Supermemory Deep Research: What's Actually Open Source in the AI Memory Engine

Repo: github.com/supermemoryai/supermemory · 29,246 stars · 2,556 forks · created 2024-02-27 · $2.6M seed (Oct 2025) · reviewed at main @ 4d8a4ebf (2026-09-02)

Verdict: What's open source is the *periphery* (MCP server, SDKs, consumer app, docs); what's closed is the *engine* (memory extraction model + temporal vector-graph database). Engineering quality is exceptionally high — the MCP server in particular — but the README's "#1 on every major AI memory benchmark" is vendor self-assessment, and "the local version is open source" does not match reality: it ships only precompiled binaries, with no engine source in any release tag.

Key Findings

1. The engine is not in the repo. The "custom learning model + temporal vector-graph engine" runs on a closed-source Cloudflare Worker. The repo contains only the MCP server, SDKs, consumer web app, and documentation. 2. The local edition is a closed-source binary. supermemory local downloads darwin/linux precompiled builds from GitHub Releases (no Windows build); all server-v0.0.x tags are structurally identical to main with no engine source. 3. "#1" claims are all self-reported. The 95% Recall@15 figure comes from Supermemory's own research page. Mastra (94.87%), OMEGA (95.4%), Hindsight/Vectorize (94.6%), and Exabase M-1 all claim ~95% SOTA in the same period — mutually contradictory, with no neutral leaderboard. The MemoryBench framework itself is open source (MIT) and reproducible.

Repository Layout

Turbo + Bun monorepo. Note: CLAUDE.md is outdated — it describes a backend (Cloudflare Worker, Hyperdrive, IngestContentWorkflow) that isn't in this repo.

| Path | Size | What it is | |---|---|---| | apps/docs | 71MB | Mintlify docs site (the only public source on engine architecture) | | apps/web | ~73k lines TS | Consumer app app.supermemory.ai (Next.js 16 + React 19) | | apps/mcp | ~7.2k lines TS | MCP server (Hono + Cloudflare Workers) | | packages/tools | 508KB | @supermemory/tools, 7 tools × multi-framework integrations | | packages/memory-graph | ~9.6k lines | Canvas 2D force-directed memory graph visualization (npm) | | Python packages, extensions, playgrounds | ~7MB | OpenAI / Agent Framework / Pipecat / Cartesia integrations, Raycast & browser extensions |

Memory Engine Mechanics (from docs + API shape)

Each document produces three things: Chunks (raw grounding for RAG), Memories (atomic facts on a graph), and Profile (static + dynamic user summary, always in context).

Ingestion is two-phase: queued → extracting (OCR/transcription) → chunking → embedding → indexing. done means only chunk indexing; memory extraction is a second phase called "dreaming" — in dynamic mode related documents are grouped and distilled together ("memories come from coherent units, not isolated writes").

• Graph relations (3 types): updates (new fact supersedes old, isLatest flag, history retained), extends (adds detail, both valid), derives (cross-memory inference of facts the user never stated).
• Memory types: Facts (persist until updated), Preferences (reinforced by repetition), Episodes (decay unless salient).
• Forgetting: time expiry ("exam tomorrow" auto-expires), contradiction adjudication, noise filtering; plus soft delete and forget-matching semantic bulk forgetting (with dryRun).
• Inference memories are flagged isInference and down-weighted in retrieval until human-confirmed; the review queue is sorted by parentCount (number of source memories).
• Profile bypasses retrieval: query-unmatchable preferences ("call me Dhravya") can only come back via profile — the core selling point vs. pure retrieval RAG. Claimed: 3–5 queries → 1 call, 200–500ms → 50–100ms.
• Search: POST /v4/search with searchMode: memories|documents|hybrid; optional rerank (cross-encoder, ~+100ms), rewriteQuery (~+400ms), include.relatedMemories exposes graph edges. Example timing 92ms; platform p50 < 300ms.
• Scale claims: 1M documents / 10M memories per container; ~10 tokens per fact, 50 facts ≈ 500 context tokens.

