One command to install, a Claude Code plugin, a binary to download, or an installer for Windows.
Seven crates are on crates.io, and the web page ships inside the binary crate, so cargo install cyberbrain needs Rust but no node toolchain. If you would rather not build it, the v0.8.4 release carries binaries for Linux, Windows and macOS (Apple silicon) with a checksum file to verify them against, and a Windows installer that adds a Start menu entry instead of a terminal.
In Claude Code, as a plugin: hooks, MCP server, three skills and a mod that searches the memory without a model turn and tells you when the context is being compacted. The binary is downloaded and checked against the release's SHA256SUMS on first use.
Source-available · FSL-1.1-ALv2
Cyberbrain memory that shows its work
Cited, trust-tiered, local-first memory for AI coding agents. Every retrieved statement carries an identifier that resolves to its source block, every result lists what was not checked, and the whole thing is one native binary that needs nothing else on the machine.
r0-5b2e0c17a4f3 ring 0 invariants.md
Deploy only from a tagged release.
r2-867ef2a8cd01 ring 2 notes/2026-08-deploy.md
Hotfix shipped from main on 12 Aug; tagged afterwards.
caveats
! semantic search skipped: no embedder configured
! contradiction check skipped: no inference model is configuredThe shape of a result, not a transcript: two hits with their citations and rings, then the two caveats a fresh install prints on every query until a model is configured.
New in 0.8
0.8.0 came out on 27 October 2026. Each point is described further down this page; this is the short version.
Speech to text, locally
cyberbrain transcribe turns a voice memo or a meeting into a note, through a whisper.cpp server on your own machine. The page gets a microphone button for dictating.
A signed audit log
policy audit-key --init gives a store an Ed25519 key. Every new row is signed, and verify-export checks an exported bundle against the fingerprint its recipient was given.
Decoys
cyberbrain canary plant puts a credential nobody uses into a note. Any use of it outside that note is refused and recorded as canary.hit.
Tokens with an end date
For MCP clients, for credentials on the hub and for device tokens. Once expired, a token is refused by name, and the refusal is in the audit log.
A hub that speaks up
It can post what needs a person to a webhook its administrator sets, and its page now manages people and invitations for new machines.
A new face
A web page in the style of Windows 11 and a neon brain as the icon. On a German Windows the launcher and the installer speak German.
0.8.1, out the same day, is a fix only: the status page now names the embedding backend correctly. With Ollama it used to say “static”. 0.8.2 closes a gap: a store's own configuration can no longer allow a public server for inference or the hub by itself. That takes your own approval with cyberbrain trust, so a cloned repository cannot send your notes elsewhere. 0.8.3 fixes what our own review of 31 October found: an agent can no longer delete the rules in rings 0 and 1 that bind it, and the Bash guard now also watches the store's configuration and keys.
It says what it did not check
Most retrieval tools return a ranked list and stop. Cyberbrain returns the list and a second list: everything it could not do for this query. A fresh install with no model configured answers every query with two lines it is not allowed to omit:
That is the design, not an error state. An agent reading the result knows the hits came from keyword search alone and that nobody looked for contradicting notes. And an answer that arrives without a citation is treated as a bug.
What it does
Cited, every time
Each retrieved statement carries an identifier like r2-867ef2a8cd01. It resolves back to the exact source block, so an agent can quote a note and a human can check the quote. A result without one is a bug, not a shortcut.
Trust rings 0 to 4
Notes live in rings. Ring 0 holds the operator's invariants and overrides everything. Rings 0 and 1 are injected into every session, under a size cap so they cannot crowd out the actual work.
Contradictions are reported, not resolved
When two blocks disagree, the lower ring wins and the conflict is named in the result. Nothing is quietly merged on your behalf.
Plain Markdown, and it stays yours
Notes are Markdown files with YAML frontmatter. You can read, edit and grep them without the tool. The index is a disposable cache; the audit log is a separate, append-only file.
One binary, nothing at runtime
Linux, Windows and macOS (Apple silicon). No system SQLite, no OpenSSL, no model server, no Node. Copy the file and run it.
Hybrid retrieval, all local
BM25 over SQLite FTS5, fused with cosine similarity over static embeddings computed on your machine. No embedding API is called.
