_status — Check the memory store's health, including total memory count, encryption status, database location, and whether LLM-based reflection is available.
Provides persistent, encrypted, local-first memory for OpenAI Codex agents, enabling them to retain context across sessions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Perseus Vault Codex remember we use ruff for formatting"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Persistent, encrypted, local-first memory for OpenAI Codex agents.
Codex never forgets. Perseus Vault gives your Codex agent persistent encrypted memory — so it remembers your project conventions, past decisions, and debugging context across every session.
License: MIT | Built for OpenAI Build Week — Developer Tools track
Every Codex session starts from zero. The agent re-learns your build commands, re-discovers your conventions, and re-derives the same architectural context you explained yesterday. Memory is the missing primitive for coding agents.
Existing memory stores don't fit a developer's machine: mem0 is cloud-dependent, cognee is Python-only with no encryption at rest, Letta manages memory but doesn't encrypt local storage, Chroma is a vector DB, not structured agent memory. None are single-binary, zero-infra, and encrypted.
Related MCP server: Conectica
perseus-vault-codex is a tiny MCP server that wraps Perseus Vault
— a single 12 MB binary, fully local, AES-256-GCM encrypted at rest, with
FTS5 keyword + hybrid recall and no API keys, no cloud, no telemetry. Install
it and any Codex session gains five memory tools:
Tool | What it does |
| Save a fact, decision, convention, or gotcha across sessions. |
| Retrieve relevant past context (FTS5 + hybrid ranking). |
| Remove a stale or wrong memory. |
| Synthesize an insight from stored memories (RAG via your OpenAI/GPT-5.6 key). |
| Store health: memory count, encryption state, DB location. |
# 1. Install the wrapper (zero Python dependencies)
pip install perseus-vault-codex # from PyPI, or from source (below)
# 2. Install the Perseus Vault binary (single static binary, no deps) and put it on PATH
# https://github.com/Perseus-Computing-LLC/perseus-vault/releases
# 3. Register it with Codex (non-destructive; backs up your config)
perseus-vault-codex-setupInstall from source (works today, before the PyPI release):
git clone https://github.com/Perseus-Computing-LLC/perseus-vault-codex
cd perseus-vault-codex
pip install -e .
perseus-vault-codex-setupThat's it. On first run the server auto-creates an encrypted vault at
~/.perseus-vault/codex/memory.db — no config required.
perseus-vault-codex-setup writes this into ~/.codex/config.toml:
[mcp_servers.perseus-vault]
command = "perseus-vault-codex"
args = []Restart Codex (or start a new session) and the five perseus_* tools are
available. To enable perseus_reflect synthesis, expose your OpenAI key:
[mcp_servers.perseus-vault.env]
OPENAI_API_KEY = "sk-..."
OPENAI_MODEL = "gpt-5.6"See examples/codex_config.toml for every option.
Inside a Codex session:
you> Set up the project. First, check what you already know.
codex> [calls perseus_recall {"query": "project build and test conventions"}]
I recall from a previous session:
- This project formats with `ruff format` and lints with `ruff check`.
- We chose SQLite + FTS5 over Postgres for the local dev store.
Running `ruff check` before I start...
you> We just decided to switch auth to short-lived JWTs with refresh tokens in Redis.
codex> [calls perseus_remember {"category": "decision", "key": "auth",
"text": "Auth uses short-lived JWTs; refresh tokens live in Redis."}]
Remembered. I'll apply that convention going forward — including in
future sessions.Tomorrow, in a brand-new session, perseus_recall "auth" returns that
decision. The context survived.
PERSEUS_VAULT_BIN=/path/to/perseus-vault python scripts/demo.pyIt simulates two separate Codex sessions: session 1 learns three project facts
and tears the vault process down completely; session 2 — a fresh process —
recalls them, reflects on them, and reports encrypted status. Sample output is
in docs/.
Codex (GPT-5.6) ──MCP stdio──▶ perseus-vault-codex ──MCP stdio──▶ perseus-vault binary
5 tools (this package) 55+ tools SQLite+FTS5, AES-256-GCMTwo hops on purpose: Perseus Vault exposes 55+ low-level memory tools; this
package collapses them into five verbs a coding agent can reason about, and the
binary does the encrypted storage and retrieval. Full write-up:
docs/architecture.md.
Measured against the real perseus-vault binary (v2.17.0), encrypted at rest —
full methodology and reproducible harness in benchmarks/:
Recall is fast and accurate at scale. Seeding 10,000 developer memories, recall runs at p50 7 ms (p95 27 ms) with 5/5 recall@10 on distinctive needle memories (1,000-memory corpus: p50 1.3 ms). The recall hot path — what a Codex agent hits every task — stays in single/low-double-digit milliseconds.
