Claude Mem: Is the Claude Code Memory Plugin Safe to Use?
Claude Mem gives Claude Code persistent memory, but a past bug uploaded user prompts without consent. Here's what to check before installing.
What is Claude Mem?
Claude Mem is an open-source memory system for Claude Code and other coding agents. It watches what an agent does during a session, compresses that activity into short notes called observations, and feeds the relevant notes back into future sessions. The project has passed 112,000 GitHub stars and close to 10,000 forks, is licensed under Apache 2.0, and recently shipped version 15.9. It’s no longer a weekend experiment. It’s installed widely enough that a privacy misstep in it is worth taking seriously, and one did happen.
The core problem Claude Mem solves is simple to describe and annoying to live with. Claude Code starts every new session with no memory of the last one. You explain a bug, walk through a fix, close the terminal, and the next day the agent has forgotten everything. You re-explain the same decisions, it re-reads the same files, and you pay token costs for context you already built once. Claude Mem tries to carry that context forward automatically, without you having to run a command or write anything down.
How does Claude Mem actually work?
Claude Mem hooks into Claude Code’s lifecycle events: session start, prompt submission, before and after every tool call, when Claude stops, and when a session ends. Every file read, edit, or command execution passes through these hooks to a small worker service that runs locally on your machine.
The worker sends raw tool-call data to an “observer,” a lightweight model (Haiku, on the Claude provider) that turns that raw activity into structured observations. Each observation gets a title, a type (bug fix, decision, and so on), a short narrative, relevant facts, and the files touched. These get stored in a local SQLite database, alongside a Chroma vector database for semantic search. When a session ends, Claude Mem also generates a summary covering what was requested, what was investigated, what was learned, and suggested next steps.
The retrieval side is where the design gets interesting. Dumping your entire history into context on every new session would be wasteful and slow. Instead, Claude Mem uses what it calls progressive disclosure: a new session gets an index of recent observations (titles and types only, by default the last 50), plus an estimate of how many tokens it would cost to read each one in full. The agent decides what’s worth opening. If it needs more detail, it has search tools that return compact lists of observation IDs, roughly 50 to 100 tokens per result, before fetching the full content. The project claims roughly 10x token savings from this filter-before-fetch approach, though it also notes the actual savings depend on your workload and model provider, which is a fair caveat rather than a hard guarantee.
In practice, this means a fresh session can recall why a previous fix was made (say, a date-parsing bug tied to time zones) and apply that same reasoning to a new, unrelated task, without you repeating any of the original explanation. Asking the agent “why did we change X” later triggers a search call that pulls the right observation and answers directly, instead of re-reading code from scratch.
What was the Claude Mem privacy bug?
In version 15.2, Claude Mem added a browser-based setup step. Until a fix landed a few days before this writing, that setup scanned local history from Claude Code, Codex, Gemini CLI, and other tools, and uploaded the full text of roughly the last 30 days of prompts to cmem.ai, along with project names, folder paths, and timestamps. This happened automatically as soon as the setup page loaded, without asking for consent.
A user reported the behavior in a GitHub issue. According to that report, cmem.ai confirmed the prompts were routed through Open Router without blocking providers that may retain or train on submitted data, all while the published privacy policy stated that nothing leaves your device unless Cloud Sync is explicitly enabled. That’s a direct contradiction between stated policy and actual behavior, and it’s the kind of thing that should concern anyone running an agent against proprietary code or client data.
The issue was fixed in version 15.8.3 (released November 2), which now pauses and asks for explicit consent before any upload, with a clear “keep everything local” option. The release notes for that version also state that prompts uploaded under earlier versions are not retroactively deleted. If you installed Claude Mem any time before 15.8.3 and went through the browser setup, assume your recent prompt history may already be on cmem.ai’s servers.
Is Claude Mem safe to use now?
With the current version and the right settings, it’s reasonably safe, though a few defaults still deserve attention.
Telemetry is on by default. It’s anonymous and documented, and the installer asks once, but it’s opt-out rather than opt-in. You can disable it with npx claude-mem telemetry disable or by setting the standard DO_NOT_TRACK environment variable.
- Name
- Maria Alvarez
- Date of birth
- SSN
- Diagnosis
- Balance due
- $412.80
Auto-redaction is a genuinely useful privacy feature: it recognizes around 30 built-in patterns for things like API keys and strips them before storage. The catch is that it’s opt-in, not on by default, which seems backwards for a tool that’s reading your entire coding session. Turning on the redaction setting takes a few seconds and is worth doing immediately.
You can also wrap any text in private tags to keep it out of storage entirely, while still letting Claude use it within the current session.
The bigger structural question is which “provider” runs the observer model. Claude Mem defaults to signing you up for its hosted service, cmem.ai (branded “CMEM Pro”), with a 30-day free trial. If you’d rather keep memory entirely on your own Anthropic usage, pass the --provider flag during install and skip the hosted sign-in. You can also point Claude Mem at your own Open Router key, Gemini key, or any OpenAI-compatible endpoint.
How much does Claude Mem cost to run?
The core engine is free and open source, but someone has to pay for the observer model that generates observations. If you run Claude Mem on your own Anthropic plan via the --provider flag, that usage comes out of your existing Claude Code limits, not a separate quota. That’s not necessarily free: there’s a documented case of a user on the Claude provider seeing around 230 hidden background runs in four days from the “my work” refresh feature, which ate into their usage quota without an obvious prompt-level explanation.
If you use the hosted cmem.ai service instead, pricing runs $30 a month after the trial, with higher tiers at $70 (“Heavy”) and $100 (“Max”) for larger usage.
Should you install Claude Mem?
If you work on the same codebase over weeks and keep re-explaining the same architectural decisions or re-diagnosing the same bugs, Claude Mem solves a real problem, and the progressive-disclosure design is a sensible way to do it without flooding context windows. For short, one-off tasks, it’s probably overkill. A well-maintained CLAUDE.md file covers most of that need for free, with no background services or third-party data flows to think about.
If you do install it: use the --provider flag to keep memory running on your own plan rather than the hosted default, decline any prompt-upload step, disable telemetry, and turn on redaction before your first real session. That’s a couple of minutes of setup, and it gets you the token-saving behavior without the parts of the default configuration worth being cautious about.
Frequently Asked Questions
What is Claude Mem used for?
It gives Claude Code (and several other coding agents, including Codex, Cursor, Windsurf, and Copilot) persistent memory across sessions, so the agent recalls past decisions, bug fixes, and context without you re-explaining them each time.
Did Claude Mem actually leak user data?
Versions before 15.8.3 uploaded up to 30 days of local prompt history to cmem.ai automatically during browser setup, without consent, contradicting the stated privacy policy. This was fixed in 15.8.3, but previously uploaded data wasn’t retroactively deleted.
Which version of Claude Mem should I use?
Use 15.8.3 or later, since that’s the first version that asks for explicit consent before uploading anything and offers a “keep everything local” option.
Does Claude Mem cost extra on top of my Claude subscription?
Remy.
If you run it on your own Anthropic plan via the --provider flag, it uses your existing Claude Code quota rather than a separate charge. The hosted cmem.ai service has its own pricing starting at $30 a month after a free trial.
Is Claude Mem only for Claude Code?
No. Despite the name, it supports other agents through an --id flag, including Codex, Cursor, OpenCode, Windsurf, Copilot, Kimi, Devin, and others.
