# ModelBrain: full text of the main pages > Generated from modelbrain.net by scripts/gen-llms-full.py. Each section is headed by the page URL. The short index is at https://modelbrain.net/llms.txt. ## https://modelbrain.net/how-it-works.html Title: How ModelBrain works How it works A small program runs quietly on your computer and looks after a folder of memories. When your assistant needs to remember or recall something, it asks that program. The assistant never gets your whole vault: only the few notes that answer the question it's working on, with the date and source attached. If you point it at a folder of your own documents, it asks for your confirmation in person, on that computer, before it reads anything. A change proposed from anywhere else doesn't take effect on its own. Where things live Your assistant Claude, Cursor, or anything else that speaks MCP. Asks questions; gets a handful of notes back. ↓ ↑ ModelBrain, on your computer Does the searching locally. Only it is allowed to write to the vault. ↓ ↑ Your vault Files on your disk, in a location you chose. Back it up like anything else you care about. Changing your mind, and deleting things A correction "Actually, we moved the launch to March." The new note replaces the old one for future answers, and the old one is kept as history. A revert "Go back to what I said before the correction." Forgetting the corrected note does this by default: the current version is removed and the earlier one becomes current again. You can instead remove just that version or the whole correction history. Nothing is invented in between. A deletion "Forget that document." All of it goes, including every piece of it the system had broken out, not just the paragraph you mentioned. From here down it gets technical Nothing above depends on reading this. Local vault → MCP server → any compatible host Hosts Any MCP client over stdio. The thin client forwards fourteen tool names and no others. remember · recall · forget · expand list_memories · diagnostics · usage · ping partition_create · partition_list · partition_use partition_rename · partition_archive · partition_restore Transport One local socket (a Unix socket, or a named pipe on Windows), checked against the OS peer identity. Nothing administrative is reachable from a model. adding a folder happens locally never over MCP, no override Daemon + vault Single writer over append-only segments. Embeddings via llama.cpp, in-process. Full-text and vector indexes over the same objects. index: ULID → (segment, offset) One memory, one object Objects, tags and edges, searched by full text and vector similarity together rather than vector-only. visibility is a real field in the record header that the model can never set; connector provenance is written at ingestion and is not model-writable either. id ULID, 16 raw bytes body type, text, block_type, heading_path, table_data, source_uri, sync_connector_id visibility header enum (never model-set) parent_id chunk → document grouping tags inline list per object edges inline adjacency (supersedes) Layered storage, and which layers exist Layer Role Status Memory Active context, hot indexes. in v1 Regular disk Hot segments, uncompressed and read with ordinary file reads. Not encrypted by ModelBrain; your operating system's disk encryption covers them. in v1 Compressed disk Memories that go cold move here once it is enabled (experimental, off by default), zstd-compressed against a dictionary trained on your own notes rather than a generic one, so old context stops piling up disk space without ever leaving your machine. experimental Private and local-only blocks are removed from the server-eligible set before placement runs. Privacy is a hard filter, never a cost term. And moving a block between layers never changes what a memory means: eviction is not forgetting. ## https://modelbrain.net/architecture.html Title: ModelBrain architecture overview Architecture overview Four layers, read top to bottom: the assistants you already use, the protocol they speak, the program that runs on your computer, and the four storage layers your vault spans. Three of those layers are free because they're your own hardware; only the fourth, the shared server, costs anything. You Ask a question, or say "remember this" Plain conversation, in the app you already use. → Your assistant Passes the request on Claude, Cursor or anything else that supports MCP. A short fixed list of tools, nothing administrative. → ModelBrain Searches your vault and answers Runs on your machine. Returns a handful of notes with dates and sources attached. Optional · folder sync Point it at a folder of your own documents Word, PDF, Markdown and plain text. You approve the folder at the keyboard, once; an assistant can never add one for you. → It reads them into your vault and keeps up with changes: new files are added, edited files are updated, and a file you delete is removed from memory in full, not a paragraph at a time. → Result Your documents become answerable Nothing is uploaded to do this. Reading and indexing happen on your own computer. Folder sync is a read of files you choose; it never writes to them. Scanned pages aren't supported yet. The four layers, and why a memory moves between them A layer is just where a memory physically sits right now. Things you've used lately sit somewhere fast; things you haven't sit somewhere cheap. You never choose a layer, and moving between them changes nothing about what a memory is. Layer 1free In memory Your computer's RAM. What you're working on right now, plus the search indexes. instant smallest rebuilt on restart Layer 2free On your disk Your vault. Everything from the last few months, stored so it can be read without unpacking first. fast uncompressed always available offline Layer 3free Compressed on your disk Older memories you rarely ask about, squeezed down so a long history doesn't fill your drive. slightly slower much smaller still offline · still yours Layer 4paid · opt-in On a server Only if you switch it on: a copy your other device or your team can reach. Never happens by default. needs a connection encrypted on your computer first available now Used often · fast · on your machine Rarely used · cheap · optionally elsewhere What never changes when a memory moves What it says, when you saved it, and where it came from. Whether it's deleted. Moving a memory to a cheaper layer is not forgetting it, and a deleted memory stays deleted wherever it sits. Its version history, so a correction is still a correction after the move. Whether your assistant can recall it: every layer is searchable. A layer affects speed and space, never answers. What decides where something sits How recently it was used. That's the whole rule in the first version, simple enough to check, and it produces the data that would justify anything cleverer. Anything private is removed from what's even eligible for Layer 4 before placement runs. Privacy is a filter, not a factor weighed against saving space. Layers 1-3 are all your own hardware, so nothing leaves your computer as a memory ages. Only turning on Layer 4 changes that. Layer 1 Your assistant Claude Desktop Claude Code Cursor any MCP client Layer 2 The fourteen requests rememberrecallforgetexpandlist_memoriesplus six partition tools and