Cognee: Open-Source Long-Term Memory for AI Agents (GitHub, Scanned)

Cognee is a memory layer for AI agents. You give it text, documents, code or conversations with remember, and it extracts entities and relationships into a knowledge graph alongside vector embeddings; recall retrieves the connected context for a question, and improve and forget refine or remove what it knows. Agents get facts that persist across sessions, and an application can see which evidence an answer came from.

It runs locally with no API key: a small GLiNER model extracts the graph and a local embedding model handles search, both on the CPU, while an LLM key adds generated answers and richer extraction. There are plugins that give Claude Code and Codex persistent memory, an MCP server for Cursor, Cline and other clients, a CLI (cognee-cli), a web UI, and storage backends from local files up to Neo4j.

It is Apache-2.0, with about 32,800 stars and 328 contributors, and the team has published a research paper on connecting knowledge graphs and LLMs. The project calls the local GLiNER extractor a demo of its small-model pipeline; for serious graphs you will want an LLM.

• Repository: github.com/topoteretes/cognee
• Licence: Apache-2.0 (Apache License 2.0)
• Language: Python. Stars: 32.8K. Forks: 3,418. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit 37f788b

Who it is for

Developers building agents or chat apps that need to remember users and projects over time, and people who want their coding agent to keep context between sessions.

Getting started

1. Install with the local extraction model (Python 3.10 to 3.14)

uv pip install "cognee[gliner]"

2. Store something in memory

cognee-cli remember "Marie Curie was born in Warsaw." -d local_quickstart

3. Ask it back

cognee-cli recall "Where was Marie Curie born?" -d local_quickstart

Set LLM_API_KEY (OpenAI by default, other providers through its .env template) to get generated answers. Set TELEMETRY_DISABLED=1 if you do not want usage events sent; see the safety notes.

Safety scan

We cloned topoteretes/cognee at commit 37f788b on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no committed binaries. The two very long lines in cognee/shared/utils.py are a base64-encoded PNG of the Cognee logo, used as a watermark on graph visualizations. The two bare-IP URLs are SSRF-protection tests.
• Telemetry: cognee/shared/utils.py sends usage events to test.prometh.ai unless TELEMETRY_DISABLED is set. Each carries an anonymous ID, a persistent ID stored in ~/.cognee, and a salted hash of LLM_API_KEY that is the same on any machine using that key; dataset names are masked. The raw key and your content are not sent, but the switch is documented in the .env template rather than the README.
• The pattern hits are the web UI showing users the official uv install command, not running it. deployment/setup_ubuntu_instance.sh is an optional cloud setup script that installs Docker with sudo.
• 165 advisories, 16 critical. Most are in cognee-mcp/uv.lock (123, 11 critical, including Pillow, certifi and anyio) and the Next.js front end's package-lock.json (42, 5 critical). The core library's own uv.lock lists 8, none critical.
• 63 workflows; the one on pull_request_target applies a core-team label and does not check out the pull request. 80 of 82 third-party actions are pinned; Dependabot, CodeQL, a security policy and a code of conduct are present; OpenSSF Scorecard 7.1 of 10.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 512.7K, JSON 61.8K, TypeScript 50.8K, SQL 16K, YAML 15.5K, Markdown 13.7K.

Questions

Is Cognee free?

Yes. Cognee is free and open source under Apache-2.0, and runs locally with no API key. Cognee Cloud is a separate managed service for teams that would rather not host it.

Does Cognee need an OpenAI key?

No. Without a key it builds the graph with the local GLiNER model and a local embedding model, and returns matching passages rather than written answers. Adding an LLM key, OpenAI or another provider, gives generated answers and better extraction.

How do I give Claude Code memory with Cognee?

Add the integrations marketplace and install the plugin: claude plugin marketplace add topoteretes/cognee-integrations, then claude plugin install cognee-memory@cognee. The plugin's setup guide covers pointing it at local or remote memory.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.