.webp)
Octopoda
Octopoda is an open-source memory and observability layer for AI agents, added to Python projects with one pip command: versioned recall, loop detection, hash-chained audit trail. No legal entity or terms of service are published anywhere.
What is Octopoda?
Octopoda is an open-source memory layer for AI agents, built on the observation its home page turns into a slogan: your agents forget everything between runs. Installation is one command, pip install octopoda, on Python 3.9 or later; the documentation announces around five minutes of setup and ninety seconds from install to a first stored memory. The central primitive is an AgentRuntime object, instantiated with an agent identifier, on which you call remember, recall and recall_similar. Four pillars are advertised: Remember, Recall, Version, Share.
Recall works by exact key and by semantic search, served by pgvector or SQLite-VSS, with a reported MRR of 0.814. Versioning is temporal: every write creates a version, and history() returns the full trail for a key. Shared memory spaces let several agents read and write the same context, with last-write-wins conflict resolution and an attributed change log. Snapshots are taken automatically every twenty-five writes, with restoration announced in under a millisecond.
The other half of the product is observability. A five-signal loop detector watches for repetitions, reflection loops, tool spam, duplicate writes and runaway chains; circuit breakers with per-agent thresholds stop an agent and allow a one-click resume, and hard spend caps are enforced at write time. Decisions are recorded in a hash-chained audit trail, presented as tamper-evident and exportable. Around this sit an entity-extraction knowledge graph, goal tracking with drift detection, inter-agent messaging with no external bus, and a real-time dashboard of eight tabs including a 3D view called The Atlas.
Nine integration guides cover vanilla Python, LangChain, CrewAI, AutoGen, the OpenAI Assistants API, the OpenAI Agents SDK, Anthropic, the Model Context Protocol and the REST API with webhooks, while a 28-tool MCP server exposes the same primitives to Claude Code, Cursor, Windsurf and Codex. Two modes are offered: local, on SQLite, offline and without an account, or cloud, through an API key. Announced latencies are 620 microseconds median for a write and 380 for a read. The core is MIT-licensed, published on PyPI and on a public repository with 327 stars.
What it does
- Store a memory in a single call from any supported agent framework
- Recall by exact key or by semantic similarity search
- Version every write and browse the complete history of a key
- Share one memory space between several agents working together
- Detect runaway loops and cut the agent off before it burns budget
- Replay the hash-chained audit trail behind a given decision
When to use Octopoda / When not to
A quick filter to help you decide if Octopoda is the right fit.
When to use Octopoda
- Python teams running several agents in production that lose their context between sessions and restarts
- Multi-agent fleets that need to hand context to one another through shared memory spaces
- Developers worried about the cost of runaway agent loops, who want spend caps and circuit breakers
- Projects where a replayable audit trail of what an agent decided has to be produced on request
- Local-first or offline work: the SQLite mode keeps everything on your own machine and needs no account
When not to use Octopoda
- Organisations that require a legally identified supplier: no company name, address or country appears anywhere on the site
- Purchases that go through a data processing agreement or a vendor review, since nothing of the sort is published
- Non-Python stacks: the SDK is Python-only and the REST API is the sole route for anything else
- Buyers bound by an effective SOC 2 requirement, as the certification is only described as in progress
- Teams that need written retention or non-training commitments, on which the site says nothing either way
How to use Octopoda
A typical end-to-end flow, from setup to results.
- Install the package with pip install octopoda, on Python 3.9 or later
- Start in local mode straight away: no account, memories in a local SQLite file, dashboard on localhost:7842
- Or go to the cloud: open a free account, collect a key and set the OCTOPODA_API_KEY environment variable
- Instantiate AgentRuntime with your agent's identifier
- Call remember, recall and recall_similar to store and retrieve context
- For a framework, follow its dedicated guide — LangChain, CrewAI, AutoGen, OpenAI or Anthropic
- For Claude Code, Cursor or Windsurf, install octopoda[mcp] and add the MCP configuration
- Track agents, loops and spending from the dashboard
- Move from local to cloud with a single environment variable, without changing a line of code
- Use the 'Setup with AI' guide if you would rather let a coding agent handle the installation
Pros & Cons
Pros
- MIT-licensed core, with a public PyPI package and a verifiable repository behind the marketing
- Local mode requires no account and keeps every memory on your own machine
- Substantial and dated documentation, with nine framework integration guides
- Loop detection and hard spend caps, rarely offered by competing memory layers
- Flat monthly pricing, readable in advance, with no per-call billing and no per-seat charge
- Permanently free tier with no credit card required
- A 28-tool MCP server usable straight from Claude Code, Cursor or Windsurf
Cons
- No company is identified anywhere — no legal name, no address, no country — and the domain is second-hand, registered for a single year
- No terms of service at all, for a service billed up to USD 99 per month
- GDPR requests land on a personal Gmail address, and no retention period, sub-processor list or DPA is published
- The security page describes another product, Synrix, and the leftover reaches the shipped software: the local store is ~/.synrix/data/synrix.db and the MCP server starts with synrix_runtime
- Security and architecture claims contradict each other from page to page, and plan quotas differ between the pricing page and llms.txt
- No position at all, either way, on training models with customer data
- Python-only SDK outside the REST API, and the home page's 'Live' dashboard figures are in fact a static mock-up
Pricing & Plans
There is a permanently free plan at USD 0.00 per month, advertised with No card required, ever. The cheapest paid entry point displayed is the Pro plan at USD 19.00 per month, ahead of Business at USD 49.00 and Scale at USD 99.00; the Enterprise tier is quoted on request. Billing is flat and monthly, with no per-seat charge and no usage-based surprise, and the subscription can be upgraded, downgraded or cancelled at any time. A Monthly/Yearly toggle announces a 20% saving on annual commitment, but no annual amount appears anywhere on the page.