A session becomes a proposal
After a session, on request, the local model summarises what was decided and what is still open. The summary does not go into the memory: it waits as a proposal until a person accepts it. Tool output and the injected rings are left out, and a long session keeps its end.
In Claude Code without a detour
The plugin brings a search command that answers from the memory without a model turn, and a notice when Claude Code compacts the context, so you know that what was not written down is about to be gone.
Speech to text, on your machine
A voice memo, a meeting or a video with sound becomes a note through a whisper.cpp server on your own machine, written the way every note is written: PII check, audit row, index. On the page a microphone button dictates into the search field and the editor, and nothing is saved until you save. Off until you name the server.
Search as of a day
recall --stand searches the store as it looked on a given date. The page marks what has been superseded since, what is no longer valid and what was not yet valid on that day.
Changes you can see before you accept them
When an agent proposes a change to an existing note, the approval shows a line diff against the current text, so a person accepts the change and not just a title.
The rings stay in view
Claude Code shows a hook's output in full only up to 10,000 characters. Session start therefore comes in two parts, the rings alone in the first, so that a long handoff note cannot push your invariants into a preview.
What comes from outside waits for a person
Notes can say where their text came from, and text from a mail, a web page or another agent is marked as such in every result. When an agent files it, it does not become a note: it waits as a proposal until a person accepts it, in the web UI or through an approval in AgentGuard. An integration can be marked untrusted as a whole and limited to its own areas, so it cannot claim otherwise and cannot read the rest of the memory.
What it looks like
The page is compiled into the binary, served by cyberbrain serve, and fetches nothing from the network. Since 0.8.0 it has the look of Windows 11: a sidebar with work, operations and tools, cards that tell apart working, not set up and broken.
Screenshots of version 0.8.0 with a demo store; the notes in it are made up. The page is shown in German here and speaks English as well. These are captures of the real interface, not AI images.
How the rings work
Trust is a property of the note, not of the query. Five rings, one short rule: when two blocks contradict each other, the lower ring wins.
Lower ring wins. The conflict is reported in the result, not resolved silently.
Search on day one, and after
A landing page that hides this produces a bad first run, so here it is: semantic search needs a model artefact you place yourself. Nothing is downloaded without your explicit consent.
Lexical, always
BM25 over SQLite FTS5 is built in and works the moment notes exist. It needs no model and no network.
Semantic, once you add a model
Cosine similarity over static embeddings, computed locally. Until the model artefact is in place, search stays lexical, and every result says so in the caveats.
Fused
With both available, the two rankings are fused into one list, and the semantic caveat goes away because there is nothing left unchecked on that axis.
Optional local inference
Some checks need a language model; the contradiction check is one. Cyberbrain talks to any OpenAI-compatible endpoint and contains no vendor-specific code. Anything that speaks that API is a valid backend.
http://127.0.0.1:11434/v1
The usual local servers, at the default address or wherever you point the endpoint. The status page says which one answered.
Released 3 September 2026 under Apache-2.0. It spreads local inference across RTX 20-series and newer, DGX Spark and Apple M4 and later machines, discovered over mDNS and paired with mTLS. Cyberbrain has no PAIR-specific code; it reaches PAIR because PAIR speaks the same API. We have not tested against a PAIR setup ourselves, and say so rather than let the logo imply it. PAIR passes on the answer of the engine behind it, so the status page names that engine rather than PAIR.
Inference is optional. Without it, the checks that need a model are skipped, and the result names which ones. When it runs on hardware you control, there is no processor and no third-country transfer to document.
What hardware this needs
A laptop. There is no large model to host here. Semantic search uses static embeddings: a table, not a forward pass through a network. A word is looked up, the words of a block are averaged, and 256 numbers come out. That is why one CPU core is enough, and why the file on disk is larger than the work it does — what takes up the space is vocabulary, not computation.
- 1 your question
- 2 look each word up
- 3 average them
- 4 256 numbers
No forward pass, no GPU, no model server, no warm-up. The same four steps ran over every block when the index was built, which is why the search itself is a dot product and nothing more.
