Is Claude-Mem Safe? Prompt Upload Bug, Telemetry and Costs

Is Claude-Mem safe to install?

Claude-Mem is safe to install if you are on version 15.8.3 or later and change a few defaults. Versions with the 15.2 browser setup step scanned local agent history and uploaded the last 30 days of prompts to cmem.ai without asking. Version 15.8.3 fixed that by asking first. The update does not delete data already uploaded. Telemetry is on by default, and automatic secret redaction is off.

What is Claude-Mem and what does it do?

Claude-Mem is an open-source (Apache 2) memory system for coding agents. It hooks into the agent's lifecycle: session start, prompt submission, before and after each tool call, stop, and session end. Those events go to a small worker service on your machine. The worker passes them to an observer, a background model (Haiku on the Claude provider), which turns raw tool calls into structured observations. Each has a title, a type such as bug fix or decision, a short narrative, facts and the files involved.

Observations land in a local SQLite database, with a Chroma vector database alongside for semantic search. At the next session start, Claude-Mem injects an index of recent observations (the last 50 by default), showing titles, types and token cost. The agent opens only what it needs through search tools. The project says this filtering saves roughly 10 times the tokens, but its own site notes the effect depends on workload and provider, so treat that figure loosely.

The project has passed 112,000 GitHub stars and supports more than Claude Code. The installer's ID flag covers Codex, Cursor, OpenCode, Windsurf, Copilot and others.

What did the prompt upload bug actually do?

Version 15.2 added a browser setup step. According to a user-filed issue and a reviewer who walked through it, that step:

• scanned local history from Claude Code, Codex, Gemini CLI and other agents,
• uploaded the full text of the last 30 days of prompts to cmem.ai,
• sent project names, folder paths and timestamps with them,
• ran as soon as the page loaded, with no confirmation.

The same report says cmem.ai confirmed the prompts were routed through OpenRouter without blocking providers that may retain or train on data. The privacy policy at the time said nothing leaves your device unless you enable Cloud Sync. That mismatch is the core of the complaint.

Prompts often contain file paths, internal service names, pasted logs and sometimes credentials. Treat anything you typed into an agent in that window as potentially exposed.

Which versions are affected, and is it fixed?

The fix stops future uploads without consent. The release notes state that prompts already uploaded are not removed by updating. If you ran the browser setup on an affected version, updating is not enough. Consider contacting the project about deletion and rotating any secret that appeared in a prompt.

How does Claude-Mem telemetry work?

Telemetry is on by default. It is described as anonymous and documented, and the installer asks about it once, but the model is opt-out. To disable it:

npx claude-mem telemetry disable

You can also set the standard do-not-track environment variable. Either route is quick, and it makes sense to do it during install rather than later.

What privacy controls does Claude-Mem give you?

Two tools matter most.

1. Private tags. Wrap sensitive text in private tags and it will not be stored in memory, though Claude can still use it during that session.
2. Auto redaction. Thirty built-in patterns catch things like API keys. It is opt-in. The reviewer argues it should be on by default and enables it on day one. That is a sensible call, since the observer sees every tool call and file read.

Also remember the local store itself. Observations, including file contents summarized by the observer, sit in a SQLite database on your disk. That is private from the network but not from anyone with access to your machine or backups.

How should you install it safely?

Use the full installer, not a global npm install. The global package only installs the library and skips the hooks and worker.

npx claude-mem install --provider claude

The installer sets up the runtime (Bun and UV if missing), then asks you to sign in and choose a memory provider. The hosted provider is preselected with a 30-day trial. Passing the provider flag with claude skips sign-in and runs memory on your own Anthropic plan. You can also use an OpenRouter or Gemini key, or any OpenAI-compatible endpoint.

A short checklist:

• Confirm you are on 15.8.3 or later.
• Decline any upload or cloud sync prompt.
• Disable telemetry.
• Turn on redaction.

How much does Claude-Mem really cost?

The engine is free. The cost is the observer, which is a model doing work for every session.

The "free" Claude provider route is the one to watch if you already hit rate limits. Background observer calls come out of the same allowance as your coding sessions.

Is there hidden observer usage?

There is at least one reported case. An open issue describes a user on the Claude provider who saw around 230 hidden Codex runs over four days, triggered by the "my work" page refresh. Those runs consumed their Codex quota. This is one user report in an open issue, not a confirmed universal behavior, but it shows why you should check your usage dashboards in the first week.

A related default: a file read gate is enabled out of the box. When Claude tries to read a large file that already has history, the gate can redirect it to an outline. It usually saves tokens, but if the agent behaves oddly around big files, that setting is the first place to look.

Is Claude-Mem worth it?

It fits developers who work on one project for weeks and keep re-explaining past decisions. In the demo, a fresh session knew due dates were handled in UTC and reused the right helper, and the injected index cost only 425 tokens for three observations. If your work is mostly small one-off tasks, a well-kept CLAUDE.md file covers most of the benefit at no cost and with no extra model running.