- Free — USD 0/month — 5 agents
- 5
- 000 memories
- 2
- 000 AI extractions
- local SQLite or cloud sync
- community support
- Pro — USD 19/month — 25 agents
- 250
- 000 memories
- 10
- 000 AI extractions
- email support within one business day
- priority bug queue
- Business — USD 49/month — 75 agents
- 1
- 000
- 000 memories
- 50
- 000 AI extractions
- 4-hour priority support
- 30-minute onboarding call with the founders
- Scale — USD 99/month — unlimited agents
- 5
- 000
- 000 memories
- unlimited extractions
- dedicated Slack channel
- same-day response
- 99.9% SLA and quarterly review
- Enterprise — on request — everything unlimited
- VPC or on-premise deployment
- custom SLA
- SOC 2
- dedicated engineer
- Every feature is included in every tier
- the tiers differ only in capacity and level of support
- llms.txt publishes different quotas for these same tiers — fair-use memory
- 2
- 000 extractions on all plans
- requests-per-minute limits
- SSO/SAML and team members that the pricing page never mentions
Data, GDPR & hosting
A consolidated view of how Octopoda handles your data.
GDPR overview
The privacy policy claims compliance outright: Octopoda is fully GDPR compliant. You have the right to access, rectify, export, and delete your personal data at any time. Data processing is based on legitimate interest (providing the service you signed up for) and explicit consent where required. Access, rectification, export and deletion are named, and the last two are backed by real API endpoints. Everything that would substantiate the claim is missing: no retention period, no list of sub-processors, no data processing agreement, no Article 27 representative, no data protection officer. Requests are directed to a personal Gmail address rather than a company one. The policy is dated April 2025, eleven months before the domain was registered, and the site's own security page — written for a different product — asserts the opposite, that no data processor relationship exists.
Who owns the data?
In local mode, the default, the question barely arises: memories are written to a SQLite file in your home directory and never leave the machine. In cloud mode the privacy policy states that data sits in PostgreSQL with row-level security and per-tenant isolation, and that each account's data is cryptographically separated — no other user or Octopoda employee can access it. Beyond that sentence, nothing settles ownership. There are no terms of service, therefore no intellectual property clause, no licence granted to the operator and no contractual commitment behind the promise. The privacy policy is the only document the site publishes.
Reuse rights
The privacy policy is blunt about third parties: We do not sell, share, or provide your data to any third party. Period. The only external tool it declares is Google Analytics 4, presented as anonymised audience measurement that any blocker can stop. On your own side, everything can be retrieved through documented endpoints — a full export via GET /v1/auth/export and a permanent deletion via DELETE /v1/auth/account — and memories also export and import as portable JSON. You may reuse what you export as you see fit, without asking permission: no terms of service exist to restrict it, which is a freedom by default rather than a granted right. The site never states, in either direction, whether customer data is used to train models.
Data retention & training
Hosting summary
Where the data lives depends entirely on the mode you choose. In local mode, which is the default, everything stays on your own machine in a SQLite file, no account is required and the system works offline. In cloud mode, presented as Octopoda Cloud, memories go into PostgreSQL with row-level security and per-tenant isolation. Past that, the site publishes nothing: no hosting country, no region and no named infrastructure provider for the cloud tier. The website itself is served behind Cloudflare on an anycast address, which says nothing about where customer data is actually stored. Anyone with a data residency requirement therefore has no answer to check, and no sub-processor list against which to verify the promise that data is never shared with third parties.