three read-only checks (diagnostics, usage, ping), over a local socket, and nothing administrative is in this vocabulary Layer 3 ModelBrain, on your computer One program. One writer. No daemon to babysit, no Python, no separate database. Write path Embed, encode, append, flush to disk, update the index. Read path Filter, over-fetch by similarity, rescore. Keywords and meaning together. Embeddings llama.cpp, in-process, on your CPU. No API call. Connectors Reads folders you approved at the keyboard. Markdown, TXT, PDF, DOCX. Layer 4 Where memories sit Moving between layers never changes what a memory means. Eviction is not forgetting. Layers 1-2 · free foreverEverything on your own machine. No account, no limit on size. 1 · Memory (RAM)free · in v1 What you're working on now, plus the hot search indexes. Fastest, smallest, not durable on its own. 2 · Regular diskfree · in v1 Your vault. Read directly with no decompression step, which is why it isn't compressed or encrypted here. Layer 3 · experimental, off by defaultStill your disk, still free. Layer 4 below is the paid one. 3 · Compressed diskfree · experimental Older memories, still on your machine and still available offline, taking less space. Experimental and off by default. Free, because it's your disk. 4 · Serverpaid · opt-in The only layer that costs money: a shared collection for your own second device or a team. Anything private is excluded before a block is even eligible to go here. Why one program instead of a stack Search, storage and embeddings are in the same binary, so there's nothing to install alongside it and nothing that can be up while something else is down. It also means the whole thing runs with no network access at all. Why one writer Exactly one part of the program is allowed to change your vault. Housekeeping and layer movement publish their work through it rather than writing in parallel, which is how deletions stay deleted across a restart. ## https://modelbrain.net/docs.html Title: ModelBrain docs: the MCP tool surface Docs ModelBrain exposes a small, fixed surface to your assistant over MCP: fourteen tools. Four handle remembering, recalling, correcting and forgetting; one lists memories without a query; six organize memories into partitions; three are read-only health checks. Everything that manages the installation stays on the command line. Looking for platforms, price, hardware needs and what leaves your computer in one place? Fact sheet → Guides Install ModelBrain Pick macOS, Windows or Linux, and see how each one connects to your assistants. Read the guide → Install on macOS Download, run the .pkg, and where your vault lives. Read the guide → Install on Windows Download, click through SmartScreen, and where your vault lives. Read the guide → Install on Linux Unpack the tarball, run install.sh, and where your vault lives. Read the guide → Connect Claude Desktop Self-registers on launch. No JSON to edit. Read the guide → Connect Claude Code One button in the setup guide. Read the guide → Connect Cursor Same one-button setup, for Cursor. Read the guide → Connect Codex CLI Add one table to config.toml. Manual steps. Read the guide → Connect Gemini CLI Add one entry to settings.json, with trust left off. Read the guide → Connect Cline Open its MCP settings from inside Cline and add one entry. Read the guide → Connect Antigravity Add one entry to Antigravity's MCP file. Hand-tested on a Mac. Read the guide → Connect OpenCode Add one entry under the mcp key. Manual steps. Read the guide → Connect Continue One small YAML file, then switch to agent mode. Read the guide → Connect Hermes Add one entry to config.yaml and reload. Read the guide → Connect Devin Desktop The file still lives in a folder named windsurf. Read the guide → Aider and ModelBrain Aider has no MCP command. What that means, and what to do instead. Read the guide → Connect VS Code servers, not mcpServers: the one key that differs. Read the guide → Connect Zed Add one entry under context_servers. Zed asks before tools run. Read the guide → Connect Goose Let goose configure add it, or edit config.yaml. Read the guide → Connect Roo Code Open the file from its MCP panel and add one entry. Read the guide → Connect LM Studio Add one entry to mcp.json and use a model that can call tools. Read the guide → ModelBrain & ChatGPT Choose Connect to ChatGPT in the menu, add ModelBrain as a plugin in ChatGPT, then sign in and pick the computer. Read the guide → ModelBrain & Grok Turn on sharing in the menu, add a custom connector in Grok with the relay URL, then sign in and pick the computer. New. Read the guide → The ModelBrain menu Every item in the menu bar and system tray menu, and what it does. Read the guide → Clients and permissions The Allow or Block prompt, forget limits, undo, client tokens, and what client identity does not protect against. Read the guide → Your ModelBrain account Sync between computers, backups, ChatGPT, billing, cancelling and deleting. Read the guide → Teams Share a partition with your team: invitations, roles, access, single sign-on and billing. Read the guide → Quickstart Install, connect, add a folder, and test recall in five steps. Read the guide → Instruction tips Copy-paste project instructions and ten tips for steady recall and saving. Read the tips → Add, remove and rescan folders What gets read, what's excluded automatically, and how to remove one. Read the guide → Export and search from the command line Write your memories to plain Markdown or JSON Lines files, or search them from a terminal. Read the guide → Use it with Obsidian Add your Obsidian vault folder and get answers that cite your notes. No plugin. Read the guide → Hardware requirements & tiers RAM/CPU per tier, and how the model is picked for you. Read the guide → Troubleshooting Fixes for the issues people actually hit. Read the guide → Reasoning mode, explained What it does differently from plain search, and what it costs. Read the guide → The fourteen MCP tools Tool Behavior Returns remember Stores a fact, decision, or correction. Can carry an object_type, tags, relations to existing memories, and supersedes to replace an older one instead of duplicating it. Marking it inferred keeps it out of default results until reviewed. key, similar memories, chunk keys for long text recall Searches stored memories for what is relevant to the current conversation. Optional reasoning mode adds a citation-verified answer, or says plainly why it could not. ranked memories with source and relevance, reasoning_status list_memories Lists memories by scope, newest first, with no search query. The right call for "what have you remembered about me" or "what is in this folder." memories in write order expand Pulls the full text of a memory that came back too thin, plus its edges and its correction history on request. Reaches superseded or forgotten memories by key. full text, tags, provenance, edges, history forget Takes an explicit mode, revert by default: revert tombstones the current version and brings the one before it back; chain removes a memory's whole correction history; object removes just the one version named. A connector-synced chunk ignores the mode and forgets its whole source, marked so it is never re-ingested automatically. confirmation, new chain head partition_create