# sovseal

> One private memory across every AI you use — local-first, zero-knowledge. On your device, synced as ciphertext, readable by no one else, including us. Built for work under NDA, HIPAA, or a security policy.

## Docs

- [Introduction to sovseal](https://docs.sovseal.com/index.md): One private memory across every AI you use — local-first, zero-knowledge.
- [Quickstart](https://docs.sovseal.com/platform/quickstart.md): Set up sovseal, store your first memory, and search it back in under two minutes.
- [sovseal CLI](https://docs.sovseal.com/platform/cli.md): The sovseal command-line interface — 1-shot setup with zero-knowledge local memory, auto-provisioning, mind digests, and automated health checks.
- [Autonomous Agent Onboarding](https://docs.sovseal.com/platform/autonomous-agent-onboarding.md): How autonomous agents self-register zero-knowledge memory vaults using self-asserting sov_proj_ tokens without human UI signups.
- [sovseal MCP Setup Guide](https://docs.sovseal.com/platform/mcp.md): Step-by-step guide to installing and configuring @sovseal/mcp-server for any Model Context Protocol compliant AI client.
- [Platform vs Self-Hosted: Choosing Your Deployment](https://docs.sovseal.com/platform/platform-vs-self-hosted.md): Compare the managed sovseal Platform and self-hosted edge function across features, compliance, cost, and migration to choose the right fit.
- [How sovseal Keeps Recall Local and the Server Blind](https://docs.sovseal.com/platform/architecture.md): A detailed walkthrough of sovseal's deployment shape, write and read lifecycles, encryption boundary, key custody, and replication behavior.
- [sovseal Memory Model: Semantic Memory vs. State Replication](https://docs.sovseal.com/platform/core-concepts/memory-model.md): How store/recall (flat, content-addressed semantic memory) and snapshot/restore/lineage (sequence-numbered zero-knowledge checkpoints) are two distinct systems — record shapes, the real SDK method table, and constraints to design around.
- [store_memory: Write-Behind Local Commit in Under 5ms](https://docs.sovseal.com/platform/core-concepts/store-memory.md): store_memory commits to local LanceDB and returns in under 5ms. Ciphertext replication is asynchronous — zero RTTs block the call path.
- [recall_memory: Zero-RTT Local Semantic Search](https://docs.sovseal.com/platform/core-concepts/recall-memory.md): recall_memory runs vector similarity search entirely on-device against LanceDB, returning ranked, decrypted results with sub-25ms p99 latency.
- [Verified Semantic Recall: Tamper Detection on Restore](https://docs.sovseal.com/platform/core-concepts/verified-semantic-recall.md): A two-check verification pattern for every state restore — AES-GCM auth tags plus a re-derived SHA-256 hash — that fails closed on any mismatch.
- [Deterministic Lineage: Sequence Numbers, Point-in-Time Recovery, and Verified Restore](https://docs.sovseal.com/platform/core-concepts/deterministic-lineage.md): How sovseal orders state snapshots by a strict per-agent sequence number, enables point-in-time recovery via restoreAt, and verifies every restore — no content-hash chain, no fork/rollback primitives.
- [Zero-Knowledge Guarantees: What the Server Can and Cannot See](https://docs.sovseal.com/platform/core-concepts/zero-knowledge.md): sovseal's replication server is permanently blind to plaintext. The formal threat model, what actually reaches the server (no path hashing, no content-hash chain), dual verification, and fail-closed behavior.
- [Three-Layer Hybrid Metrics](https://docs.sovseal.com/platform/core-concepts/three-layer-metrics.md): How the dashboard monitors activity, quotas, and usage without exposing plaintext data to the server.
- [Manage API Keys in the sovseal Console](https://docs.sovseal.com/platform/console/api-keys.md): Generate, scope, rotate, and revoke the tokens your agents use — including token types, blind auth, rotation policies, and a leaked-key playbook.
- [Zero-Knowledge Team Collaboration in sovseal](https://docs.sovseal.com/platform/console/teams-and-rbac.md): Share encrypted memory contexts across teammates using wrapped DEK grants — the server sees only public keys and opaque envelopes, never your plaintext DEK.
- [sovseal Pricing Plans, Usage Quotas, and Billing](https://docs.sovseal.com/platform/console/usage-and-billing.md): Compare pricing tiers, understand Layer-A-only billing metrics, monitor live quota meters, upgrade your plan, and review SLA commitments per tier.
- [Connect a Source](https://docs.sovseal.com/platform/console/connect-a-source.md): Setup and configure the agent memory sync client.
