What changed in the product, in the order it happened, including the decisions that made it smaller. Written for people using it, not as an engineering diary.
Shipped on macOS, Windows and Linux. A 0.6.4 store opens unchanged. Sync. A temporary failure never marks a file as forgotten: a file that keeps failing is recorded for diagnostics only and is tried again after every restart, and a model worker that dies on one file is counted for that file so the others carry on. A folder file or chunk that can no longer be read is now replaced or forgotten with a plain stub, so it no longer blocks its folder or removing a connector. Clients. A caller whose program cannot be identified counts as outside the install, a block on a program name holds even when the program hides itself, and the Windows program lookup is implemented. ChatGPT relay grants are capped and rate limited, and a blocked grant stays blocked. Folders. Folders added with set-includes keep the secret-file-name skip in any letter case, and the command shows what it will index. A forgotten synced file can be listed and resumed from the tray. Under the hood. Forgetting a record that cannot be read back is refused instead of writing an empty marker, compaction no longer rereads records under the write lock, format_versions reads the headers on disk, and every tool now has a title. Known limits. Windows installers are unsigned and have not been run by us on a Windows machine.
Shipped on macOS, Windows and Linux. A 0.6.3 store opens unchanged. Storage. The store now keeps a per-segment ledger of forgotten folder content, so compaction rewrites segments that hold only small stubs, the storage report separates live, stub, pending and unindexed bytes, and the daily pass no longer reads every forgotten record. Folder sync. A temporary failure (a locked store, a full disk, an interrupted read, a model worker that is down) now leaves the file's earlier text searchable and the next pass tries again. A failure that repeats three times for the same file contents is recorded as failed. connector_sync set-includes lets one connector sync folders the default skip list leaves out, such as logs or build. The default list is unchanged. Under the hood. Format headers record a readable range and diagnostics show the on-disk versions. Compaction keeps a forgotten record that cannot be purged yet as stored instead of recompressing it every pass. Known limits. Windows installers are unsigned and have not been run by us on a Windows machine.
Shipped on macOS, Windows and Linux. A 0.6.2 store opens unchanged. Restart ModelBrain after you upgrade: the ChatGPT relay now proves itself to the local daemon with a secret the daemon makes when it starts, so an old daemon and a new relay client do not talk until it restarts.
Security. A program on your computer can no longer pose as the ChatGPT relay to skip the Allow prompt. Admin actions (backups, sharing a partition, bulk deletes, exports) are refused to any program that is not part of ModelBrain and to any assistant still waiting for your decision. A backup has to be written outside the store. A forget is checked against the per-minute limit before it runs, and one call that would remove more than 20 objects is refused. The undo list now refuses a new forget before it drops one you could still undo. Config files that hold a token are private from the moment they are created, and revoking a token closes the connections that used it. modelbrain_admin setup tokens --mint NAME makes a token for any assistant, and turning on Require client tokens now lists the assistants that would be locked out first. On Linux and Windows the install folder belongs to you, so client identity is a consent tool for well-behaved programs and not a defence against software already running as you.
Speed and storage. Compaction no longer makes recalls wait behind a queued save. A save reports where its time goes in diagnostics.remember_latency, and its duplicate check runs after the write lock is released. Forgetting folder content now leaves a small stub straight away instead of a full copy, so narrowing a connector no longer writes hundreds of megabytes, and a store with many forgotten files opens with less memory. modelbrain_admin reclaim (and "Free space from forgotten folder data" in the menu) clears forgotten folder content immediately instead of at the next daily pass. Model isolation turns on again after repeated crashes, and with it on a save no longer queues behind the background worker.
Known limits. The small stub left for each forgotten folder file stays in the index; removing those is planned for 0.7. A lone double quote in a CSV can still swallow up to 50 rows. Windows installers are unsigned and have not been run by us on a Windows machine.
