TencentDB Agent Memory Makes Every Memory Private by Default. Its Newest README Dropped the Benchmark That Made It Famous.
A team-level memory hub with real ACLs on every stored fact, an SQLite backend you can run yourself, and a benchmark table that got shorter between branches. Here is what it does, how to try it, and which number to stop repeating.
The number that carried TencentDB Agent Memory around social media is 61.38 percent, the token reduction it claims when paired with OpenClaw. It is still there in the main README, in a table with three more rows next to it.
It is not in the newer one. The feat/server_team README, which is where the current four-asset framing lives and which the repository description now quotes, keeps exactly one benchmark row: PersonaMem, 48 percent to 76 percent. The token number, the WideSearch pass rate, SWE-bench, and AA-LCR are gone.
I read that as a project getting more honest with itself, and it points straight at the thing worth actually paying attention to here, which is not the benchmarks at all.
The interesting design is the permission model
Most agent memory projects give you a store and a retriever. This one gives you an owner, a visibility level, and a review step, and I think that is the more useful idea by a wide margin.
Every asset in TencentDB Agent Memory carries one of four visibility levels. private means, in the README's words, "Only the Owner can read, not even team admins." team shares across the team. restricted does "Precise access via User / Role / Agent ACL." agent binds an asset to a specific agent. Assets are scoped to a team / agent / task triple, and the hub uses what the docs call "Fixed Binding + ACL."
Then the default. "New Chat Memory and Skills are private by default. Sharing is an explicit action, not a default leak."
That sentence is doing real work. Think about what a shared team memory hub is if you get it wrong: one agent writes a wrong fact, a stale credential path, or a customer detail somebody should not have, and every other agent in the org inherits it silently. A memory store without an access model is a blast radius with a search index on top. Making every new memory private until a human promotes it is the difference between a knowledge base and an incident.
Skills get the same treatment, plus versioning. The README is specific: "A Skill isn't just a prompt snippet; it has versions, resource files, trigger boundaries, execution steps, and validation rules." Personal skills are private, and after review they can be shared with the team and assigned to other agents. That is a lifecycle. It is the same lifecycle we already give code, applied to the thing agents actually run on.
What the four assets are underneath
Chat Memory is a four-level pipeline, not a vector dump. Raw conversation lands as L0 in SQLite. An async pipeline refines it into L1 Atoms (facts, preferences, constraints, events), L2 Scenarios (knowledge blocks per project), and L3 Core/Persona. Retrieval starts high: "normally, L2/L3 provide a quick context bootstrap; when specific facts are needed, BM25 + vector retrieval + RRF fall back to L1/L0." Start with the summary, drop to the raw text only when you need a specific fact. That is the right shape.
Skills are extracted by the model itself. The install guide describes it plainly: if the LLM decides "this is a reusable how-to," it gets pulled out into a Skill. The skill code is acknowledged as derived from Nous Research's Hermes Agent.
LLM-Wiki turns docs, specs, and runbooks into structured pages with a link graph, credited in the acknowledgements to Karpathy's LLM knowledge base gist. Code-Graph indexes symbols, files, call relationships, and impact paths so an agent can check who calls a function before it edits it, and the README says outright that the module "uses code from" colbymchenry/codegraph.
I like that the acknowledgements are that explicit. Three of the four assets name their upstream. That is a good sign about how the rest of the claims are made.
Put this into practice
The lowest-friction path is Docker, and it is genuinely short. Clone the repo, cd deploy/global-images, copy .env.example to .env, run ./start-all.sh. You get four services: Memory Core on 8420, the Panel UI on 8125, the knowledge service (Wiki and Code-Graph) on 8424, and a dual-protocol proxy on 8096.
The storage is SQLite with sqlite-vec underneath, self-hosted, no Tencent Cloud account required. Tencent Cloud Vector DB is an optional backend added back in v0.2.2, not a dependency. Postgres is not on offer.
