Aletheia 0.2.0, a local AI coding memory tool, fixes an open-door flaw found by self-audit

One memory for many coding agents

Anyone who switches between AI coding assistants knows the chore: each one needs the same project background explained from scratch. Aletheia is built to remove that. It keeps notes and rules in a single SQLite store (a small database that lives in one file) on your own computer. Claude Code, Codex CLI, Cursor, Gemini CLI, Windsurf and OpenCode can all read it, through MCP (a standard way for AI tools to talk to other software), a REST interface, or a command line.

As dev.to reported in the makers' own write-up, the project is alpha software under the Apache-2.0 open-source licence, with no account to create and no usage tracking. For 0.2.0 the team did not simply add features. They audited their own code and that of claude-mem, an older and larger project in the same space, and turned every finding into a task. Each task needed a test that failed before the fix and passed afterwards. That produced 28 tasks.

The security gap in remote mode

The most serious finding was a flaw rather than a missing feature. By default the server only answers requests from the same machine, and that setup was not affected. But if you set it to listen on a network address without defining an API key, the login screen guarded the dashboard while leaving three other doors open: the /v1 interface, the live socket and /mcp. These are the paths the coding tools actually use, so anyone able to reach the port could use them.

Version 0.2.0 now demands either a login session or the key for /v1 in remote mode, and the key for /mcp. It also prints a warning at startup if remote mode runs with no key.

An independent review of that fix turned up three more problems, all now fixed. One check meant to restrict /mcp to local use was skipped on the local setup, so putting a reverse proxy (a middleman server) in front exposed it. The remote login page's own browser security rules stopped its sign-in request from going through. And the sync hub verified a pairing code before applying its lockout against repeated guesses, which is the wrong order. The project's SECURITY.md file records each one.

Features nobody ever called

The audit also found code that existed and passed its tests but was never reached by any command, route or hook. Examples were vector search (matching by meaning rather than exact words) outside the command line, a graph-based retrieval channel, a gate on file reads, folder-level context files and a reranker that reorders search results.

The makers point out why this slips through: tests that check each module on its own cannot tell you whether the module is used anywhere. Version 0.2.0 connects each of these, mostly switched off by default, and adds a test that fails whenever a module in the source folder has no real caller.

Worktrees, backups and other changes

Agents that work in git worktrees (extra checkouts of one repository) had their memory filed under the worktree's own path. Every new session therefore started empty. Now those sessions share the main project's memory. Merging projects moves every table in a single transaction, and a new command, aletheia projects fold-worktrees, folds old fragments back in, showing a dry run first.

• Scheduled local backups and an aletheia restore command.
• Search that works for Chinese, Japanese and Korean text, which the old tokenizer treated as one unbroken chunk.
• Prompts are redacted again just before any model call, not only when stored.
• New team_brief and team_search tools, plus an import for Claude Code's own memory files.
• Setup for Copilot CLI, Goose and Roo Code, written from documentation and untested on real installs.
• A dashboard available in ten languages, machine-translated with no native-speaker review.

Reading the benchmark carefully

The team re-ran its LoCoMo comparison against claude-mem 15.17.0. Recall@5, meaning how often the right memory appears among the top five results, was 43.5% for claude-mem as shipped and 57.4% for Aletheia working from raw conversation turns. The makers stress that this measures retrieval only, not whether an agent then answers correctly.

Because the project's authors ran the test, treat it as a claim to verify. They say result files and commands are in the repository so anyone can repeat it.