Shipped on macOS, Windows and Linux. A 0.6.1 store opens unchanged and nothing is rewritten on disk. This release comes from a full review of 0.6.1 and is mostly about files that were being mangled or dropped by mistake.
Synced files. The secret scan now replaces only the matched text, so one key in a paragraph no longer drops the paragraph. Obsidian properties such as position and publish are no longer treated as secrets, and a hex api_key or a UUID secret_id is still redacted. A credentials file that puts a key id beside its secret now has both redacted. The prompt-injection scan is stricter about what it flags, so a line like System: Ubuntu 24.04 passes. A flagged chunk is moved down the recall ranking, not removed: in a synthetic test its mean rank went from 30.8 to 100.3 of about 102 to 106 hits. Text, PDF and Office files no longer show a stray \#, and YAML and CSV edge cases chunk correctly. Changes apply to files synced after the upgrade.
Clients and undo. The forget limit now follows each client across reconnects. Undoing a forget in revert mode restores one live version. A program that introduces more than five new client names in ten minutes is refused until you decide on the pending ones. modelbrain_admin setup tokens --revoke <label> shuts out a token, and the connected clients list shows which token label each client used, and flags a label that does not look like the client's name. That flag is visibility only; revoking the label is what locks a token out. Config files that hold a token are set to owner-only permissions on macOS and Linux.
Known limits. A local process can declare itself a relay connection and skip the token check; the hosted relay's forget budget is shared across grants; a lone double quote in a CSV can swallow up to 50 rows. Windows installers are still unsigned.
Shipped on macOS, Windows and Linux. A first 0.6.0 build was on this site for macOS for a few hours and was withdrawn after a full review found problems; 0.6.1 is the build to install, and it carries the fixes from that review. Read this first: a store written by 0.6 will not open in 0.5.x. Each memory now records which client and session wrote it, and a 0.5.x build cannot decode that, so it refuses to open the store and changes nothing on disk. Stores written by 0.5.x open normally in 0.6. A 0.5.x build that opens a 0.6 store says it found a corrupt record. That is not damage: the store is intact, and installing 0.6 again opens it as it was. Restore a 0.5.x backup only if you mean to stay on 0.5.x.
What you will see. recall no longer returns score or pending (both deprecated since 0.5.2), and repeated chunks of one synced file now fold into the file's best chunk by default (collapse_sources: false gives every chunk). Chunking is tighter for PDF, slides, sheets, Word, CSV and YAML, and lines that look like keys or tokens are dropped from synced files before they are stored. After the upgrade every synced file is re-indexed once, in stages, and the old chunks stay searchable until each file is swapped. forget is limited to 20 destructive calls a minute, and recent forgets can be undone from the menu (Undo recent forgets). The menu asks Allow or Block the first time an assistant connects. A project folder can carry a .modelbrain.toml that binds it to a partition, and modelbrain_admin setup project --partition NAME writes the matching .mcp.json. export --history also writes replaced versions.
Underneath. Recalls now share the store and run at the same time, compaction holds the write lock only for the swap, and opening a 190,000-chunk test store takes about 0.9 seconds. The embedding model can run in a child process, which turns on by itself after a panic or two abnormal exits. The file watcher falls back to polling and rescans when a watch goes silent. MODELBRAIN_STORE_LOCK=exclusive returns to one operation at a time if you suspect the shared reads.
Not in this release. Dropping the tombstone entries that remain after forgets, the last part of the injection-list work, and batch embedding during ingest. The macOS installer is signed and notarized. The Windows installers are not code-signed yet, and they have been built but not yet run on real Windows hardware.
Shipped on macOS, Windows and Linux. Nothing here needs action when you upgrade, no stored data changes, and the tools your assistant uses are unchanged.
Export. modelbrain_admin export --out <folder> writes your saved memories as plain files: one Markdown file per memory in a folder per partition, or a single memories.jsonl with --format jsonl. It needs the app running, never overwrites (the folder must be new or empty), writes only the current version of each memory, and skips synced folder chunks unless you add --include-synced.