Creates a separate namespace for memories, for example one per client or codebase. partition id partition_use Binds this connection to a partition so new memories are saved into it and current resolves to it. Per connection: a new connection has no partition chosen, so it saves into unsorted and searches every active partition until it calls this or is bound by a .modelbrain.toml, --partition or MODELBRAIN_PARTITION. active partition partition_list Lists partitions, including the default one named "unsorted". Archived ones only on request. partitions with ids partition_rename Renames a partition by id. The default partition cannot be renamed. updated partition partition_archive Hides a partition from name lookups without deleting anything. Its memories stay reachable by id. updated partition partition_restore Brings an archived partition back, unless another active one has taken its name. updated partition diagnostics Read-only health report: version, store location, live counts, search mode, per-folder sync state and any files that could not be indexed, degraded status. health report usage Read-only summary of this machine's local tool-call log: calls per tool, empty-recall rate, errors by code. Records names and counts only, never memory content, and stays on this machine. usage summary ping Minimal liveness check that does not touch the store. ok { "tool": "recall", "query": "what did we decide about the pricing tiers", "hits": [ { "key": "01M3...", "relevance": 0.71, "text": "Free tier stays local-only, no device cap.", "source": "user", "tags": ["pricing"], "created_at": "2026-08-14T15:02:11Z", "partition": "Product" } ], "reasoning_status": { "available": true }, "status": "ok" } Reverting to an earlier version is forget's own revert mode, the default; see what a forget call actually has to guarantee. Parameters & limits remember text (required, up to 64 KB), tags, partition, inferred, object_type (free text: architecture_decision/pitfall/convention/verified_command are meaningful conventions, not a fixed enum), relations (edges to existing keys), supersedes (the key this corrects), similar_min_relevance (0.0 to 1.0, how close an existing memory must be to be listed as similar). Returns a key. recall query (required), k (1-50, a hard limit; a value outside that range is rejected, not silently clamped), min_relevance, scope (all/user/connectors/connector:), tags, partition_scope (current/all/all_active/id:/a partition name), reasoning, widen, verify. Since 0.6: collapse_sources (default true: repeated chunks of one synced file fold into the best chunk; false returns every chunk), dedupe_identical, object_type (one value or a list), created_after and created_before (the first must be earlier than the second), folder, branch_scope (default current), as_of. Hits no longer carry score or pending. forget key (required), mode (revert by default, undoing the last correction), chain (tombstone the whole correction history), or object (tombstone just this one). Idempotent: forgetting something already gone isn't an error. expand key (required), edges (include linked memories, default false), history (walk the correction chain backward, default false). piece_only (return just the matching piece of a long memory). Text is cut at 64 KB. Returns found: false rather than erroring on an unknown or forgotten key. list_memories scope (all/user/connectors), tags, limit (1-50, default 20), newest_first, after_key with the returned next_cursor to page, partition_scope, branch_scope, object_type, created_after, created_before. Lists what is stored without searching. usage days (1-90, default 7), sessions (0-50, default 10). Which assistants used ModelBrain, how often, and what they saved or recalled. A connection that has not picked a partition saves into unsorted and searches every active partition. partition_use, a .modelbrain.toml in the project, --partition or MODELBRAIN_PARTITION bind it to one partition for both saving and searching, the same as recall's partition_scope default. all_active reads every active partition at once and overrides that binding. When reasoning can't answer recall called with reasoning on either returns a verified answer or a reasoning_unavailable object naming why, never a guess it couldn't check. Full explanations, in plain language: troubleshooting. reason Meaning model_provisioning The reasoning model is still downloading (one-time). hardware_too_slow This machine is below even the lightest tier's requirements. timeout No verified answer inside the time budget. call_budget_exceeded The model ran out of reasoning steps before reaching a verified answer. verification_failed An answer was generated but failed its own citation check, so it was withheld. busy Another reasoning call is already in flight. model_load_failed The model file failed to load. Error codes A rejected call returns one of these in its error data, not just a message string, so a client can branch on it programmatically. invalid_params · invalid_key · empty_text · text_too_long · invalid_tag · invalid_scope · invalid_forget_mode · invalid_partition_target · context_window_exceeded · relation_target_not_found · supersedes_conflict · pending_conflict · reserved_partition_name · duplicate_partition_name · partition_not_found · default_partition_immutable · cross_partition_edge · embedding_failed · storage_io · store_corrupt · recovery_required · store_locked · usage_log_unavailable · busy · internal · store_busy · relay_scope · rate_limited · client_token_required · client_rate_limited · client_blocked Deliberately not over MCP These manage the installation itself, not a single conversation, so they stay on the command line rather than something an assistant could be talked into calling mid-chat. connector_add / connector_remove / connector_list Which folders and sources feed the vault. backup / restore Manual snapshot and recovery of the local vault. housekeeping Storage-tier maintenance: compaction, tier migration. Uninstalling Leaving should be as plain as arriving. Uninstalling is one command, it tells you exactly what it is about to remove, and it does not touch your memories unless you ask it to. Uninstall Stops ModelBrain, removes the program and the entry it added to Claude Desktop's settings. Your vault folder is left where it is, and its path is printed. On Linux, run ~/.local/lib/modelbrain/uninstall.sh. Delete your vault too Your vault is ordinary files in one folder, so deleting that folder removes everything. On Linux, uninstall.sh --purge-data does it for you. There is nothing to request from us for the free local tier. By hand Stop the daemon, delete the vault folder (its location is on the install page for your system), and remove the ModelBrain line from your assistant's MCP settings. The vault is ordinary files, so deleting the folder is complete deletion, with nothing left to ask us for. If you used sync, managed backup or Teams, uninstalling the software does not cancel the subscription or delete what we hold; cancel from your account, and server-held copies are deleted 30 days after the paid period ends, as the terms describe. Architecture How the four storage tiers, the daemon and your assistant fit together. Read the architecture → ## https://modelbrain.net/faq.html Title: ModelBrain: questions and answers Questions Short answers, with a link where the long one lives. If something you need isn't here, ask; the answer usually ends up on this page. Getting started Do I need to be technical to use this? No. Setup is one installer, and Claude Desktop is registered for you (Claude Code and Cursor take one button). After that you talk to your assistant normally: "remember this", "what did we decide?", "forget that". There's nothing to configure and no query language to learn. Which assistants does it work with? Anything that supports MCP, the open standard for connecting tools to assistants. Today that includes Claude Desktop, Claude Code and Cursor, with the list growing. It won't work with an assistant that has no MCP support. Does it work with ChatGPT? Yes, through a hosted relay: choose Connect to ChatGPT in the ModelBrain menu, add it as a plugin in ChatGPT, and sign in to your free ModelBrain account to pick the computer. It's the one connection that doesn't stay fully local, since ChatGPT on the web can only reach outside tools through an internet-reachable connector. How to connect it. Do I need an account? No. There's no sign-up, no password and no licence key. An account only comes into existence if you connect ChatGPT (free, it needs a sign-in) or subscribe to something that involves our servers. When can I actually use it? Now. macOS, Windows and Linux builds are live on the download page. It ships as a beta, and the recall-test scores are published. Your data Where exactly are my memories stored? In a folder you choose on your own computer. You can move it, copy it or delete it like any other folder. If you delete it, it's gone: there's no copy anywhere else unless you set one up. Is my data used to train AI models? No. Not on any tier, not in aggregate, not anonymised. Separately, remember that your assistant is a different company with its own terms; we control what's on your disk, not what Claude or Cursor does with a memory once it's in the conversation. Can you read my memories? Local use with Claude Desktop, Claude Code or Cursor: no, we have nothing, since those talk to your local ModelBrain directly. ChatGPT connects through a hosted relay that forwards each request to your computer and back, so it handles the content in transit without writing it to disk. Sync and managed backup: no, they're encrypted before they leave your machine and we don't hold the key. Teams: no, a shared partition is encrypted on each member's computer with a key only the members hold; we see who is in the team, not what's in it. The three modes, in detail. Is the vault encrypted? Not by ModelBrain today; the security statement has the detail. Turn on FileVault, BitLocker or LUKS instead; your operating system already does this well, for free. We do not plan to add one, because the key would have to sit on the same computer. Trusting it What if it remembers something wrong? Every recalled memory comes back with its date and where it came from, so you can check it rather than take its word. Correct it by telling your assistant the new version; the old one becomes history rather than a competing answer. If I delete something, is it really gone? It stops appearing in every recall at once. For 15 minutes you can bring it back with Undo recent forgets in the menu, and its text is cleared for good after 24 hours for a synced folder and 30 days for a saved memory. That it is gone is a pass/fail line in our own test rather than a promise in marketing copy. "Forget that" takes a mode: revert (the default) tombstones the current version and brings the one before it back as current; object removes just the version you named; chain removes the whole correction history at once. Nothing comes back on its own as a side effect of any other call, only when you explicitly choose revert. Will it decide on its own what to remember? Your assistant asks it to save things, so in practice some of that is the assistant's judgement. What ModelBrain guarantees is that nothing is hidden: everything stored can be listed, checked and deleted by you, and nothing it stores can mark itself private or claim a source it doesn't have. What if two memories contradict each other? It won't spot that by itself; we've deliberately not claimed otherwise. You tell it which is current, and the other becomes history you can still look at. Practical What does it cost? Nothing, for everything on your own computers, permanently. You pay only for things involving someone else's machine: syncing between devices or a shared team collection, plus a flat $0.05 per GB per month for the backup and vault storage those use. Pricing. Will it slow my computer down? Day to day it's idle between requests. The honest exception is the first read of a large folder of documents, which uses real CPU for a while because it processes everything locally instead of sending it away. If you also run another app that keeps its own local model loaded (Ollama, LM Studio and similar), expect some slowdown when both are active at once, since they're drawing on the same CPU, RAM and GPU. Nothing to configure for it, just worth knowing if things feel sluggish. What happens if my laptop dies? Whatever your backup habits allow. Your vault is ordinary files, so Time Machine, File History or any backup tool you already run covers it. If you'd rather not think about it, device sync includes managed backup, keeping encrypted restore points and restoring to a new machine in one command; the space the snapshots use is billed at $0.05/GB/month. How do I uninstall it? Uninstalling stops ModelBrain and removes the program and the entry it added to your assistant's settings. Your vault folder stays where it is, and its path is printed so you can keep it, move it, or delete it. To delete the vault as well, delete that folder yourself (on Linux, run uninstall.sh --purge-data). Because the vault is ordinary files on your computer, deleting it is complete deletion, with nothing left to request from us. Uninstalling does not cancel a paid subscription; cancel that from your account. Details. Can I get my memories out? Yes. Your vault is a folder on your computer, and since 0.5.1 a command writes every memory out as plain Markdown files (or one JSON Lines file). It needs ModelBrain running and never overwrites anything. From 0.6, --history also writes the earlier versions of memories you replaced. How to run it. If you use sync, Export in the Account window also saves an encrypted copy of what you have synced. We'd rather you could leave easily than rely on it being hard. ## https://modelbrain.net/facts.html Title: ModelBrain fact sheet ModelBrain fact sheet ModelBrain is a free, local-first memory layer for AI assistants: it runs its own AI models on your computer to answer questions from your notes, checked against the notes it cites. It works with Claude Desktop, Claude Code, Cursor, ChatGPT and other MCP assistants, on macOS, Windows and Linux. Every figure below is current as of this page's last update; nothing here is rounded for effect. At a glance Current version 0.6.5 on macOS, Windows and Linux Release status Beta on macOS, Windows and Linux. The Linux build is command line only. Reasoning-based recall-test accuracy 86% by a lenient automatic match (a correct answer with extra words still counts), 70% by a strict exact-match standard. 