- [ZK Sandbox](https://docs.sovseal.com/platform/console/playground.md): Interactively inspect client-side Web Crypto operations in a safe sandbox.
- [Memory Exports](https://docs.sovseal.com/platform/console/exports.md): Export your memories in structured formats.
- [Project Settings](https://docs.sovseal.com/platform/console/settings.md): Configure project metadata, devices, and security toggles.
- [Replication & Sync](https://docs.sovseal.com/platform/features/replication-sync.md): How write-behind replication works, recovery semantics, and conflict resolution.
- [Authentication & Tokens](https://docs.sovseal.com/platform/features/auth-and-tokens.md): API key types, scopes, rotation, and revocation.
- [Observability](https://docs.sovseal.com/platform/features/observability.md): Dashboards, metrics, and audit logs available to Platform projects.
- [Billing](https://docs.sovseal.com/platform/features/billing-and-credits.md): How sovseal bills: flat plans, fair-use ceilings, seat scaling, and Layer-A metering.
- [Limits & SLAs](https://docs.sovseal.com/platform/features/limits-and-slas.md): Payload caps, retention behaviour by plan, and what sovseal does and does not commit to on availability.
- [SSO & SCIM](https://docs.sovseal.com/platform/features/sso-and-scim.md): Enterprise SAML 2.0 single sign-on and SCIM 2.0 directory provisioning.
- [Webhooks](https://docs.sovseal.com/platform/console/webhooks.md): Configure external webhook endpoints for metadata sync events.
- [Cryptographic Trust Center](https://docs.sovseal.com/platform/trust.md): Consolidated threat model, encryption guarantees, compliance posture, and key custody details.
- [How Your Data is Protected](https://docs.sovseal.com/security/data-protection.md): A complete guide to sovseal's cryptographic pipeline, zero-knowledge architecture, and local-first memory model.
- [Account & Device Security](https://docs.sovseal.com/security/account-security.md): How sovseal authenticates you, where your keys live, and exactly what recovery is — and isn't — available on each plan.
- [Give Claude Code CLI Persistent Memory via sovseal](https://docs.sovseal.com/integrations/claude-code.md): Add the sovseal MCP server to Claude Code in one terminal command so the CLI remembers context across every session and shell environment.
- [Add Persistent Memory to Claude Desktop with sovseal](https://docs.sovseal.com/integrations/claude-desktop.md): Configure the sovseal MCP server in Claude Desktop to give Claude local-first, zero-knowledge memory that persists across every chat session.
- [Persistent Memory for Cursor AI with sovseal MCP](https://docs.sovseal.com/integrations/cursor.md): Wire the sovseal MCP server into Cursor so your AI agent remembers code style choices, design decisions, and package versions across every session.
- [Add sovseal Memory to Windsurf AI Editor](https://docs.sovseal.com/integrations/windsurf.md): Configure the sovseal MCP server in Windsurf so the Cascade AI assistant remembers project decisions and preferences across all your workspaces.
- [Google Antigravity Persistent Memory](https://docs.sovseal.com/integrations/antigravity.md): Integrate local-first, zero-knowledge memory with Google Antigravity IDE using the sovseal MCP server.
- [OpenClaw Agent Persistent Memory](https://docs.sovseal.com/integrations/openclaw.md): How a sovseal memory plugin for OpenClaw would work — no published plugin exists yet; this is a build target modeled on OpenClaw's real plugin-slot architecture, not a confirmed install.
- [Deploy Self-Hosted](https://docs.sovseal.com/self-hosted/deploy.md): Deploy the v2-agent-state edge function to your own Supabase project.
- [Deploy a Self-Hosted sovseal Instance in 5 Minutes](https://docs.sovseal.com/self-hosted/quickstart.md): Four commands: link a Supabase project, push the schema, deploy the edge function, point your SDK at it.
- [Configure Your Self-Hosted sovseal Deployment](https://docs.sovseal.com/self-hosted/configuration.md): Every real environment variable the edge function and client SDK read — no fictional server config included.
- [AES-256-GCM Encryption](https://docs.sovseal.com/components/encryption/aes-256-gcm.md): Specifications of the authenticated symmetric encryption model protecting state snapshots.
- [Key Management & Custody](https://docs.sovseal.com/components/encryption/key-derivation.md): How the master key is generated, held in the OS keychain, and split into purpose-bound subkeys via HKDF.
- [LanceDB: sovseal's Local Vector Store](https://docs.sovseal.com/components/vector-stores/lancedb-local.md): The only vector store in sovseal — local, on-device LanceDB. Schema, file layout, thread safety, and what actually replicates to the server.