The engine scales to 1,000,000 memories. A separate 2× H100 validation
(run #619, results/scale_1m_2xh100.json)
embedded ~1M memories (995,562 persisted, 0 errors) and hit hybrid recall@5 =
recall@10 = 1.00 over 2,000 semantic queries, at sub-second latency (p50
479 ms). This is an engine-scale result on GPU, not the laptop path — reported
separately and honestly (keyword-only recall is near-zero on that semantic
workload; hybrid carries it).
Persistent memory cuts context tokens ~72%. Over a 30-session horizon, recalling the top-k relevant memories per task uses 110,493 fewer tokens (72.5% reduction) than re-priming each new session with the full project knowledge base — per-unit token costs measured with tiktoken against real vault recalls.
Every number is measured or explicitly labeled as a stated assumption; nothing is
hardcoded. Reproduce with python benchmarks/bench_recall.py and
python benchmarks/bench_token_savings.py.
Codex was used during Build Week as an implementation and verification partner.
In the final review session, it read the complete wrapper and its tests, ran the
suite against the real perseus-vault 2.17.0 binary, exercised the two-session
demo, and checked a unique marker was absent from the raw default database file.
It also hardened stdout-EOF recovery in the subprocess client and added a
regression test. Those are review-session contributions; this README does not
attribute all pre-existing code to that session.
See SUBMISSION.md for the precise verification record and
benchmark caveats.
git clone https://github.com/Perseus-Computing-LLC/perseus-vault-codex
cd perseus-vault-codex
pip install -e ".[dev]"
pytest -q # unit tests (no binary needed)
PERSEUS_VAULT_BIN=/path/to/perseus-vault pytest -q # + integration testsBuilt by Perseus Computing LLC. Perseus Vault is the only fully-local, encrypted memory store for AI agents, with existing integrations for Haystack, LangChain, LlamaIndex, CrewAI, Pydantic AI, and Google ADK. MIT licensed.
Remove a stale or incorrect memory. Soft-deletes by (category, key) — the memory is hidden from recall but recoverable. Use the key shown in a prior perseus_recall / perseus_remember result.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The memory's key. | |
| reason | No | Optional note on why it's being removed. | |
| category | No | The memory's category (default 'codex-memory'). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses soft-deletion, recoverability, and the effect on recall queries. It could be improved by mentioning any side effects or limits, but the core behavioral traits are well described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that efficiently conveys the tool's purpose, mechanism, and usage hint. No superfluous words, and the most critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple forget tool with 3 parameters and no output schema, the description covers the core behavior, recoverability, and relationship to sibling tools. It could be expanded with success/failure indicators, but is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3). The description adds meaning by explaining that 'key' and 'category' form a composite key for soft-deletion and that 'reason' is an optional note, which goes beyond the schema's property descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Remove a stale or incorrect memory'), the mechanism ('soft-deletes by (category, key)'), and distinguishes from siblings by referencing prior perseus_recall/perseus_remember results, which aids selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent to use the key from prior perseus_recall/perseus_remember results, providing clear context. However, it does not state when to avoid using this tool or mention alternatives like perseus_status or perseus_reflect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieve relevant memories from past Codex sessions. Call this at the start of a task, or whenever you need project context you might have learned before, e.g. 'how do we run tests here', 'what did we decide about auth'. Uses FTS5 keyword + hybrid ranking; returns the most relevant memories with a score.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Ranking mode (default 'hybrid'). | |
| limit | No | Max memories to return (default 5). | |
| query | Yes | What you want to remember about (natural language). | |
| category | No | Optional: restrict recall to one category. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses use of FTS5 keyword + hybrid ranking, and that it returns scored results. Lacks explicit statement that it is read-only, but 'retrieve' implies non-destructive behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no wasted words. Front-loaded with primary purpose and usage guidance. Efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 4 parameters and no output schema, the description explains the tool's purpose, when to use it, ranking mechanism, and that results include scores. Minor gap: could mention result sorting by relevance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. The description adds minimal extra meaning beyond schema (e.g., 'Uses FTS5 keyword + hybrid ranking' but does not clarify parameter interactions). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it retrieves memories from past sessions, with specific use cases and examples. Distinguishes from siblings (remember, forget, reflect, status) by focusing on retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to call ('at start of task', when needing project context) and provides example queries. No exclusion criteria, but sibling tools cover different operations, so usage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Synthesize an insight from stored memories. Given a question, Perseus Vault recalls the most relevant memories and asks the configured LLM (your OpenAI/GPT-5.6 key by default) to produce a grounded answer citing them. If no LLM is configured, returns the assembled memory context so you can reason over it yourself.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | The question to reflect on, e.g. 'what are this project's conventions?' | |
| top_k | No | How many memories to ground the answer in (default 8). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses use of optional LLM and returns either grounded answer or memory context. With no annotations, the description carries the burden; it covers key behaviors without contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three front-loaded sentences with no filler. First sentence captures core purpose, followed by clear procedural explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main behavior, LLM optionality, and return format. Lacks edge cases or error handling, but is adequate given tool simplicity and lack of output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds value by explaining the roles of query and top_k in the reflection process, and the optional LLM configuration impact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it synthesizes an insight from stored memories, using a question to recall relevant memories and produce a grounded answer. Distinguishes from sibling tools like perseus_recall (raw retrieval) and perseus_remember (storage).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use (given a question) and behavior when LLM is not configured. No explicit when-not or alternative mentions, but context implies use for synthesis vs. raw recall.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Save a fact, decision, convention, or piece of context to persistent encrypted memory so it survives across Codex sessions. Call this whenever you learn something durable about the project: build commands, code style, architectural decisions, gotchas, or the user's preferences. Idempotent per (category, key).