100% on prompt-injection resistance. See "How we tested it" below for the breakdown. Doesn't yet include detecting contradictions between your own notes (see "what it doesn't do yet" on the homepage). Platforms macOS (Apple Silicon), Windows (x64 and ARM64), Linux (x86_64 and aarch64, glibc 2.28+) Price Free, $0, for one person on their own machines, permanently. No trial, no cap Account required No Protocol MCP (Model Context Protocol), 14 tools: remember, recall, list_memories, expand, forget, six partition tools, diagnostics, usage, ping Works with Claude Desktop, Claude Code, Cursor (one click); Antigravity, Gemini CLI, Codex CLI, Cline, Devin Desktop (setup guide card); any other MCP client by hand; ChatGPT (via hosted relay) Company NexSpark LLC, Buford, GA Founder Matthew Firth Platforms Platform Status macOS Live: Apple Silicon (M-series) only, notarized and signed Windows Available: x64 and ARM64, unsigned. Built and published, but not yet run by us on a Windows machine Linux Live: x86_64 and aarch64, command line Downloads and SHA-256 checksums: get-it.html. How we tested it 269 questions, each run three times independently (807 scored answers) and averaged, built to catch the cases that actually break a memory tool: two similar projects you'd confuse, a fact you've since corrected, a long pile of notes with the right one buried in it, a question with no answer in your notes at all, and a deliberate attempt to feed it a bad instruction. "Correct" below means a person reading the answer would call it right; the stricter exact-match number is 70% overall. Test case Right answer rate A single fact you told it once 100% A prompt-injection attempt in your notes 100% A question with no answer in memory (correctly declines) 100% A fact you've since corrected 94% A long pile of notes, right one buried 90% Lookalike facts designed to confuse it 90% Connecting two separate notes to answer one question 79% Not included above: noticing on its own that two of your notes contradict each other. That's not built yet (see "what it doesn't do yet"), so we don't count it toward this number. Full methodology and the harness itself ship with v1. All results in one place: recall test results. The separate retrieval test on public benchmarks is on the retrieval benchmarks page. Price Tier What it covers Price Free The whole product, one person, their own machines, permanently; connecting ChatGPT through the relay is free too (with a free account) $0 Device sync Sync between your own devices and managed encrypted backup: available now, opt-in $6/device/mo (billed annually), $8/mo monthly; $4/device/mo past 25 on either plan Teams Shared partitions with roles and per-partition access, end-to-end encrypted, SSO and audit log: available now, paid $6/node/mo yearly, $8 monthly, $4/node/mo past 25 on either plan; storage $0.05/GB/mo Storage Backup snapshots, synced data and Teams shared partitions; storage on your own computer is never metered $0.05/GB/mo Full terms: pricing.html. Hardware & model tiers Remembering and plain search run on essentially any machine. Reasoning runs a real local model, so ModelBrain reads your total installed RAM and CPU cores and picks one of these tiers automatically. Nothing to configure, though it can be pinned. How reasoning mode works. Tier Needs Model Minimal 7.5 GB RAM, 4 CPU cores Granite 3.3 2B Instruct Q4_K_M, ~1.5 GB download Default 15 GB RAM, 8 CPU cores Qwen3 4B Instruct 2507 Q4_K_M, ~2.5 GB download High 30 GB RAM, 8 CPU cores Qwen3 4B Instruct 2507 Q4_K_M, ~2.5 GB download (same model, larger context) Off Below 7.5 GB RAM or 4 cores No model downloaded; plain search, remember and recall still work RAM here means the total RAM installed in the computer, not what happens to be free at the moment. Cores means performance cores, not raw thread count. Full detail: hardware requirements & model tiers. What leaves your computer What you're doing Leaves? How to turn it off Saving, recalling or deleting a memory (Claude Desktop, Claude Code, Cursor) No Nothing to turn off. No network call is made. Saving, recalling or deleting a memory (ChatGPT) In transit only, not stored Only runs if you connect ChatGPT. Do not connect it and nothing is relayed. Working out what a note means (embeddings) No, your CPU Nothing to turn off. It runs on your CPU. Reading a folder of documents you approved No Only folders you approve. Remove a folder and it stops. Downloading the optional reasoning model (once) Yes, once Skip reasoning mode and nothing is downloaded. The file comes from Hugging Face and is checked against a pinned SHA-256 before use. Usage tracking, analytics, crash reports Local log only The app sends none. It keeps a call-count log (no memory text) in your vault folder that never leaves your computer. Set MODELBRAIN_USAGE_LOG=off to stop it. Sync and managed backup (paid) Available now, opt-in and paid. Encrypted on your computer first. Opt-in. Leave it off and nothing syncs. Teams shared partition (paid) Available now, paid. Encrypted on members' computers first. Opt-in. Do not create a shared partition. Vault encryption at rest No: ModelBrain relies on your OS's disk encryption Use your operating system's disk encryption. Full detail, including why the ChatGPT row differs from the other three clients: privacy.html. What it doesn't do yet Encrypt the vault itself No: use FileVault, BitLocker, or LUKS Read scanned or image-only PDFs No: reads Markdown, plain text, Word, PowerPoint, Excel, and text-layer PDFs Detect contradictory notes on its own No: you tell it which note is current Team sharing Available now: per-person read or write access per partition, priced on this page Device sync and managed backup Available now: priced on this page. Synced data is encrypted on your computer before upload ## https://modelbrain.net/security.html Title: ModelBrain security statement Statement of security · v0.4 · October 11, 2026 Security statement Written for whoever has to approve installing this. It describes the product as it exists today, in beta. Where something is designed but not built, it says so rather than implying coverage, and it names what is deliberately not protected. 1 · Boundaries Process. A local daemon holds exclusive write ownership of the vault and exposes exactly one local socket (a Unix domain socket on macOS and Linux, a named pipe on Windows). Callers are authorized by an OS peer-identity check. The local product opens no network listener. Model. The MCP client forwards a fixed set of fourteen tool names and nothing else: remember, recall, forget and expand; list_memories; six partition tools; and three read-only checks, diagnostics, usage and ping. Administrative operations are unreachable over MCP, which protects against a naive or buggy host as well as a hostile one. Human. Adding an ingestion root can only be done locally, from the menu's folder picker or an interactive terminal, never over MCP, and ships with no --yes or --force flag. Backup destinations and peer authorization follow the same rule: proposed anywhere, effective only locally. 