Wyrm gives AI coding agents a memory that lasts between sessions, and stops them repeating mistakes they have already made. It is free, and it runs on your own machine.
npm install -g wyrm-mcpEach figure comes from a benchmark or test suite in the Wyrm repository, and runs offline. The receipts page gives the file, line, commit and date behind every one, and the command that reproduces it.
| Figure | What it measures | Commit, date |
|---|---|---|
| 100% | Repeated mistakes caught, 16 of 16, on the firewall benchmark | 4a67c24, 2026-07-11 |
| 100% | New actions let through without a false block, 16 of 16 | 4a67c24, 2026-07-11 |
| ~0.3 ms | Time to check an action before it runs (median) | 6c0b055, 2026-09-14 |
| 72.0% | Questions where the right memory is in the first ten results (LoCoMo benchmark, the bundled local model) | a09f572, 2026-08-14 |
| 39.9 → 55.5% | Right memory ranked first with NVIDIA NIM embeddings, then with the NIM reranker (optional, 301 questions) | 3d11168, 2026-10-04 |
| 622 | Jailbreak prompts it was tested against | 26b244d, 2026-07-17 |
| 0 | Ordinary text wrongly flagged as an attack | 26b244d, 2026-07-17 |
| 3,395 | Automated tests passing, across 305 suites | c37b496, 2026-09-14 |
Local use is free with no limits and no account: the memory, the mistake firewall and the search, all of it. Paid plans add cloud sync across devices, encrypted snapshots, shared team memory and support. They are arranged by email, not a checkout: write to support@ghosts.lk.
Free
For individual developers
$29
per month
For power users
$199
per month
For development teams
$499
per month
For organizations
Already on a paid plan? Sign in to your account ↗ Need something the plans do not cover? Contact us.
Local Wyrm stays free. If it is useful to you and you want to support the work, you can buy us a coffee ↗
Text containing the word “constructor” or “__proto__” could not be indexed by the bundled local model: the tokenizer read those words as built-in JavaScript objects rather than vocabulary, and the conversion failed. Recall then fell back to keyword search without saying so. Since 9.4.0 indexes private memories on the bundled model, this reached any private memory that mentioned a JavaScript constructor. Other text indexes exactly as before, and the memories that failed are picked up by the next backfill.
A review of 9.3.1 on a store in daily use since June found four problems, and this release fixes all four. On installs using NVIDIA’s hosted models, memories from private projects were sent to NVIDIA to be indexed, which Wyrm’s own egress document says never happens; they are now indexed on the machine. Memory reaches the agent marked as records, not instructions, and an imported rule no longer becomes a ground truth on its own. Backups now run by themselves, wyrm doctor fails when the newest is more than two days old, and servers starting together no longer crash on an upgrade.
The setting WYRM_LICENSE_REFRESH=0 is documented as the switch that stops Wyrm's license calls, but a paid license close to its expiry still renewed itself with the switch set. The check now sits inside the renewal itself, so the switch stops the call it says it stops.
Signing in with wyrm login used to replace an installed Pro, Team or Enterprise license with a 30-day free one, without a word. It now keeps a paid license, and installs that were already moved to the free tier fetch theirs back on their own. The same release fixes the setup crash and the hook failures reported from Windows, and wyrm cloud login now tells Wyrm Cloud which machine it is.
A long-term audit of a store in daily use since June found that Wyrm kept everything forever, trusted every truth it was ever told, let its indexes rot, and could silently lose or resurrect data across devices. This release fixes that, and the default tool surface stays at 33 tools and 7,995 tokens.
Unknown arguments used to be silently dropped, so a misspelled argument did nothing. Tool calls now reject arguments a tool does not accept, and the wyrm vault exec wrapper that sits in front of every MCP server no longer loads the store, the SDK or the CLI.
A hands-on audit of 9.2.0 covered the MCP tools, the CLI, the server process, the Claude Code hooks, packaging, and the editor and adapter packages. It found defects that lost no data but made Wyrm harder to trust or to run, and this release fixes them with no schema change and no ranking change.