- [REST Surface](https://docs.sovseal.com/self-hosted/rest-surface.md): The HTTP routes the self-hosted v2-agent-state edge function actually exposes.
- [Storage Architecture](https://docs.sovseal.com/self-hosted/bring-your-own-storage.md): What the self-hosted deployment actually stores, where, and what you can realistically swap.
- [Embedding Model](https://docs.sovseal.com/self-hosted/custom-embedders.md): sovseal runs one fixed local embedder — there is no pluggable provider system to configure.
- [Back Up and Recover Your sovseal Self-Hosted Instance](https://docs.sovseal.com/self-hosted/backups-and-recovery.md): Strategies and commands for backing up Postgres snapshots, LanceDB local collections, and recovering agent memory state via lineage replay after a failure.
- [Upgrade Your Self-Hosted sovseal Deployment](https://docs.sovseal.com/self-hosted/upgrading.md): Redeploy the edge function and apply new migrations. No Alembic, no container orchestration — it's two Supabase CLI commands.
- [Migrate from Self-Hosted sovseal to Managed Platform](https://docs.sovseal.com/self-hosted/migrate-to-platform.md): Switch your replication target between self-hosted and the managed Platform by changing one constructor argument.
- [LangChain Agent Memory Integration with sovseal](https://docs.sovseal.com/integrations/langchain.md): Wrap sovseal-sdk's store/recall as native LangChain tools in Python, or extend BaseChatMemory in TypeScript, for zero-network local memory.
- [Stateful LangGraph Agents with sovseal Memory Nodes](https://docs.sovseal.com/integrations/langgraph.md): Hook sovseal-sdk's store/recall into LangGraph's StateGraph to inject recalled memory at node entry and persist new context at node exit across agent runs.
- [OpenAI Agents SDK: Add Persistent Memory with sovseal](https://docs.sovseal.com/integrations/openai-agents-sdk.md): Wrap sovseal-sdk's store/recall as function tools in OpenAI Agents SDK so every agent in a multi-agent handoff workflow shares persistent context.
- [Vercel AI SDK: Stateful Chat Apps with sovseal Memory](https://docs.sovseal.com/integrations/vercel-ai-sdk.md): Use @sovseal/sdk's store/recall with Vercel AI SDK tool calling to inject relevant local memory into every request and let the model write new facts back mid-stream.
- [Share Memory Context Across CrewAI Agent Crews](https://docs.sovseal.com/integrations/crewai.md): Wrap sovseal-sdk's store/recall as CrewAI-native tools so every agent in your crew can persist and retrieve facts at 0 RTT local latency across tasks and crew runs.
- [ElizaOS Agent Memory Integration](https://docs.sovseal.com/integrations/eliza-os.md): Build a minimal ElizaOS plugin wiring @sovseal/sdk's local-first, zero-knowledge store/recall memory into your agent's Plugin interface.
- [Mastra Agent Memory Integration](https://docs.sovseal.com/integrations/mastra.md): Build stateful Node.js/TypeScript agents with Mastra using @sovseal/sdk's local store/recall memory, wrapped as Mastra-native tools.
- [Persistent Dev Session Memory with Claude and Cursor](https://docs.sovseal.com/cookbooks/dev-productivity-session-memory.md): Wire sovseal's local MCP server into Claude Desktop and Cursor for cross-session state persistence with zero cloud exposure of your codebase.
- [Persistent Eliza Characters](https://docs.sovseal.com/cookbooks/eliza-os-character.md): Wire @sovseal/sdk's store/recall directly into an ElizaOS character's Plugin interface for local-first, zero-knowledge persistent memory — no pre-built adapter package exists yet.
- [Defending SOC Agents from Memory Poisoning](https://docs.sovseal.com/cookbooks/threat-detection-vsr.md): Verify every restored threat-intel snapshot before an agent acts on it — fail closed on tamper or substitution, page a human.
- [HIPAA-Aligned PHI Handling with Google ADK and sovseal](https://docs.sovseal.com/cookbooks/healthcare-google-adk.md): Build a healthcare co-pilot that keeps PHI local using Google ADK and sovseal's client-side AES-256-GCM encrypted memory. HIPAA-aligned architecture.
- [Authenticate sovseal API Requests with Bearer Tokens](https://docs.sovseal.com/api-reference/authentication.md): Learn how to authenticate every sovseal API request using project tokens, live API keys, or session JWTs — and which token type fits each use case.