API Surface (v3 ingestion + v4 memory coexist)

• POST /v3/documents (millisecond queued acceptance), /v3/documents/file (≤50MB), POST /v4/conversations (turn-aware; resubmission with the same customId bills only the diff — max(0, total - seen) — so repeated syncs are free: a clever and honest design).
• v4 memory: direct writes (1–100 per call), versioned PATCH (old version flagged isLatest=false), soft-delete forget, semantic forget-matching.
• Isolation via containerTag hard separation + container-scoped rate-limited keys (default 500 req/60s). Connectors (Drive, Gmail, Notion, OneDrive, GitHub, Granola, web crawler) are cloud-only.

Supermemory Local: "Open Source" in Doubt

The install script (curl -fsSL https://supermemory.ai/install | bash) fetches a precompiled darwin/linux binary (release server-v0.0.8), port 6767, data in ./.supermemory/, zero telemetry. Local embeddings default to Xenova/bge-base-en-v1.5 (768d, ONNX via WASM; swappable with OpenAI / Gemini / Ollama; dimension mismatch refuses to start). 1GB memory governor default, ingestion concurrency 2.

Discrepancy: docs claim "it's open source (git.new/memory)", but neither main nor any server-v0.0.x tag contains engine source. Local extraction uses your own model (OpenAI default gpt-5.1; Anthropic pinned to claude-haiku-4-5) while cloud uses a "proprietary long-horizon model" — the local edition is a freemium funnel, not an open-source engine. v0.0.5 had an embedding-plan read/write inconsistency that silently returned empty results for exact Japanese search; fixed in v0.0.7.

MCP Server (apps/mcp) — Engineering Benchmark

Streamable HTTP, stateless (new McpServer per request). Dual auth: sm_ API keys (validation cached per-isolate, 60s/1000 entries) or OAuth JWT (JWKS). When the upstream auth backend is down it returns 503 + Retry-After instead of 401 — preventing clients from discarding valid credentials.

15 tools in three tiers (model sees only the first 7):

• Tier A (model-visible): search_memory, listDocuments/getDocument, listMemories, listSpaces/whoAmI, add_memory (save/forget combined; forget falls back to 0.85-threshold similarity deletion on 404).
• Tier B (app launchers ×4): select-space, memory-graph, guided-save, upload-file — open embedded single-file HTML widgets with behavioral guardrails in descriptions.
• Tier C (app-only ×4): set-active-tag, save-memory, prepare-file-upload, fetch-graph-data — hidden via _meta.ui.visibility:["app"].

Highlights: two-phase upload (Durable Object stores only the SHA-256 of the upload token, 2-min alarm TTL, atomic consumption, multipart passthrough — widgets never see the real token); decorator-based PostHog instrumentation with zero intrusion; discriminated-union server↔widget contracts (adding a view is a compile error).

SDKs & Integrations

Seven tools defined once, reused across AI SDK / OpenAI / Mastra / VoltAgent / Python.

• withSupermemory (Vercel AI SDK): Proxy intercepts doGenerate/doStream → POST /v4/profile (5s timeout, LRU-100 cache) → dedupe (normalized: static > dynamic > retrieved, order preserved) → injects as <supermemory context="user-memories" readonly> XML in the system prompt → stores the conversation back via /v4/conversations. Memory fetch failure silently skips by default (additive, non-blocking).
• Claude Memory Tool adapter: all six commands implemented (view/create/str_replace/insert/delete/rename; file=doc, customId=normalized path).
• Python packages: openai-sdk (sync/async monkey-patch + 7 tools), pipecat for voice (<user_memories> injection + overlapping-diff incremental storage), cartesia intercepting UserTurnEnded.

Consumer Web App (~73k lines TS)

The Nova agent is closed-source: chat goes through api.supermemory.ai/chat (AI SDK v6 streaming); the repo holds only the UI shell. Model menu: grok-4.5, gpt-5.6-terra, claude-sonnet-5, gemini-3.1-pro-preview. Tool surface inferred from stream widgets: searchMemories, recallContext, discoverSpaces, updateMemory, forgetMemory, forgetDocument + dynamic web search. Memory graph live-highlights documents cited by Nova. Agent space merging: a regex taxonomy folds memories written by Claude Code / Codex / OpenCode / Cursor into one "Agents" space per project. Next.js 16 runs on Workers via @opennextjs/cloudflare.

