Brain Server

Governed, local-first memory and decision infrastructure for AI agents. Deterministic, privacy-preserving, human-auditable.

Brain Server gives an agent a second brain that lives on the operator’s own device. Recall never has to think: a static, local embedding model plus a deterministic retrieval pipeline answer the question without an LLM deciding, without an embedding API on every read and write, and without data leaving the machine.

The one-line framing for 2026: your agent’s memory is a compliance time bomb. Brain Server is the tamper-evident, human-gated memory store that defuses it.

The three pillars

1. Deterministic, reference-faithful retrieval — no LLM in the loop, no per-query cost, no data egress. The retrieval stack implements published research deterministically (bi-temporal knowledge graphs, submodular evidence packing, TRACE edges, Personalized PageRank graph leg, GAAMA hub dampening, calibrated abstention). See docs/research/.
2. Human-in-the-loop write gate — nothing becomes memory autonomously. A candidate is proposed, scored deterministically, and promoted only when a human approves. The injection screen (blocklist + optional local classifier) quarantines adversarial input before it reaches the gate. See v1.14–v1.20, extended since then by the v1.28 governed loop — lineage events on every workflow step, an outcome scoreboard with signed calibration, the complaint/aftersales lifecycle — closing the Enterprise Line at v1.28.62 “Attestation” with signed provenance marks on every engine-generated artifact, the principal kill-switch, and the cryptographic inventory — then hardening through v1.28.80 “Lockdown” (two-principal approvals, fail-closed auth admissions, visible mixing flags), the off-host anchor + physical shred (v1.28.91 “Notary”), and the governed diagnostic loop with its OS-bounded exec path, machine-refusal law, and dual-gated bulk reads (v1.28.92 “Ledger”).
3. Tamper-evident audit — every decision (and, opt-in, every read) lands in a keyed hash chain (HMAC-SHA256 under a per-DB epoch, legacy rows verifying as legacy) you can verify end to end. DSARs produce chain- verifiable deletion certificates. Every security/compliance claim in the docs is reproducible live, not asserted. See docs/trust/proof-map.md.

What it is not

• Not an LLM — it stores, recalls, and supports structured decisions; it does not generate free-form prose.
• Not a SaaS lock-in — one self-hosted binary, zero telemetry, no vendor.
• Not a black box — every mechanism has a documented, deterministic implementation and an honest ceiling.

Who it is for

• Developers building agents that need memory their users can trust, audit, and delete on request.
• Operators who must answer “what did the agent know, when, and why?” for a SOC 2 / GDPR / EU AI Act review.
• Teams that refuse to pay an embedding API on every read/write and refuse to ship user memory to a third-party datacenter.
• Support & contact-center operations — from in-house helpdesks to multi-client BPOs — whose agents need to recall past resolutions and policy, keep client data on-prem, and stay human-gated and auditable. The controls they need are shipped today; multi-client tenancy on one shared backend is the v2.0 “Cortex” roadmap. See Who it’s for — target audiences.

Continue to Quickstart or Install. For the self-serve evaluation story, see Editions.

For the narrative — the why / who-it’s-for / market-shift stories — see the blog (one post per hard-won mechanism, each tied to its research or trust source) and the media kit (positioning, one-liners, and a Brain-vs-the-field sizing table with honest ceilings).

For who builds this, how to reach us, and how to arrange a free pilot on your own hardware, see About & Contact.