2 · Integrity of metadata visibility is a narrow enum in the record header, never derived from model-writable content. Connector provenance (source_uri, sync_connector_id, ingestion parent_id) is written at ingestion and is not model-writable. Records carry a checksum that the read path validates, so silent corruption surfaces as an error rather than a plausible answer. 3 · Deletion Deletion is a tombstone plus exclusion from retrieval, made permanent by compaction. forget on the head of a version chain takes a mode: by default (revert) it removes the head and makes the previous version current again; object removes only that version and chain removes the whole correction history. Nothing is restored except as the chosen mode says. On connector content, forget tombstones the whole source, resolving a child target to its root first. Deletion integrity, that forgotten content stays out of every later recall including after compaction and a restart, is a hard-fail line in the published evaluation, not a scored metric. 4 · Data at rest and in transit No application-level encryption at rest, in the free local tier. Mitigation is full-disk encryption (FileVault, BitLocker, LUKS). Stated here rather than omitted. We do not plan application-level vault encryption: the key would have to sit on the same computer, so it would add nothing to disk encryption. The on-disk format is proprietary, which is not a security property. A shipped binary can be reverse-engineered. Cloud-sync guard. The daemon compares its data directory against known sync-folder patterns at startup and refuses to start on a match, because disk encryption does not prevent a sync client from uploading the decrypted view. In transit: local traffic never leaves the socket. Sync, managed backup and Teams data are encrypted on your computer before upload, with keys held by your computers, and travel over TLS. The ChatGPT relay reads each message to route it but does not store its content. 5 · Paid services and the ChatGPT relay Sync and backup. Your computers encrypt everything before it is uploaded, with a vault key that only your computers and your 24-word recovery phrase hold. Our servers store and check the encrypted data but cannot decrypt it. They hold an account, an email address, device names, billing records, and the size and timing of uploads. If you lose every approved computer and the phrase, neither you nor we can recover the synced data. Local-only partitions. A partition you mark local-only is not synced, and its content is never uploaded. Teams. Shared partitions are end-to-end encrypted with their own keys, held only by members' computers. Our servers see partition names, sizes and who has access, never memories. Removing someone changes the key on the next sync, and an owner or admin confirms each removal in the app. ChatGPT relay. ChatGPT can only reach outside tools over the internet, so its requests pass through a relay we run. The relay reads each message to route it but does not store the content; it logs the method name and the size. OpenAI receives whatever ChatGPT recalls, under OpenAI's terms. A connection needs a signed-in ModelBrain account, and we email you each time ChatGPT is connected to a computer. ## https://modelbrain.net/privacy.html Title: ModelBrain privacy: local, sync and backup, and Teams Privacy How private your memories are depends on which mode you're in, so this page is organized by mode rather than as one sweeping promise. Most people will only ever use the first one. Two things are true in every mode: your memories are never used to train any model, ours or anyone else's, and the app sends no usage tracking or analytics. It keeps a local call-count log on your computer, with no memory text in it, that never leaves it and can be turned off. Privacy policy Security statement Terms Mode 1 · Local the default Everything on your own computer For the free local product no account exists, so we hold no record that you use it at all. We cannot read your memories, cannot delete them, and cannot produce them if someone asks us to, because we never have them. we store about you: nothing we can read: nothing you are identified by: nothing Mode 2 · Sync and backup opt-in, paid We hold a copy we can't read Memories that sync between your computers, and the backups we keep of them, are encrypted on your computer before they're uploaded, and we don't hold the key. What we do hold is real and worth naming: an account, an email address, your devices' names, billing records, and the size and timing of what you upload. we store: encrypted blobs, account, devices, billing, sizes we can read: none of the contents Mode 3 · Teams opt-in · paid Shared with your team, still unreadable to us A shared partition has its own key, held only by the computers of the people it's shared with. Memories in it are encrypted there before they're uploaded, and searching still happens on each person's own computer. We see who is in the organization, their roles, the names of shared partitions, and sizes and timing, but not what's in them. we store: encrypted blobs, members, roles, partition names, billing we can read: none of the contents What that means for sync and Teams, said plainly Turning on sync, or joining a team, is your choice. It is never the default and it is separately paid. Nothing is uploaded because your computer ran out of space. A partition you mark as staying on this computer never leaves it, not even in encrypted form, and neither do the documents ModelBrain reads from your folders. That's checked before anything is sent. A shared memory is visible to the people the partition is shared with, at the level they were given: an owner or admin grants read or write access per partition, and taking it away changes the key so new memories stay out of reach. Your local memories stay local and keep working whether or not you ever switch this on, and continue working if you cancel. Sync is an addition, never a migration. Does it leave your computer? What you're doing Leaves? How to turn it off Saving, recalling or deleting a memory (Claude Desktop, Claude Code, Cursor) No Nothing to turn off. No network call is made. Saving, recalling or deleting a memory (ChatGPT) In transit only, not stored Only runs if you connect ChatGPT. Do not connect it and nothing is relayed. Working out what a note means (embeddings) No, your CPU Nothing to turn off. It runs on your CPU. Reading a folder of documents you approved No Only folders you approve. Remove a folder and it stops. Downloading the optional reasoning model (once) Yes, once Skip reasoning mode and nothing is downloaded. The file comes from Hugging Face and is checked against a pinned SHA-256 before use. Usage tracking, analytics, crash reports Local log only The app sends none. It keeps a call-count log (no memory text) in your vault folder that never leaves your computer. Set MODELBRAIN_USAGE_LOG=off to stop it. Sync and managed backup (paid) Encrypted first Opt-in. Leave it off and nothing syncs. Teams shared partition (paid) Encrypted first Opt-in. Do not create a shared partition. Sending text to an outside model for processing Off by default Off unless you configure it. On the first row: ModelBrain itself never sends a memory anywhere when saving, recalling, or deleting it. Once your assistant has that memory, what it does next is governed by that assistant's own policies, not ours (see "things we'd rather you