Recall. modelbrain_admin recall <words> searches your memories from a terminal and prints the best matches. On Linux the install script links the tool as modelbrain.
What was checked. Both commands were run against a live ModelBrain with the real search model on Linux x86_64, and automated tests cover the rest. They were not hand-checked on Windows or on a large store, and the Windows installers and Linux aarch64 build have not been run. Details: Export and search from the command line.
Shipped on macOS, Windows and Linux. Nothing here needs action when you upgrade, and no stored data changes. The Linux package is command line only, so it has no setup guide and none of the new assistant cards; its install script still registers Claude Code and Cursor with --setup. The recall changes below apply to Linux as well.
Setup guide: five more assistants. Antigravity, Gemini CLI, Codex CLI, Cline and Devin Desktop (formerly Windsurf) get a card in the setup guide. A card appears only when the assistant is already on the computer. One click adds a modelbrain entry to that assistant's MCP config, keeps every other server, and saves a one-time copy of the original file beside it as .bak-original. A file that cannot be parsed is left alone, and running setup twice changes nothing. The uninstaller removes only the entry that points at ModelBrain. Connected badges now recognise Antigravity.
What was checked. Antigravity was hand-checked on the released macOS build: setup wrote a valid file, Antigravity loaded ModelBrain, and remember, recall, expand and forget ran without errors. Gemini CLI's manual config was checked, but not the setup button. Codex CLI, Cline and Devin Desktop are tested on fixtures only, and their config locations come from the vendors' docs.
Recall. recall takes an optional as_of date (YYYY-MM-DD) so that relative dates such as "5 days ago" resolve against that day. It has an effect only when the server runs with MODELBRAIN_DATE_SLOT=1, which is off by default. A memory tagged role:user gets a small ranking bonus (default 0.012, MODELBRAIN_USER_BONUS=0 turns it off); untagged memories are unaffected. An optional reranker for filtered queries exists, but the installers do not bundle its model file, so installed copies recall exactly as before.
Known issues. The Windows installers are still unsigned, so SmartScreen shows a warning. The Windows builds were made on Linux and have not been run on real Windows hardware. The setup cards for the new assistants have not been tried on Windows. The Linux x86_64 package was started and answered a ping in a cloud test; the Linux aarch64 package was built but has not been run.
Shipped on macOS, Windows and Linux. Nothing here needs action when you upgrade.
Setup guide (macOS and Windows). The tray app now opens a short guide on launch that replaces the old Client Setup window. It has five screens: a welcome, an optional free account, where the tray icon lives, connecting your assistants, and how it works. It keeps showing on each launch until you tick Don't show this again or sign in, and the tray's Setup guide item reopens it any time. If you are already signed in, it says so and lets you continue or switch accounts. The connect step shows Connected, last used next to an assistant once it has called ModelBrain, read from a log that stays on your computer. The ChatGPT row asks for a free account, then turns on sharing, copies the connector address and opens the ChatGPT guide.
No console windows on Windows. The tray, the update check, model downloads and the helper tools no longer open black command prompt windows, and the server that ChatGPT starts no longer opens one that stays up. On 0.4.3 the relay client ran in such a window, and closing it ended the ChatGPT connection, which left the computer unlisted at ChatGPT's sign-in with No computer is ready. The relay client now runs with no window to close.
Clearer ChatGPT sign-in. When ChatGPT replays a registration that the service no longer has, the page now tells you to delete the ModelBrain plugin in ChatGPT and add it again, instead of showing a bare error line.
Linux. The Linux package is command line only, so it has no setup guide. It differs from 0.4.3 only by the version number.
Known issues. The Windows installer is still unsigned, so SmartScreen shows a warning. The Windows builds were made on Linux and have not been run on real Windows hardware. The Connected badge for Cursor, Claude Code and ChatGPT may not appear until confirmed on real use.