Install nothing
Lexical search over SQLite FTS5, rings, citations, the audit log. Everything except semantic search.
- 15 MB
- memory per call
- 10 ms
- a search across 4,960 blocks
- 1.1 s
- to rebuild the whole index
Drop in the embedding model
Semantic search: a question in the words you would use finds the note written in someone else's.
- 584 MB
- peak while a search runs
- 9 ms
- a search once the daemon holds the model; 1.2 s from cold
- 507 MB
- on disk, and 4.5 s to rebuild the index
Point it at an inference endpoint
The contradiction check: hits are held against each other instead of merely listed next to each other.
- 126 s
- one check with a 7B model on this CPU-only server
- 3 s
- the budget, after which hits come back unchecked and say so
- 0 GB
- in Cyberbrain itself — the model runs in its own process
Measured on 29 September 2026 with v0.7.4 on a server with no GPU (AMD EPYC-Milan, 12 vCPU, 23 GB RAM) against a corpus of 1,516 notes and 4,960 blocks. The first start after the model is put in place checks its hash once and peaks at about 1.1 GB; every start after that is the figure above. Your numbers will differ with your corpus; the point is the order of magnitude. Step 2 is the only one that wants better hardware, and it is the only one that is optional twice over: without it, the check is skipped and the result says it was.
Compliance is a subsystem
Not a page in the docs that asserts things about the code. These are commands and data structures. They can be enumerated, run and tested.
Every path by which data can leave the process, as an enumerable list, with what each one carries and whether it is on. Today it has nine entries and ends with the line "Telemetry does not exist."
Removes the note, its blocks, its vectors, its index rows and every derivative in one transaction. Nothing is left in a cache to resurface later. forget --report writes an erasure report somebody else can check, signed with the store's key if you ask.
A subject-access export for Art. 15 requests.
A write that appears to contain personal data is held for the operator's decision. It is not redacted behind your back.
A separate file with a blake3 hash chain. verify walks the chain, names the first altered row and exits non-zero, so a nightly check fails instead of quietly passing. With an audit key every new row is also signed with Ed25519, so an export proves more than that it agrees with itself.
A planted credential nobody uses, in a note that reads like the real thing. Used anywhere outside that note, in a tool call or in a note being written, it is refused, counted and recorded. The value itself never appears in the log, an alert or an answer, only its fingerprint.
Applied on request, per note, rather than as a global sweep.
What the active profile claims the law says, line by line, each with the article it rests on and how sure the author is of it. On the compliance screen and from the command line.
Profiles: eu, ch, off
Switzerland is a separate profile rather than "EU minus something". The revised FADP differs from the GDPR in substance, and folding the two into one profile produces claims that are wrong in one of the two countries.
eu
GDPR
ch
revised FADP
off
compliance behaviour switched off
Evidence, not assurance
The GDPR applies today. That is what most of this is for: erasure, subject access, a record of what was processed, and the ability to show what actually happened rather than what the manual says should have happened. What a tool can contribute is artefacts, and these are the ones it produces.
An audit log you can hand over
Append-only, one row per operation, blake3-chained. verify walks the chain, names the first altered row and exits non-zero. With an audit key the rows are signed, and the recipient of an export checks it with verify-export against the fingerprint you gave them beforehand.
Erasure with a receipt
The note, its blocks, its vectors, its index rows and its derivatives in one transaction, and two audit rows: that it was asked for, and that it happened. The erasure report names both rows and can be signed.
A subject access answer
Everything the store holds about an identifier, with citations, in a form that can be handed to the person who asked. The search itself is audited.
Data flows you can enumerate
The egress register is closed at compile time and printable. Nine entries today, each off until it is configured, and the last line reads: Telemetry does not exist.
A model card
Identity, source, licence, hash, intended use and limits of every model in play. What a technical file needs, and what an endpoint model cannot tell you about itself.
The AI Act moved. Under the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) the high-risk obligations for standalone Annex III systems shifted to 2 December 2027 and for Annex I products to 2 August 2028; the Article 50 transparency duties have applied since 2 August 2026. Nothing about the GDPR moved. So what you have to show today, you have to show because of the GDPR — and what you will have to show in 2027 is easier to collect from today than to reconstruct then.