knew," right). On the second row: Claude Desktop, Claude Code and Cursor all talk to your local ModelBrain directly, with no network hop. ChatGPT on the web can only reach outside tools through an internet-reachable connector, so that one connection routes through a small relay ModelBrain runs, which forwards each request to your computer and the answer back over an encrypted connection. The relay doesn't write that content to disk, but it does handle it in transit, which is a real difference from the other three clients; how the ChatGPT connector works. Note on the last row: the option to send text to an outside model exists only as an unused interface in the first release. Nothing calls it, and it stays off unless you enable it and supply your own key. Things we'd rather you knew ModelBrain does not encrypt your vault today. Turn on your computer's own disk encryption instead: FileVault on a Mac, BitLocker on Windows, LUKS on Linux, which protects the same files at no cost if the machine is stolen. We do not plan application-level vault encryption: the key would have to sit on the same computer, so it would add nothing to disk encryption. Don't put your vault inside Dropbox, iCloud Drive, OneDrive or Google Drive. Those apps would copy it to someone else's servers, and disk encryption doesn't stop them. ModelBrain checks for this when it starts and refuses to run rather than let it happen quietly. The file format isn't a security measure. It's a custom format for speed, not secrecy. Anyone with your files and enough determination can read them, which is the real reason to use disk encryption. Your assistant is a third party. Whatever you discuss with Claude, Cursor or anything else is subject to that company's terms, not ours. ModelBrain controls what's stored on your disk, not what your assistant does with a memory after we hand it over. ## https://modelbrain.net/pricing.html Title: ModelBrain pricing: local memory is free, forever Pricing Local memory is free and stays free. Sync puts the same memory on every computer you use, with encrypted backup included, for $6 a device a month billed yearly. Storage is one flat rate: $0.05 per GB a month. Free $0 The whole product, for one person on every computer you own, permanently. No account, no card, nothing that expires. Unlimited memories Folder sync for your documents ChatGPT too, with a free account Commercial use included Full export, any time Download free Sync between devices $6 /device/mo, billed yearly Or $8 a device if you pay monthly. Your memory on every computer you use, kept up to date, with managed backup included. Synced data is encrypted on your computer before it is uploaded. Per device, not per person Managed backup included Storage $0.05/GB/mo, on what you use $4/device a month past 25, on either plan Start syncing, yearlyPay monthly Payments are handled by Link, a Stripe service, as the merchant of record: it adds sales tax, VAT or GST where it applies, and pays it for you. Teams & organizations $6 /node/mo Same per-node rate as syncing your own devices, for shared partitions a team remembers into and recalls from. A computer already on its owner's sync plan isn't charged again. Owners, admins, members and readers; access per partition; end-to-end encrypted with keys only members' computers hold. Single sign-on and an audit log included; shared storage is billed at $0.05/GB/month. Billed yearly, or $8 a node if you pay monthly. $4/node a month past 25, on either plan Per node: members' computers SSO and audit log included Storage $0.05/GB/mo Start a teamHow Teams works Payments are handled by Link, a Stripe service, as the merchant of record: it adds sales tax, VAT or GST where it applies, and pays it for you. What sync adds The same memory on every computer Remember something on your laptop and your desktop recalls it. Each computer you add joins your plan at the same per-device rate. Backup you do not manage Managed backup comes with the plan, so a lost or broken computer is a restore, not a loss. Encrypted before it leaves Synced data is encrypted on your computer before upload. How the encryption works. Never used for training Not on any tier, in any form, including anonymised. What we hold, per mode. Cancel any time Sync keeps working to the end of the period you paid for, then your copy is read-only for 30 days so you can restore or export it. Memories on your computers are never touched. Free stays free Every computer you install it on, no memory cap, no account. Sync keeps them in step, and nothing you already have gets taken away. What it costs in practice Two computers and a 2 GB brain: $12 a month billed yearly ($144 a year), plus about 10 cents a month for storage. Paying monthly it is $16 plus the same 10 cents. Yearly saves $24 per device each year. Sales tax or VAT is added where it applies. Start syncing, yearlyDownload free first Storage $0.05 /GB/mo One rate for everything we store on your behalf: managed backup snapshots, synced data, and Teams shared partitions. Metered on what is actually stored at the end of each month, with no minimum, no included allowance to keep track of, and no different rate per tier. A typical brain is a few hundred megabytes to a few gigabytes, so for most people this is cents, not dollars. Storage on your own computer is never metered. Is free a trial? No. It's the complete product for one person on their own machines, with no time limit and no memory cap. The paid tiers add other people's computers, not features. Is my data used for training? No, on any tier, in any form, including anonymised. What we do hold, per mode. How do I start? Install ModelBrain, then open modelbrain.net/account (or the Account window in the app), sign in with your email, and choose yearly or monthly. Sign in with the same email on your other computer to add it. What if I cancel? Your memories keep working, because they never depended on us. Sync and backup keep working until the end of the period you paid for, with no refund for the rest of it. Then your synced copy stays read-only for 30 days so you can restore or export it, and is deleted after that. How cancelling works. ## https://modelbrain.net/get-it.html Title: Get ModelBrain Download ModelBrain™ macOS, Windows and Linux are live now. Download below and connect it to Claude Desktop, Claude Code, or Cursor in a few minutes. Current version: 0.6.5 on macOS, Windows and Linux. Platform Status macOS Download (.pkg) Windows x64 · ARM64 Linux (command line) x86_64 · aarch64 macOS build requires Apple Silicon (M-series); a signed, notarized .pkg installer, so there's no Gatekeeper warning and upgrades stop/restart ModelBrain automatically, no manual quit step. SHA-256: eb528de557dac18075d925af7154d0f3105f70717728ed72d3de9eded882b1f3 This is a beta. In our published test, it gave the right answer 86% of the time by a lenient automatic match, and 70% by a strict exact-match standard. It scored 100% on prompt-injection resistance. Full numbers. Uninstalling leaves your vault in place; delete the vault folder yourself if you want it gone: how uninstalling works. Windows will show a SmartScreen warning before install: the app isn't code-signed yet, a paid step we're deliberately skipping for the first release. Click More info, then Run anyway. To verify the