Install
macOS and Linux. A native binary — no Python, no GitHub account, nothing to authenticate.
brew install sekondbrainailabs/s9n/kemoryUpgrade later with brew upgrade kemory.
| Platform | How |
|---|---|
| macOS, Apple Silicon and Intel | Homebrew, above |
| Linux, x86-64 and arm64 | Homebrew, above |
| Windows, x86-64 | Download kemory-windows-x64.zip from the releases page, extract it, and put the folder on your PATH |
Check it worked:
kemory --versionEvery command takes --help, and kemory --help lists them all. This page covers the ones you are likely to need.
Homebrew is a convenience, not a requirement — every binary is a plain public download, no GitHub account needed. Take the archive for your platform from the releases page (kemory-macos-arm64.tar.gz, kemory-macos-x64.tar.gz, kemory-linux-x64.tar.gz, or kemory-linux-arm64.tar.gz), check it against the .sha256 file published beside it, extract it, and put the folder on your PATH.
Sign in
kemory loginThis opens a browser, signs you in through SeKondBrain's identity service, and stores a short-lived token that refreshes itself. Kemory never sees or holds your password, and because there is no key to paste, nothing secret ends up in your shell history.
Confirm it worked:
kemory whoamiThat prints the account and organisation your token resolves to. kemory logout removes the stored credentials.
Connect a local client
If you have done nothing else yet, this is the whole setup — it signs you in if needed, writes the config, and verifies the result with a live call:
kemory connectEvery step is idempotent, so re-running it is safe and is the first thing to try when a client has stopped seeing Kemory. It takes the same --host choices as below, and --no-browser if you would rather copy the login URL yourself.
To write the config without the sign-in and verification around it:
kemory mcp install --host claude-code--host | Client |
|---|---|
claude-code | Claude Code — the default if you omit --host |
claude-desktop | Claude Desktop |
cursor | Cursor |
continue | Continue.dev |
warp | Warp |
all | Every supported client found on this machine |
--host may be repeated to do several at once.
Claude Code has a plugin that carries its own HTTP entry to the same API and adds hooks for session context, prompt recall, rating and consolidation — see Connect Claude Code. Use one or the other: if you install the plugin later, remove the kemory entry this command wrote to ~/.claude.json, or you will run two servers and get two copies of every tool.
Restart the client fully afterwards — quitting the window is not enough. Warp is the exception; it picks the change up on save.
The entry it writes runs a local bridge that speaks MCP to your client and HTTPS to Kemory, authenticating with your browser login. No API key is written into the file — so your client configs stay safe to sync between machines, or commit.
This path is for clients running on your own machine. An agent that cannot start a local subprocess — a hosted or cloud agent — should connect to the remote endpoint directly instead. See Connect a web AI.
Ask your vault
Everything else on this page configures access. This is the one command that uses it:
kemory ask "what did we decide about the search architecture"Search returns what matches; ask returns an answer, composed from what it found and followed by the evidence it used. It reads memories, captured chats and text files together — an answer is as likely to be sitting in a conversation as in a memory somebody wrote down.
| Option | Effect |
|---|---|
--type | memory, chat or file. Repeatable; omit for all three. |
--limit | How many items to ground the answer in. |
--no-synth | Skip the model call and return the evidence only — faster, and costs nothing. |
--json | The raw response, for scripting. |
If nothing relevant is found, or the answer cannot be composed, you get a line saying that plus whatever evidence was retrieved — never a confident answer assembled from material that does not support it. The same request over HTTP is POST /api/v1/ask, and MCP clients get it as kemory_ask.
API keys
Keys are for clients you are configuring by hand, and for CI. Most people never need this command and can mint a key from Dashboard → Keys instead.
kemory keys list
kemory keys create --name my-agent --write
kemory keys rotate <agent-id>Without --write, a key can recall memories but not store them — least privilege by default. If an agent reads your memories happily but never seems to save anything, this is almost always why.
A new key is displayed once and never shown again — copy it when you create it. To retire a key, rotate it, which invalidates the previous value, or delete it from the dashboard.
A newly created agent may need an administrator to approve it before its key starts working, depending on how your organisation is configured. If a fresh key is refused, that is the first thing to check — kemory doctor reports the agent's status.
Organisations
If your account belongs to more than one organisation, memories are scoped to whichever one is active.
kemory orgs # list them; the active one is marked
kemory use "Acme Corp" # switch — by name, id, or id prefixThe switch persists and applies to the next command. Membership is re-checked on the server for every request, so switching cannot grant you access you do not already have.
Diagnosing
kemory doctorThis walks the whole path end to end: reads your stored credentials, checks the service is healthy, confirms the credentials resolve to an account, lists the tools the server is offering, verifies your organisation is set, and reports how many namespaces you have and when a memory was last written.
| What you see | What it means | What to do |
|---|---|---|
401 on every call | The stored login expired or was revoked | kemory login |
| Organisation empty | Your account's organisation has not reached the identity service | Contact support — this is not fixable from the CLI |
Client does not list the tools after mcp install | The client was not fully restarted | Quit it completely and reopen |
| The bridge exits immediately | The client is passing environment variables that override your stored login | Re-run kemory mcp install for that client |
Self-update
kemory upgrade # --check to look without installingIf you installed through Homebrew, use brew upgrade kemory instead — upgrade detects a Homebrew install and tells you so rather than fighting it.
Telemetry
Off by default, opt-in only.
kemory telemetry status
kemory telemetry on
kemory telemetry offWhen enabled it records anonymous usage counts against a random install id. It never collects your identity, your memory contents, file paths, or the values of any argument you type.
Support
The output of kemory doctor is the most useful thing to include in a support request — it says which step broke without exposing your memories or your credentials.