- [@sovseal/sdk: Node.js SDK Reference for Agent Memory](https://docs.sovseal.com/sdk-reference/node-sdk.md): Complete reference for @sovseal/sdk — install, AgentStateClient configuration, local store/recall semantic memory, snapshot/restore/lineage replication methods, crypto utilities, and error handling.
- [@sovseal/mcp-server: MCP Tools for AI Client Memory](https://docs.sovseal.com/sdk-reference/mcp-server.md): Reference for @sovseal/mcp-server — stdio transport config, key custody, store_memory and recall_memory tool schemas, and the bundled sovseal CLI.
- [sovseal-sdk: Python SDK Reference for Agent Memory](https://docs.sovseal.com/sdk-reference/python-sdk.md): Complete reference for sovseal-sdk (PyPI) — install, AgentStateClient configuration, local store/recall semantic memory, snapshot/restore/lineage replication methods, and error handling.
- [sovseal CLI: Terminal Memory, Diagnostics & Device Linking](https://docs.sovseal.com/sdk-reference/cli.md): Reference for the sovseal binary — memory commands, doctor diagnostics, the --json agent envelope, exit codes, and the sovseal login device handshake.
- [POST /snapshot: Upload Encrypted State Checkpoint](https://docs.sovseal.com/api-reference/snapshot.md): Upload a base64-encoded AES-256-GCM encrypted state checkpoint for your agent, with sequence enforcement, billing debit, and storage confirmation.
- [POST /replicate: Push Write-Behind Replication Chunks](https://docs.sovseal.com/api-reference/replicate.md): Upload one or more encrypted differential block chunks to the replication log, with Merkle root verification, billing debit, and split-brain conflict detection.
- [Restore Snapshot Checkpoints and Walk Agent Lineage](https://docs.sovseal.com/api-reference/restore.md): Retrieve your agent's latest encrypted snapshot, restore a checkpoint at any sequence number, or walk the full parent lineage chain for history verification.
- [GET /replay: Stream Replication Log for Crash Recovery](https://docs.sovseal.com/api-reference/replay.md): Fetch replication log chunks chronologically from a given sequence number to catch up after a crash, device switch, or cold start.
- [GET /head: Retrieve Latest Replication Head Metadata](https://docs.sovseal.com/api-reference/head.md): Fetch the latest confirmed sequence number, Merkle root, and timestamp for your agent's replication log — a lightweight liveness and sync-check probe.
- [GET /envelopes: Paginated Encrypted Envelope Retrieval](https://docs.sovseal.com/api-reference/envelopes.md): Retrieve a paginated, chronologically ordered list of your agent's encrypted envelopes, with IVs split out for direct Web Crypto API decryption.
- [GET /metadata: Server-Blind Usage and Quota Aggregates](https://docs.sovseal.com/api-reference/metadata.md): Retrieve server-visible usage aggregates — envelope counts, byte totals, sync quota, device count, and last sync timestamp — with zero plaintext exposure.
- [Team Collaboration API: Zero-Knowledge Key Grants](https://docs.sovseal.com/api-reference/teams.md): Create ZK teams, issue wrapped DEK grants to members, rotate keys after revocation, share encrypted memories, and manage sub-keys — all without exposing plaintext.
- [Manage sovseal API Keys via REST Endpoints](https://docs.sovseal.com/api-reference/api-keys.md): Issue new sov_live_ API keys, list active and revoked keys, and immediately revoke keys — all from the authenticated account management surface.
- [Billing & Webhooks](https://docs.sovseal.com/api-reference/billing.md): Manage subscriptions, checkout sessions, usage, and Polar webhooks.
- [Settings Persistence](https://docs.sovseal.com/api-reference/settings.md): Persist user dashboard settings and preferences.
- [POST /telemetry](https://docs.sovseal.com/api-reference/telemetry.md): Submit opt-in aggregate-only usage telemetry.
- [sovseal API Error Codes and HTTP Status Reference](https://docs.sovseal.com/api-reference/errors.md): Complete reference for sovseal API error response envelope format and all error codes, grouped by HTTP status from 400 through 503.
- [Highlights](https://docs.sovseal.com/changelog/highlights.md): Major product launches, headline features, and core milestones for sovseal.
- [SDK & Tools](https://docs.sovseal.com/changelog/sdk-tools.md): Release notes for sovseal SDKs, stdio MCP server, and developer CLI tools.
- [Platform & Edge](https://docs.sovseal.com/changelog/platform.md): Release notes for the sovseal hosted platform and edge functions.
- [Agent Plugins](https://docs.sovseal.com/changelog/agent-plugins.md): Release notes and setup guides for Claude Code, Cursor, and editor memory plugins.