NVIDIA retired both of Wyrm's default hosted NIM retrieval models on 2026-08-25, and Wyrm caught the error and returned nothing, so on installs using the NIM tier new memories stopped being embedded and recall fell back to keyword-only while wyrm doctor still showed a green tick. Both defaults are replaced, and wyrm doctor now checks embedding health.
An upgrade used to overwrite the whole MCP server entry, which destroyed a wrapped launch command and the env var selecting a hosted embedding provider. Setup now merges, and your env wins over ours. wyrm doctor also stops calling a 1% vector index healthy.
9.1.0 memoised anything the Read tool touched, screenshots included, which turned a picture into a memo of mangled binary and inflated the saving it claimed. A memo now requires the file to be text, decided by sniffing the bytes rather than trusting the extension.
Every figure here traces to the Wyrm repository; the receipts give the file, commit and date behind each one.
MCP, the Model Context Protocol, is an open standard for connecting AI assistants to outside tools and data. An MCP memory server is one that gives the assistant persistent memory it reads and writes over MCP, so context survives across sessions instead of resetting when the context window clears. Wyrm is an MCP memory server: install it once and any MCP-capable client can use it.
Wyrm is a local-first AI memory and intelligence layer, an MCP server that gives coding agents like Claude, Cursor and Copilot persistent memory across sessions and learns from recorded failures to block a known mistake before it repeats.
Developers and teams who work in one or more AI coding assistants and want a single persistent memory behind all of them, and people building agent fleets who need run-attributed, accountable memory that many agents can share.
Yes. Wyrm is an MCP server, so it works with any MCP-capable client: Claude Code and Claude Desktop, GitHub Copilot, Cursor, Windsurf, Codex, and others. One memory layer sits behind all of them instead of a separate integration per tool.
Memory lives in a local SQLite database on your machine. Nothing egresses by default, the free tier needs no account, and it works fully offline. Cloud sync and encrypted snapshots are an explicit opt-in on paid tiers, and any hosted embedding or reranking call is disclosed on every recall.
Yes. Local use is free with no limits and no account: all 154 tools, the full 33-verb surface, fleet memory, negative learning, write receipts and hybrid recall. Paid tiers add cloud features: Pro is $29 a month, Team $199, Enterprise $499. They are arranged by email, not a checkout: write to support@ghosts.lk.
Run npm install -g wyrm-mcp, then add a server named wyrm pointing at the wyrm-mcp command to your MCP client's config. It is published on npm as wyrm-mcp and on the official MCP Registry as lk.ghosts/wyrm. Setup takes about a minute.
Two ways. It is local-first and MCP-native, so your memory stays on your machine and plugs into any MCP client without per-app glue. And it does more than store facts: it records what failed and blocks the repeat, links each decision to its reasoning and downstream effects, and injects project ground truths into every context brief. Its published benchmarks are deterministic and reproducible offline, with no cloud LLM in the retrieval path.
Wyrm records failures, not just successes. When an agent is about to repeat an approach that already failed, a guard hook surfaces that prior failure and blocks the counter-pattern before the doomed call runs. On the benchmark that ships in the repository it blocks a repeated mistake at 100 percent recall and 100 percent precision, with no false blocks on novel actions, deterministically and in well under a millisecond, no LLM and no cloud.
No. Core recall runs on full-text search fused with local semantic vectors from a bundled embedding model, with no extra LLM call in the hot path, which keeps retrieval fast, cheap and deterministic. Optional NVIDIA NIM embeddings and reranking lift recall further and are an explicit opt-in.
npm install -g wyrm-mcpThen run wyrm-setup to connect your editors. Questions, or a paid plan: support@ghosts.lk. Wyrm is made by Ghost Protocol, a security and software company in Colombo.
Answers come from an AI. To reach a person, email ryan@ghosts.lk or WhatsApp +94 71 055 5055.
Sol here. Ask about a pentest, the free scan, Wyrm, or anything on the site.