Business Model

Free $0 ($5 monthly credits) → Pro $19 → Scale $399 → Enterprise. Metering: text tokens $5/1M, rich $10/1M, superrag mode 50% off (skips memory extraction, RAG only), search $5/1M, operations $0.1 each. SOC 2 Type II, GDPR, HIPAA BAA (Scale+); "customer content is never used for training — on every plan." Migration guides from mem0/zep provided.

Benchmark Claims, Verified

The README claims #1 on LongMemEval / LoCoMo / ConvoMem and 95% Recall@15 at ~720 tokens (99.4% context compression). Verification: all figures come from Supermemory's own research page; the docs site gives no numbers; no neutral third-party leaderboard exists (LongMemEval's official academic site does not host commercial vendor rankings). At least four competitors simultaneously self-report ~95% SOTA with contradictory numbers — the metric is saturated by vendor marketing. The credible part: the MemoryBench framework is open source (MIT, unified provider interface), so anyone can re-run supermemory / mem0 / zep plus filesystem / RAG baselines. Another self-report: SMFS saves 3.0× tokens vs. Claude-native on a 110-question xAFS set (24M vs 72M).

Quality Assessment

Good:

• MCP engineering discipline: zod at every boundary, rollback DO keeping one version, correct 503/401 error classification
• Diff-based billing + customId idempotent ingestion
• SSRF protection down to CGNAT ranges, IPv6 literals, 2MB bounded reads
• Load-bearing comments about AI SDK v6 tool-widget defects in the web app

Questionable:

• "Open source" marketing mismatches facts: closed engine, binary-only local edition, no source in tags, all "#1" self-reported
• CLAUDE.md describes a nonexistent backend, misleading agent developers
• Garbled doc sections (apparent bulk-edit accident)
• v3/v4 dual APIs; SDK patches like "pinned SDK lacks forget, so raw DELETE"
• Self-host and cloud "proprietary model" are not the same thing, papered over with a whole local-vs-enterprise docs page

Transferable Lessons

1. MCP three-tier tool visibility (model-visible / app launchers / app-hidden) is a ready-made pattern for "too many tools polluting attention." 2. Profile as a retrieval bypass: facts queries can't match need an always-on summary channel — every memory system should have this asymmetric path. 3. Inference memories default-down-weighted + human review (sorted by parentCount) is a pragmatic guard against LLM memory-hallucination pollution. 4. Diff billing + idempotent customId ingestion makes "repeat syncs are free" a billing primitive — broadly applicable to connector products. 5. withSupermemory's "silently degrade on memory-fetch failure, additive only, never blocking" is the safe posture for adding sidecar dependencies to LLM pipelines. 6. The temporal graph (updates/extends/derives + isLatest + forgetAfter) is more expressive than flat fact lists, but complexity shifts to temporal filtering on the search side.

Sources

• Code: local clone at main @ 4d8a4ebf (apps/mcp, apps/web, apps/docs, packages/tools, etc.)
• TechCrunch: 19-year-old founder raises $2.6M backed by Google execs — https://techcrunch.com/2025/10/06/a-19-year-old-nabs-backing-from-google-execs-for-his-ai-memory-startup-supermemory/
• Supermemory's own funding announcement (self-stated $3M) — https://supermemory.ai/blog/supermemory-raises-3-million-and-building-the-best-memory-engine-for-llms/
• Supermemory LongMemEval self-report — https://supermemory.ai/research/longmembench/ · official LongMemEval (academic, no commercial leaderboard) — https://github.com/xiaowu0162/longmemeval
• Competitor same-period self-reports: Mastra 94.87% (https://mastra.ai/research/observational-memory) · OMEGA 95.4% (https://omegamax.co/benchmarks) · Hindsight 94.6% (https://vectorize.io/benchmarks) · Exabase M-1 (https://exabase.io/research/exabase-achieves-state-of-the-art-on-longmemeval-benchmark)
• GitHub API: repo stats and server-v0.0.8 release asset manifest (captured 2026-09-07)