Two things change right after you upgrade. First, the text of a synced folder chunk that was forgotten, replaced by a re-sync or left behind by a removed folder is now purged after 24 hours instead of 30 days, and the purge cannot be undone. Memories you saved by hand keep their 30 day window. The first purge after the upgrade can remove a backlog at once. Second, recall now folds identical passages by default: when the same text appears word for word in several synced files, such as the working copies of one repository, you get it once, with the other files listed in also_in.
Safer storage. A damaged length in the middle of committed data no longer makes recovery cut off everything after it: the store refuses to open, leaves every file untouched and tells you, so you can restore from a backup. A damaged last record opens with the loss reported and a .torn copy kept. Damage inside a record that is kept for the retention window is now reported when the store opens.
Sync. A delete that arrives before its create no longer brings the memory back. Two devices that move a memory or rename a partition at the same moment now agree on the winner. Long memories are forgotten and moved as a whole. Local backups now remember which partitions are local only, and a restore brings that back.
Recall and tools. Ties rank the same on every machine, scores no longer drift after a restart, and recall returns the same top hits for a smaller k as for a larger one. expand returns the whole long memory from any piece. usage shows the last 7 days with p50 and p95. list_memories pages with a cursor. Out of range k, limit and usage arguments now return a clear invalid_params error instead of being clamped. collapse_sources is available but off by default, because it can hide a needed neighbouring chunk.
Hardening. About 80 defects found by seven independent test rounds are fixed, including linear time reading of hostile Obsidian notes, bounded spreadsheet extraction, secret looking frontmatter keys never being indexed, safer uninstall and config repair, and a Windows style path fix for exclusions. The storage_report test flake is fixed.
Known issues. A last record damaged in both its length and its contents looks the same as a torn write and is reported as a loss. A run of zero bytes longer than 64 MiB at the end of a segment is refused. A long memory that 0.4.2 split across partitions is not rejoined. Delete markers that arrive early are kept in every sync base for good. Convergence for early deletes holds only among 0.4.3 devices. Chunking a single 100 MB line is slow.
The pairing code is gone. In the tray, choose Connect to ChatGPT, then add the app in ChatGPT and sign in with Google, Microsoft, Apple or an emailed code. If you have several computers, you pick which one ChatGPT uses (give each a different name). You get an email for every new connection, and Stop sharing with ChatGPT in the tray turns it off at any time. The tray also has a ChatGPT Setup Guide link and shows the version. If an app you connected earlier stops answering, add it again once. A keepalive keeps the connection from dropping while idle. Linux and Windows get the same helper. The ChatGPT guide has the steps.
The pricing page leads with what sync adds, shows a worked cost example, and has Download free and Start syncing buttons. Start syncing opens the account page on the plan you picked, yearly or monthly. The account page no longer calls the free plan "no account features".
The terms and the privacy policy now say that paid plans are sold through Stripe Managed Payments, where Link, a Stripe service, is the merchant of record, collects and pays sales tax, VAT and GST, and appears on your card statement. Nothing else about prices, cancelling or what we hold changed.
Teams is now available: shared partitions your team remembers into and recalls from, with roles, per-partition access, single sign-on and an audit log, end-to-end encrypted with keys only members' computers hold. It is $6 a node a month billed yearly, or $8 monthly, $4 a node past 25, and shared storage is $0.05 per GB a month. Start from the team console on the account page. Payments are handled by Link, a Stripe service, as the merchant of record.
Device sync and managed backup are now available on the paid plan: $6 per device a month billed yearly, or $8 monthly, with storage at $0.05 per GB a month, billed on what you use. Payments are handled by Link, a Stripe service, as the merchant of record: it adds sales tax, VAT or GST where it applies and pays it for you. The free plan is unchanged.
