powermem - Moses Yebei

The Problem

AI agents and applications lack persistent, structured memory. Session context is lost between runs, and existing memory solutions are either too simplistic (key-value stores) or too rigid (fixed schemas). PowerMem addresses this by providing a memory layer that combines multiple retrieval strategies—vector, full-text, and graph—with LLM-driven extraction and time-based decay, so agents can recall relevant information without rebuilding context every session.

What This Does

PowerMem is a persistent memory system for AI agents, exposed through a Python SDK (src/powermem/), a CLI (pmem), an HTTP API server with a React dashboard (src/server/, dashboard/), and an MCP server. The core memory.py module handles the orchestration: it auto-configures providers, manages the underlying store, and exposes add, search, delete, and list operations.

The repository also contains a set of self-contained projects beyond the core library: a Go-based Claude Code plugin (apps/claude-code-plugin/), a TypeScript VS Code extension (apps/vscode-extension/), a LOCOMO benchmark suite (benchmark/locomo/), and a benchmark server (benchmark/server/main.py). These are independent projects sharing the core memory design, not one monolith.

How It Is Wired

Execution starts in src/powermem/cli/main.py at the memory function. From there, the shortest path to an external effect is memory -> delete_all, which makes a network call via self.client.get—three hops from entry to leaving the process. The benchmark server (benchmark/server/main.py) starts at reset and reaches delete_col, hitting the database via self.connection.execute in two hops. The CLI's cli function reaches _install_shell_completion, which writes to the filesystem via os.makedirs.

The call graph shows clear hot spots. search is called from 132 distinct places, delete_all from 57, and PGVectorStore from 50—these are the functions with the widest blast radius. The module graph confirms this: src/powermem/core/memory.py has 18 imports and is depended on by 4 modules, with an instability score of 0.82. The src/server/models/errors.py module is a hub with 15 dependents and zero imports—stable but high-churn risk. The CLI modules (main.py, commands/config.py, commands/interactive.py) participate in a circular import cycle, which will complicate any refactoring.

How To Use It

Setup:

git clone https://github.com/moses-y/powermem
cd powermem
pip install -e .

Configuration: Copy .env.example to .env and set LLM and embedding credentials. The default database is SQLite. Run pmem config init for interactive setup.

Running it:

pmem memory add "User prefers dark mode" --user-id user123
pmem memory search "preferences" --user-id user123
powermem-server --host 0.0.0.0 --port 8000

Real-World Use

A customer-support agent that needs to remember user preferences across sessions:

from powermem import Memory, auto_config

memory = Memory(config=auto_config())
memory.add("User prefers dark mode and dislikes phone calls", user_id="user123")
results = memory.search("communication preferences", user_id="user123")

Code Health & Issues

Static analysis found 168 findings (40 high, 128 medium). The most significant:

High - Deep nesting (33 occurrences) - src/server/utils/metrics.py, src/powermem/core/memory.py (indentation depth 8); fix with early returns/guard clauses.
High - Oversized files (8) - src/powermem/core/memory.py at 1662 lines; split by responsibility.
High - Duplicated code blocks - 1885 repeated 6-line blocks across 165 files, notably in apps/vscode-extension/src/writers/ (claude.ts, cursor.ts, codex.ts); extract shared helpers.
High - Import cycle members (6) - src/powermem/cli/main.py and its commands; break the cycle.
Medium - Broad exception handling (10) - src/powermem/utils/utils.py, config_loader.py; catch specific exceptions.
High - Unsafe CI/CD practices - Third-party GitHub Actions pinned to tags (docker/setup-qemu-action@v3), no lockfile for pyproject.toml, no least-privilege token permissions, no dependency scan.

The Bottom Line

PowerMem is a functional, multi-faceted memory system with solid test coverage (47 test files) and good documentation (171 doc files). The core library is the strongest part; the plugins and benchmark are useful but contribute to the code duplication and complexity. The CI/CD security gaps and deep nesting in core files are the main concerns for anyone planning to extend it. Suitable for teams building AI agents that need persistent, queryable memory with minimal setup.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

564 files

Python263
TSX91
Markdown56
CSS26
JSON24
TypeScript22

ReactDjangoDockerTransformersLangChainVector store

Module dependencies

The 10 most depended-upon modules of 380, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_server_models_errors["errors"] n1_src_server_models_response["response"] n2_src_server_middleware_auth["auth"] n3_server_middleware_rate_limit["rate_limit"] n4_alueProps_icons_AccurateIcon["AccurateIcon"] n5_ueProps_icons_AffordableIcon["AffordableIcon"] n6_s_ValueProps_icons_AgileIcon["AgileIcon"] n7_src_powermem_cli_main["main"] n8_src_powermem_utils_utils["utils"] n9_src_server_utils_converters["converters"] n2_src_server_middleware_auth --> n0_src_server_models_errors n3_server_middleware_rate_limit --> n0_src_server_models_errors n9_src_server_utils_converters --> n1_src_server_models_response classDef cyc stroke:#ef4444,stroke-width:2px; class n7_src_powermem_cli_main cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/build-push-action@v6

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/build_docker.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

6 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium3 occurrences

docker/Dockerfile

node:20-slim, python:3.11-slim, python:3.11-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/plugins-build.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/build_docker.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.