What this is not: a conformity assessment, a CE mark, a risk management system or a certification. Using it makes nobody compliant. And the artefacts describe Cyberbrain itself — what it retrieved, what it sent to which model, what it erased. They are the part of your file that covers the memory, not the file.
Surfaces
Four ways in, all served by the same binary.
Everything is reachable from the command line.
Fire on agent lifecycle events. Measured with 0.8.1 on a store of 1,300 notes and 105,000 audit rows, process start included: p99 7 to 9 ms against a 15 ms budget. session-start, which hands over rings 0 and 1, takes 17 ms against its 150 ms budget.
For any client that speaks the Model Context Protocol, in its current revision (2026-07-28) and the earlier ones. Over HTTP each client gets its own token and its own name in the audit log, for agents that cannot start a process on the machine, such as n8n in a container. A token can carry an end date and is refused by name after it.
Served from the binary, in English and German, in the style of Windows 11. It has its own command line, and a microphone button once transcription is set up. There is no separate frontend to install.
Where it stands
The numbers a landing page usually leaves out.
- It has been run against one operator's real corpus: 1,086 notes across five projects. Not much else. Expect edges.
- Semantic search needs a model artefact you place yourself. Nothing is downloaded without your explicit consent. Until then search is lexical, and says so.
- The contradiction check needs an inference endpoint. Without one it is skipped, and says so. It also has a time budget: on a machine where one check takes two minutes, the hits come back anyway and the result says the check did not run.
- Binaries for Linux, Windows and macOS hang on the release with a checksum file, cargo install cyberbrain builds it from source, and in Claude Code it installs as a plugin.
Three other ways to have it
Each of these was announced on this page while it was still a plan, and each is out now. They are kept here rather than folded into the feature list because none of them is Cyberbrain itself: one is a smaller product, one is a different way into the same one, and one is what happens when a team rather than a person has to show what its agents did.
Memory protection for agents
out now, in v0.7.6Provenance on every note, quarantine for what agents bring in from outside, approval by a person in the web UI or through AgentGuard, and limits per integration. Built for the case where an agent reads a mail or a web page and is meant to remember it, without anyone being able to plant an instruction that way.
How we set it up (German)Cyberbrain Light
out nowThe same citations, the same rings, the same store, without the model and without the compliance subsystem. Keyword search only, one 5 MB binary, nothing to place and no network code in it at all. Its own product in its own repository, and nothing was taken out of Cyberbrain to make it.
Cyberbrain LightA desktop application for Windows
out nowAn installer and a Start menu entry instead of a terminal. It asks once which project to open, starts the server on a port Windows picks, opens your browser at it and waits in the notification area. Right-click for the project folder, a different project, Start with Windows (off by default) or quit. On a German Windows the launcher and the installer speak German. The page and the API are the ones the command line serves; this is the way in, not a second product.
Cyberbrain for WindowsOne machine collects what the others did
out now, needs a licenceA team keeps its notes where it always did — on each person's machine, in each person's store. What one machine collects is the audit trail: which machine did what kind of thing, when, in a chain that cannot be edited afterwards without it showing. By default it holds no note text; a team that wants the same handover note on four desks can switch sharing on for a bereich, and a second person has to countersign that, while rings 0 and 1 never travel. On Windows it runs as a service and the installer registers it; its own page shows the licence, the seats in use, the people with a role, the invitations for new machines and which machines are reporting, with what is wrong first. What needs a person, such as a countersignature waiting, a licence running out, a machine quiet for 48 hours or a token about to expire, it can post to a webhook its administrator sets. What it collects crosses the network encrypted: it makes its own certificate where there is no authority to ask for one, and each machine is invited with the fingerprint of the certificate it should expect — so a delivery reaches that collector or none at all. Reading somebody's activity is a separate procedure that needs a second person to approve it, modelled on how works agreements handle access to video recordings.
How a team runs itLicence
FSL-1.1-ALv2. The source is available, and you may use it for anything except building a competing product. Two years after a release ships, that release becomes Apache-2.0.
Provenance
Cyberbrain is an independent work, written from scratch under a clean-room discipline. It shares no source code with any other memory tool and carries its own licence.