Paid features are switched on by a signed token from ModelBrain's server. The app used to fetch the signing key from the server the first time it needed it. It now ships with that key built in and refuses a token signed by anything else. Nothing changes for you today. Linux has no account features and stays at 0.3.19.
The Linux command line package for x86_64 and aarch64 now carries everything in 0.3.19, including the sync and cleanup fixes listed below. It still needs glibc 2.28 or newer and installs under your home folder with no root access.
The sync change in this release skips leftover markers from old cleanups. In one rare case, a memory you had only just forgotten could look like one of those leftovers and not be sent. Sync now skips a marker only when it is older than the 30 day window, so a fresh forget is always sent.
ModelBrain keeps a marker for anything removed for 30 days, then clears it. After that cleanup, the markers for file chunks from your folders could look like memories you had deleted, and sync would have sent one record for each of them. Sync now skips those markers, and the cleanup keeps enough of each marker to tell a file chunk from a memory you forgot.
The hourly cleanup used to look through every removed item on every pass. It now does that check at most once a day, so the store stays responsive. The other cleanup steps still run every hour.
The Sync card shows one figure, the storage your account uses on our servers. It also says that files from your folders are not synced to ModelBrain's servers and are not part of server restore points, and that only memories you save are synced. A separate line shows how much space ModelBrain uses on this computer.
After ModelBrain was restarted, new memories could be left out of sync while the account window still said it was synced, and a backup then reported that nothing had synced yet. The sync log now keeps counting from where it left off. A computer hurt by this sends its memories again once, the first time you sync after updating.
If a partition is set to stay local, the Sync card now names it and has a button to start syncing it. It also says how many changes are waiting to be sent.
The background service used to read each saved secret from the Keychain on every sync round, so a secret not yet approved could bring up the same prompt again and again. It now reads each one once per run and remembers a refusal for ten minutes. After updating, expect one prompt.
The installer now adds a login item on macOS and a start-at-sign-in entry on Windows. You can turn either off in your system settings, and uninstalling removes it. On Windows it can take a minute after sign-in to appear.
After a restart only the menu bar or tray app used to start, and the background service waited for an AI app to connect, so syncing sat idle. The app now starts the service when it opens if nothing is answering.
Replaced in 0.3.19 by a single figure for the storage your account uses on our servers.
If you added a vault while ModelBrain was partway through syncing a large folder, the new vault waited until that sync finished, which could take minutes, and only a restart sped it up. Adding, pausing or removing a folder now interrupts the running sync, and a folder that has never synced goes first. Files already synced are skipped by their content hash, so nothing is read twice.
The account page now offers Continue with Google, Continue with Microsoft and Continue with Apple next to the emailed code. We ask each one only for your email address, and use it only if that provider has confirmed it; a Microsoft work or school address is accepted only when Microsoft says its organization owns that domain. The emailed code still works for everyone. How signing in works.
Wikilinks, aliases, tags, frontmatter, embeds, canvas files and Obsidian's Excluded files setting are now understood, and %%comments%% and properties with secret-like names are never stored. Search can be limited to a folder or a tag, results name the vault and note, and an assistant can follow a note's links and backlinks. Adding a vault from the menu bar asks which partition it belongs in and whether to skip template folders, and results carry an obsidian:// link that opens the note in Obsidian (checked on macOS). Searching for a note by its title puts that note first. Vaults you added earlier are re-read once on the first sync after you update, and the first sync of a large vault takes a while because every note is read by the local model; after that, changes are picked up within seconds. What is tested.
Each file used to trigger a read of every record already stored, so the time to re-check a folder grew with the square of its size. In a test, re-checking an unchanged 1,200-note folder dropped from about 19 seconds to under a tenth of a second, and a first pass over 20,000 notes now takes about 13 seconds of engine time. Changes to a folder also reach your searches sooner.