files yourself first, their SHA-256 hashes are: f62dfdf7593d6686077ece7f7a468b9a389e73b67c6c4ec9a78519803db6cdf6 (ModelBrain-Setup-0.6.5-x64.exe) a79128d1f4c350ef2eefd97e8e4079e3046080388cc0578037b0f94ef6cb5fc9 (ModelBrain-Setup-0.6.5-arm64.exe) Linux is a command line package for 64-bit glibc distributions (glibc 2.28 or newer: Debian 10+, Ubuntu 20.04+, RHEL 8+ and similar). Unpack it and run ./install.sh --setup; no root needed. Linux install guide. SHA-256 (also in a .sha256 file beside each download): 7fb4c29a8465a0d006aa2e129fec3e4e284ee9b4b19c95a17a5dd25130694a5a (modelbrain-0.6.5-linux-x86_64.tar.gz) c5507cdba652f8c16dd39089b6d517e92cbe76993f8b02ab767fa8e37c33f2d7 (modelbrain-0.6.5-linux-aarch64.tar.gz) Updates One email when there's a new release worth knowing about: a new platform, a security fix, a major version. No newsletter, no drip sequence. No tracking pixels. Unsubscribe in every message. ## https://modelbrain.net/changelog.html Title: ModelBrain changelog Changelog What changed in the product, in the order it happened, including the decisions that made it smaller. Written for people using it, not as an engineering diary. Oct 25, 2026 Changed Safer retries and tighter client checks (0.6.5) Shipped on macOS, Windows and Linux. A 0.6.4 store opens unchanged. Sync. A temporary failure never marks a file as forgotten: a file that keeps failing is recorded for diagnostics only and is tried again after every restart, and a model worker that dies on one file is counted for that file so the others carry on. A folder file or chunk that can no longer be read is now replaced or forgotten with a plain stub, so it no longer blocks its folder or removing a connector. Clients. A caller whose program cannot be identified counts as outside the install, a block on a program name holds even when the program hides itself, and the Windows program lookup is implemented. ChatGPT relay grants are capped and rate limited, and a blocked grant stays blocked. Folders. Folders added with set-includes keep the secret-file-name skip in any letter case, and the command shows what it will index. A forgotten synced file can be listed and resumed from the tray. Under the hood. Forgetting a record that cannot be read back is refused instead of writing an empty marker, compaction no longer rereads records under the write lock, format_versions reads the headers on disk, and every tool now has a title. Known limits. Windows installers are unsigned and have not been run by us on a Windows machine. Steadier folder sync and a clearer storage report (0.6.4) Shipped on macOS, Windows and Linux. A 0.6.3 store opens unchanged. Storage. The store now keeps a per-segment ledger of forgotten folder content, so compaction rewrites segments that hold only small stubs, the storage report separates live, stub, pending and unindexed bytes, and the daily pass no longer reads every forgotten record. Folder sync. A temporary failure (a locked store, a full disk, an interrupted read, a model worker that is down) now leaves the file's earlier text searchable and the next pass tries again. A failure that repeats three times for the same file contents is recorded as failed. connector_sync set-includes lets one connector sync folders the default skip list leaves out, such as logs or build. The default list is unchanged. Under the hood. Format headers record a readable range and diagnostics show the on-disk versions. Compaction keeps a forgotten record that cannot be purged yet as stored instead of recompressing it every pass. Known limits. Windows installers are unsigned and have not been run by us on a Windows machine. Oct 25, 2026 Changed Tighter assistant checks and a lighter store (0.6.3) Shipped on macOS, Windows and Linux. A 0.6.2 store opens unchanged. Restart ModelBrain after you upgrade: the ChatGPT relay now proves itself to the local daemon with a secret the daemon makes when it starts, so an old daemon and a new relay client do not talk until it restarts. Security. A program on your computer can no longer pose as the ChatGPT relay to skip the Allow prompt. Admin actions (backups, sharing a partition, bulk deletes, exports) are refused to any program that is not part of ModelBrain and to any assistant still waiting for your decision. A backup has to be written outside the store. A forget is checked against the per-minute limit before it runs, and one call that would remove more than 20 objects is refused. The undo list now refuses a new forget before it drops one you could still undo. Config files that hold a token are private from the moment they are created, and revoking a token closes the connections that used it. modelbrain_admin setup tokens --mint NAME makes a token for any assistant, and turning on Require client tokens now lists the assistants that would be locked out first. On Linux and Windows the install folder belongs to you, so client identity is a consent tool for well-behaved programs and not a defence against software already running as you. Speed and storage. Compaction no longer makes recalls wait behind a queued save. A save reports where its time goes in diagnostics.remember_latency, and its duplicate check runs after the write lock is released. Forgetting folder content now leaves a small stub straight away instead of a full copy, so narrowing a connector no longer writes hundreds of megabytes, and a store with many forgotten files opens with less memory. modelbrain_admin reclaim (and "Free space from forgotten folder data" in the menu) clears forgotten folder content immediately instead of at the next daily pass. Model isolation turns on again after repeated crashes, and with it on a save no longer queues behind the background worker. Known limits. The small stub left for each forgotten folder file stays in the index; removing those is planned for 0.7. A lone double quote in a CSV can still swallow up to 50 rows. Windows installers are unsigned and have not been run by us on a Windows machine. Oct 24, 2026 Changed Fewer false positives and tighter identity checks (0.6.2) Shipped on macOS, Windows and Linux. A 0.6.1 store opens unchanged and nothing is rewritten on disk. This release comes from a full review of 0.6.1 and is mostly about files that were being mangled or dropped by mistake. Synced files. The secret scan now replaces only the matched text, so one key in a paragraph no longer drops the paragraph. Obsidian properties such as position and publish are no longer treated as secrets, and a hex api_key or a UUID secret_id is still redacted. A credentials file that puts a key id beside its secret now has both redacted. The prompt-injection scan is stricter about what it flags, so a line like System: Ubuntu 24.04 passes. A flagged chunk is moved down the recall ranking, not removed: in a synthetic test its mean rank went from 30.8 to 100.3 of about 102 to 106 hits. Text, PDF and Office files no longer show a stray \#, and YAML and CSV edge cases chunk correctly. Changes apply to files synced after the upgrade. Clients and undo. The forget limit now follows each client across reconnects. Undoing a forget in revert mode restores one live version. A program that introduces more than five new client names in ten minutes is refused until you decide on the pending ones. modelbrain_admin setup tokens --revoke