Things to keep in mind
Risks and trade-offs to weigh before adopting Octopoda.
- The security page is not about this product. Its body is written for 'Synrix' and its 'Lattice' engine, seven times over, and the API key it shows is sk-synrix-{token} where the comparison page shows sk-octopoda-. Nothing on that page can be attributed to Octopoda, including the security guarantees a reader would most want to rely on.
- The leftover is not only editorial, it is in the shipped software: the local store is created at ~/.synrix/data/synrix.db and the MCP server is launched with python -m synrix_runtime.api.mcp_server. The rebrand is unfinished inside the product itself, which makes the published name and the installed one two different things.
- No legal entity appears anywhere — no company name, no postal address, no country, no registration number — and the complete sitemap proves that no legal notice and no about page exist. There are no terms of service either: the footer's 'Terms of Service' link points to the privacy policy, so a subscription billed up to USD 99 per month is sold without a contract to hold anyone to.
- Three different contact addresses appear depending on the page, all obfuscated: one at ryjoxtechnologies.com on the contact page, a personal Gmail address on the privacy policy and in several footers, and joe@octopodas.com in the support documentation. The address published for GDPR requests is the personal Gmail one.
- Claims contradict each other across the site. SOC 2 is announced as 'in progress' and as an Enterprise deliverable at the same time, and denied by the security page. The architecture is described both as 'no cloud, no third-party servers, no telemetry' and as a PostgreSQL cloud tier with Google Analytics 4. Plan quotas differ between the pricing page and llms.txt for the same tiers. And the privacy policy is dated April 2025, eleven months before the domain was registered.
- The evidence offered is thinner than it looks: the 'As seen on' banner links to the home pages of Product Hunt, BetaList and Hacker News rather than to any listing or thread, testimonials are reduced to a first name and an initial, and the home page dashboard figures — 1,371,169 operations, 24 active agents, USD 1,247 saved, 48,112 audit entries — are labelled 'Live' and 'streaming' while being a static mock-up. The domain is second-hand and registered for one year only, from March 2026 to March 2027.
- Nothing is published on retention, sub-processors, a data processing agreement or an Article 27 representative, and the site takes no position at all on training models with customer data. Giving an agent a permanent memory also means it keeps whatever you put into it: with no stated retention period and no deletion schedule, pruning, setting a time to live and actually reading the audit trail are entirely your discipline, not the service's promise.
Setup & Integrations
Technical difficulty
Low for a Python developer, out of reach without code. Installation is one pip command and two lines of code; the documentation announces about five minutes of setup and ninety seconds from install to a first memory. Python 3.9 or later is required. Local mode needs no account and no key, and moving to the cloud is a single environment variable. Each framework has its own self-contained guide, and a 'Setup with AI' page lets a coding agent perform the installation. There is no no-code interface: the intended audience is developers.
Deployment
Integrations
Behind Octopoda
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Octopoda.
Frequently asked questions
What counts as an agent?
What happens if I reach my memory limit?
Can I self-host Octopoda?
Which agent frameworks are supported?
Is my data used to train models?
Who publishes Octopoda?
Are there terms of service?
Is a DPA or a list of sub-processors available?
How do I contact support?
Is there a mobile application?
Should you pick Octopoda?
Octopoda is real software, and that has to be said first. The package is published and versioned on PyPI, the core sits on a public repository under an MIT licence with 327 stars, and the documentation runs to dozens of pages dated June 2026, covering nine named framework integrations, a REST API and a 28-tool MCP server. It answers a genuine problem: agents that forget their context between runs, and loops that quietly burn a budget. The API primitives are consistent across the comparison page, the documentation and the machine-readable summary, and the pricing is public and itemised.
What lags far behind the product is everything around it. No company is named anywhere, no address, no country, and the sitemap proves that no legal notice, no about page and no terms of service exist: a service sold at up to USD 99 per month has no contract behind it. GDPR requests go to a personal Gmail address. The privacy policy is dated eleven months before the domain was registered. The rebrand from an earlier product, Synrix, is unfinished right into the shipped code, and the security page still describes that other product from beginning to end. Claims contradict each other from page to page on SOC 2, on architecture and on plan quotas, and the domain itself is second-hand, registered for one year only.
The practical reading follows from that split. Run locally, on SQLite, with no account, the exposure is close to nil and the MIT licence protects you: this is the sensible way to try it. Paying for the cloud tier is a different decision, because it means entering a commercial relationship with a counterparty that cannot be identified, under a contract that does not exist.
- Choosing a selection results in a full page refresh.
- Opens in a new window.