Connecting ChatGPT stays free, and now goes through a ModelBrain account: you sign in once, and a new connection works only after you allow it on your computer. You can see and disconnect your ChatGPT connections from your account. If you connected ChatGPT before this change, update ModelBrain, sign in, and connect again with a new pairing code: the ChatGPT guide has the steps.
The privacy policy and terms now describe what was actually built: an account for the free ChatGPT connection, sync and backup encrypted on your computer, and Teams sharing encrypted the same way. The old "server tier" where we could read your memories is gone from both, because nothing like it exists. They also name the companies we use, and say what an account deletion keeps.
ModelBrain now ships for Linux on x86_64 and aarch64 as a tarball with an install script. It needs glibc 2.28 or newer, installs per user with no root, registers with Claude Code and Cursor through modelbrain setup, and reaches ChatGPT through the relay client. It has no tray icon or window. Linux install guide.
The menu bar app's "Repair connection" action for Claude Desktop now checks that Claude Desktop is actually installed first. Before, a stale Repair request could create a Claude Desktop settings folder on a computer that never had the app. Messages from the app, the background service and the command line tools also now use plain punctuation throughout. No change to how recall, remember or partitions behave.
Asking for partition_scope: "all_active" now searches every active partition and overrides the one your connection is bound to; before, it was treated as a partition name. Reserved names such as all_active can no longer be used as partition names and return a reserved_partition_name error. If an older store has a partition literally called that, it stays reachable by id until you rename it. The menu bar app now registers itself with Claude Desktop only when Claude Desktop is actually installed. Windows installers are now at 0.2.4 as well.
The descriptions your AI client reads for remember, recall, list_memories, partition_create and partition_use now name the features that were easy to miss, such as supersedes for correcting a memory and partition_use for binding a session to a partition. A call with a missing required field now returns the accepted fields, which are required, which are optional, and any argument names that were not recognized, so the client can fix the call on its own. Reserved partition names are now listed in the error, including all_active. The setup text ModelBrain gives to AI clients covers partitions and corrections too.
Some text files, often ones exported from Windows tools, failed to sync with a tokenizer error and stayed missing from your memory. They now read correctly, and any file that failed this way before is retried automatically on the next sync, without re-processing everything else. Version 0.2.2.
If a connected app and the background service were pointed at different ModelBrain installs, the error used to say only that the configuration did not match. It now names both locations and says how to fix it: pick the install to keep, then restart.
If ModelBrain was busy saving a longer memory while a second connected app tried to use it at the same time, both could stall, sometimes for a while. The two no longer block each other.
Real downloads on the download page now: a notarized, signed .dmg for Apple Silicon Macs, and x64/ARM64 installers for Windows. The Windows build isn't code-signed yet (a paid step we're deliberately skipping for this release), so it shows an expected SmartScreen warning on first run. Install on macOS · Install on Windows.
This release ships macOS and Windows only. Linux followed on Oct 6, 2026. Platforms, in one table.
Claude Desktop, Claude Code and Cursor already talk to ModelBrain directly, with no network hop. ChatGPT can only reach outside tools through an internet-reachable connector, so this one connection routes through a small relay ModelBrain runs: pair once from the ModelBrain menu, add it as a custom connector in ChatGPT. How to connect it.
Putting your vault in a sync folder would quietly copy it to someone else's servers, and disk encryption doesn't prevent that. It now checks at startup and stops rather than warning.
"We'll check that recall is good" was an intention. It's now a gate with a threshold: one real vault, one assistant, and a demonstrated loop of remembering, correcting and deleting across sessions.
Reading memories quickly depends on the files being readable as-is. Rather than half-build it, we've documented the gap and recommend your operating system's own disk encryption. Why, in detail.
Proving who's connecting is designed; deciding what a given person is allowed to read isn't. The team tier won't ship before that exists, so it stays listed as unavailable rather than "coming soon".
Space management moves memories between faster and slower storage based on what you've actually used recently. Anything marked private is excluded from leaving your machine before that decision is made, and moving something is never the same as forgetting it.