Krynex Labs
Built by Krynex Labs
Krynex Labs builds AI agents, automations and LLM systems for companies that measure them in revenue. Cyberbrain comes out of that work, and the corpus it has been run against is ours.
What we do →FAQ
What is Cyberbrain?
A memory for AI coding agents: notes in plain Markdown, a disposable index, and retrieval that returns cited statements with trust rings and a list of what was not checked. One native binary for Linux, Windows and macOS, with nothing else needed at runtime.
Can I install it?
Yes. cargo install cyberbrain builds it from crates.io, or take a binary for Linux, Windows or macOS from the v0.8.4 release on GitHub and check it against the SHA256SUMS file that ships with it. On Windows there is also an installer on that release, which adds a Start menu entry that opens the page without a terminal. Nothing else is needed at runtime. In Claude Code there is a plugin as well: /plugin marketplace add bassprofressor-lab/krynex-plugins, then /plugin install cyberbrain@krynex-plugins.
Can a team use it?
Yes, and the interesting half of the answer is what does not move. Each person keeps their notes on their own machine, in their own store, exactly as before. One machine can be licensed to collect the audit trail of the others: which machine did what kind of thing, when, in a hash chain that cannot be edited afterwards without it showing. By default that machine has no notes, no index and no search, and what a note said stays on the machine that holds it. Sharing notes is a switch per bereich that a second person has to countersign, and rings 0 and 1 never travel. It runs as a Windows service or a systemd unit, and its own page shows the licence, the seats in use, the people with a role and which machines are reporting. Reading one person's activity is a separate procedure with a named reason that somebody else has to countersign, modelled on how works agreements handle access to video recordings; the request, the approval and the disclosure are themselves entries in a chain.
What hardware does it need?
A laptop. Without the embedding model it uses 15 MB of memory and answers a search across 4,960 blocks in 10 milliseconds. With the model, a search peaks at 584 MB; from cold it takes 1.2 seconds, most of that loading the model, and 9 milliseconds once the background daemon holds it. The whole index rebuilds in 4.5 seconds. No GPU: the embeddings are static, a table lookup and an average rather than a forward pass. Only the optional contradiction check wants better hardware, and it says so when it is skipped. Measured on 29 September 2026 with v0.7.4 on a server with no GPU against 1,516 notes.
Does it need a model?
No. Lexical search over SQLite FTS5 works without one. Semantic search needs a static-embedding model artefact you place yourself, and the contradiction check needs an inference endpoint. Nothing is downloaded without your consent, and every result names what was skipped.
Does anything leave my machine?
The egress register lists every path out of the process; today it has nine entries, each off until you configure it, and it ends with the line "Telemetry does not exist." Inference, if you enable it, goes to the OpenAI-compatible endpoint you configure, by default one on 127.0.0.1. cyberbrain policy egress shows what is on for your machine.
Can I dictate notes?
Yes, since 0.8.0. cyberbrain transcribe sends a recording to a whisper.cpp server on your own machine and writes the text as a note, with PII check and audit row, by default in ring 3. On the page a microphone button puts dictated text into the field, and it is saved only when you save. It stays off until you name the server, and it follows the same rule as inference: loopback or your own network.
What does "trust-tiered" mean?
Notes live in rings 0 to 4. Ring 0 is the operator's invariants and overrides everything; rings 0 and 1 are injected into every session under a size cap. When two blocks contradict, the lower ring wins and the conflict is reported instead of silently resolved.
How does it connect to an agent?
Through six agent hooks, an MCP server over stdio or HTTP, the CLI, and a web UI served from the binary. Measured with 0.8.1 on a large store, process start included, the hooks reach a p99 of 7 to 9 ms against a 15 ms budget; session-start, which hands over the resident memory, 17 ms against 150 ms.
What licence is it under?
FSL-1.1-ALv2. Source-available; use it for anything except building a competing product. Each release becomes Apache-2.0 two years after it ships.
Try it, or say what is missing
It is out: seven crates on crates.io, binaries on the release page. If you have a corpus you would like it run against, or something your case needs and it does not do, use the contact form and mention Cyberbrain.
The form is in German. Writing in English is fine.