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Optional stable identifier. Re-using a key updates that memory instead of creating a duplicate. Auto-generated if omitted. | |
| tags | No | Optional tags for later filtering. | |
| text | Yes | The fact or context to remember, in plain language. | |
| category | No | Optional grouping, e.g. 'convention', 'decision', 'gotcha'. Defaults to 'codex-memory'. | |
| importance | No | Optional salience 0.0–1.0 (higher ranks sooner in recall). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that memory is 'persistent encrypted memory' surviving sessions, and notes idempotency per (category, key). This adds behavioral context beyond the input schema, though it omits details like rate limits or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise: only two sentences. The first sentence precisely explains the tool's function, and the second provides usage guidance and the idempotency property. Every word serves a purpose, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 parameters, no output schema), the description covers core aspects: purpose, idempotency, and encryption. It could mention what the tool returns (e.g., a confirmation), but the key behavioral traits are addressed. The sibling tools imply recall capability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with parameter descriptions. The main description adds value by explaining idempotency behavior for key and category ('Re-using a key updates that memory'), and describing 'text' as 'in plain language.' This supplements the schema, justifying a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Save a fact, decision, convention, or piece of context to persistent encrypted memory.' It specifies the verb 'save' and the resource 'persistent encrypted memory,' and provides concrete examples of what to save. This differentiates it from siblings like perseus_forget and perseus_recall.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises when to call this tool: 'Call this whenever you learn something durable about the project.' It lists examples such as build commands and code style. However, it does not explicitly state when not to use it or compare with alternatives, though the idempotency hint ('Idempotent per (category, key)') provides useful context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Report the health of the memory store: how many memories are stored, whether encryption at rest is active, the database location, and whether reflect (LLM synthesis) is available. Zero-argument.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so description carries full burden. It clearly states the tool is read-only and non-destructive by reporting health info. It lacks details on response format or any side effects, but the listed specifics are sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with front-loaded purpose, no wasted words. Efficiently communicates what the tool does and its zero-arg nature.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-arg tool with no output schema, the description covers the main purpose and lists key information. Could mention return format (e.g., 'returns a JSON object'), but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero parameters with 100% schema coverage. The description explicitly confirms 'Zero-argument', adding value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Report') and lists exact resources (memories stored, encryption, database location, reflect availability). It clearly distinguishes from siblings (forget, recall, reflect, remember) by focusing on health/status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for checking health/status, but does not explicitly state when to use it vs alternatives or provide exclusions. The zero-argument note helps clarify simplicity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0perseus_forgetperseus_recallperseus_reflectperseus_rememberperseus_statusEach tool serves a unique memory operation: storing, recalling, forgetting, synthesizing, or checking status. No two tools overlap in purpose.
All tools follow a consistent 'perseus_verb' pattern, making their actions immediately clear.
Five tools is an ideal size for a memory system, covering essential operations without redundancy or omission.
Core CRUD operations are present (create, read, soft-delete), and reflect provides synthesis. Missing explicit update, but idempotent remember can achieve the same effect.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Cloud-hosted MCP server for durable AI memory
Persistent memory for AI assistants — one shared, OAuth-secured vault for every MCP client.
Persistent memory for AI agents with OAuth-backed hosted MCP access.
An MCP server that gives your AI access to the source code and docs of all public github repos
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Perseus-Computing-LLC/perseus-vault-codex'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
