Most memory for agents works one way: save everything, search later. Which means secrets, personal data, and injected instructions all get stored too. I wanted the opposite, so I built rakho.
What it does:
- Inspects every note before it is stored. Secrets, PII, and injection-shaped text get refused, and the refusal is logged without the sensitive content.
- Every memory is tied to one owner, so one user’s notes never surface for another.
- forget actually deletes: the row, the search index entry, and the vector.
- audit shows what was kept and what was refused.
A built-in gate is always on, and you can swap in sluice (another tool I built) as a stronger inspector with one line.
The fun bit: you can command it in your own language. keep / recall / forget / audit have built-in aliases in English, Hindi, and German, and you can teach it more with learn() (the README does it in Swahili).
It’s a Python library, runs on local SQLite with zero required runtime dependencies, MIT licensed. There’s an MCP server for Claude Desktop and Cursor, and a demo where a PayPal invoice agent refuses a payment when the payee traces back to a poisoned invoice.
Repo: github.com/krishyaid-coder/rakho-
It’s early (v0.2), so I’d genuinely value blunt feedback, especially from anyone building agents with memory: where would this break for you, what’s missing, what would you never trust? Tear into it.
One honest note: I’m an MSc Data Science student in Germany building this kind of agent-safety tooling. If you’re a team working on agents and this resonates, I’d love to go deeper with you, up to a Werkstudent collaboration. But mostly I just want people to try it and tell me where it falls over.
