Aletheia 0.2.0: what a full gap scan found in a local memory hub for AI coding tools

If you use more than one AI coding agent, you have probably re-explained the same project to each of them. Aletheia is a free, local memory and rules hub for that problem: one SQLite store on your machine that Claude Code, Codex CLI, Cursor, Gemini CLI, Windsurf and OpenCode read over MCP, REST or the CLI. It is alpha software, Apache-2.0, with no account and no telemetry.

For 0.2.0 we did something different from adding features one by one. We ran a full gap scan, both of our own code and of claude-mem, the larger and older project in this space, and turned every finding into a task with a test that had to fail before the fix and pass after it. 28 tasks came out of it. Here is what they found and what changed.

A security hole in remote mode

The most important finding was not a missing feature. When the server was bound to a non-loopback address with no ALETHEIA_API_KEY, the Hub login protected the dashboard (/ and /api/*) but not the API the tools use. /v1/*, the live socket and /mcp answered anyone who could reach the port. Loopback installs, the default, were not affected.

0.2.0 requires a login session or the key on /v1 in remote mode, and the key on /mcp, and warns at startup when remote mode runs without a key. An independent review of that fix found three more issues, all now fixed: /mcp on loopback skipped the local-only check, so a reverse proxy in front of it exposed it; the remote login page's own security policy blocked its login request; and the sync hub checked a pairing code before its lockout. SECURITY.md records each one.

Built, tested, and never called

The scan also found features that existed as tested modules but that no command, route or hook ever called: dense vector search outside the CLI, a graph retrieval channel, a file-read gate, folder context files, a reranker. A test suite that tests modules in isolation does not catch this. 0.2.0 wires each of them in, mostly off by default, and adds a test that fails when a module in src/ has no production caller.

Memory that git worktrees can share

Agents that work in git worktrees were filing memory under <repo>/<worktree>, so every new worktree session started with nothing. Worktree sessions now use the main project's memory, project merges move every table in one transaction, and aletheia projects fold-worktrees folds old fragments into the main project, as a dry run first.

Other changes

• Scheduled local backups and aletheia restore.
• Search that finds Chinese, Japanese and Korean words inside stored text. The old FTS5 tokenizer treated a run of CJK characters as one token.
• Every prompt is redacted again right before any model call, not only at storage time.
• team_brief and team_search MCP tools, an import for Claude Code's own memory files, and MCP config for Copilot CLI, Goose and Roo Code. Those configs are written from each host's docs and not tested on a real install.
• A dashboard you can switch into ten languages. The translations are machine-made with no native review.

The numbers, with their caveats

We re-ran our LoCoMo retrieval comparison against claude-mem 15.17.0. Recall@5 was 43.5% for claude-mem as shipped and 57.4% for Aletheia on raw turns. That measures retrieval, not answer accuracy, and the result files and commands are in the repository so anyone can re-run them.

Try it

git clone https://github.com/mohamed-ashraf-elsaed/aletheia-mem
cd aletheia-mem
bun bin/aletheia-server.mjs

Open http://127.0.0.1:37790. It needs Bun 1.1 or newer. Or install the package with npm install -g aletheia-mem and start aletheia-server.

If you use one of the hosts we have only configured from docs (Cursor, Gemini CLI, Windsurf, Copilot CLI, Goose, Roo Code), the most useful thing you can do is try it on a real install and open an issue with the tool, its version, the command and what happened.