Connecting Claude Code is the part people get wrong, because there is no MCP server upstream. It works through the Anthropic-protocol proxy:
export ANTHROPIC_BASE_URL=http://127.0.0.1:8096/claude-code/default
export ANTHROPIC_AUTH_TOKEN=sk-mem-...
claude --model <PROXY_UPSTREAM_MODEL>
The proxy pipeline runs auth, then a session init that uses Claude Code's own AskUserQuestion tool to make you pick team, agent, and task, then injects L2/L3 memory plus skills and knowledge into the system prompt before forwarding upstream.
One trap worth knowing before you start, because it will waste your first evening. Per INSTALL.md, system_admin "cannot directly create other business assets such as Agent / Wiki / Skill," because the business APIs enforce owner_user_id === caller and the admin role is not yet in the allow list. Create a normal user first, or the Claude Code team picker comes up empty and you will think the install failed.
If you want to evaluate it in an afternoon, do this: import one real project's conversation history, then open the Panel and look at what landed in L1 and L2. The quality of that extraction is the whole product. Everything else is plumbing around it.
Where it breaks, and what I would not repeat
The benchmark table is the honest-limitations headline, so let us be precise about it.
The main README claims, verbatim: "When integrated with OpenClaw, it cuts token usage by up to 61.38%, improves pass rate by 51.52% (relative), and raises PersonaMem accuracy from 48% to 76%." The supporting rows are WideSearch 33 percent to 50 percent with tokens falling from 221.31M to 85.64M, SWE-bench 58.4 to 64.2 percent, and AA-LCR 44.0 to 47.5 percent.
Those are vendor self-reported numbers with no paper, no arXiv link, no eval harness in the tree, no logs, no seeds, and no disclosure of which underlying model produced the baseline. There is no bench, eval, or experiments directory on main. The README invites "benchmark reproductions" as a contribution type, which is a polite way of saying reproduction is your job. And the newer branch dropped everything except PersonaMem. When a project removes its own strongest marketing number, believe the removal.
The rest of the caveats are stated in the repo's own Notes, which I appreciate:
Wiki and Code-Graph build asynchronously, so allow time before they reach ready. Code-Graph "currently prioritizes public HTTPS repositories; support for private repositories and SSH credentials is still being refined," which rules out a lot of real work. The hub "supports manual asset binding; fully automated memory routing is still under iteration." Supported harnesses are OpenClaw, Hermes, and the SDKs, with "broader cross-framework migration on the roadmap." The whole team layer is labeled Beta by its own banner.
Two more things I would want you to know before you deploy it anywhere shared. Gateway auth (server.apiKey) and the CORS allow list both default to off, and binding to 0.0.0.0 without a key only prints a warning. Set the key. And the tagline "zero external API dependencies" needs an asterisk: the project's own release notes qualify it as running with only an LLM API key, and the new stack's .env wants two LLM configs, one for the memory pipeline and one for the proxy upstream. It is local-first. It is not LLM-free. The model does L1 extraction, dedup, scene extraction, persona generation, and skill extraction.
Licensing has a wrinkle too. The LICENSE file is MIT text behind a Tencent copyright preamble, which breaks GitHub's SPDX detection: the About sidebar shows "View license" rather than "MIT license," and Trendshift reports "Custom license" while the README badge says MIT. Read the file yourself before your legal review does.
And do not trust any star count you read about this repo, including mine. Fetching seven different GitHub URLs for it in one session returned seven different figures, from 4.7k to 10.1k, purely from CDN cache age. The freshest primary reading I could get was 10.1k stars and 974 forks on August 1. Every third-party writeup citing 4.5k or 7.8k is weeks stale.
Take one thing from this
Whether or not you run TencentDB Agent Memory, steal the default.
Go look at whatever memory your agents write today, and ask one question: if an agent stored something wrong in there this morning, who else would be reading it by tonight? If the answer is everyone, you have a sharing model that leaks by default, and the fix is a visibility flag and a promotion step, not a better retriever.
That is a weekend of work in whatever you already run. It is worth more than 61 percent of anything.
Sources: TencentCloud/TencentDB-Agent-Memory; main README; feat/server_team README; INSTALL.md; LICENSE; releases; Trendshift.