
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
jasper-recall
Advanced tools
Local RAG system for AI agent memory using ChromaDB and sentence-transformers
Local RAG (Retrieval-Augmented Generation) system for AI agent memory. Gives your agent the ability to remember and search past conversations using ChromaDB and sentence-transformers.
[public] or [private] to control visibility--public-only flag for sandboxed agentsagent_sonnet, agent_qwen, etc.)recall-mesh "query" --mesh sonnet,qwen,opusnpx jasper-recall serve for Docker-isolated agents# One-command setup
npx jasper-recall setup
# Search your memory
recall "what did we decide about the API"
# Index your files
index-digests
# Process new session logs
digest-sessions
# Index memory for specific agents
index-digests-mesh --agent sonnet
index-digests-mesh --agent qwen
# Query as specific agent
recall-mesh "query" --agent sonnet
# Query across multiple agents (mesh mode)
recall-mesh "query" --mesh sonnet,qwen,opus
See Multi-Agent Mesh Documentation for details.
By default, indexes markdown files from ~/.openclaw/workspace/memory/:
*.md)session-digests/*.md)repos/*.md)sops/*.md)┌────────────────┐ ┌──────────────┐ ┌───────────┐
│ Session Logs │────▶│ digest- │────▶│ Markdown │
│ (.jsonl) │ │ sessions │ │ Digests │
└────────────────┘ └──────────────┘ └─────┬─────┘
│
▼
┌────────────────┐ ┌──────────────┐ ┌───────────┐
│ Memory Files │────▶│ index- │────▶│ ChromaDB │
│ (*.md) │ │ digests │ │ Vectors │
└────────────────┘ └──────────────┘ └─────┬─────┘
│
▼
┌──────────────┐ ┌───────────┐
│ recall │◀────│ Query │
│ "query" │ │ │
└──────────────┘ └───────────┘
Search your indexed memory:
recall "query" # Basic search
recall "query" -n 10 # More results
recall "query" --json # JSON output
recall "query" -v # Show similarity scores
recall "query" --public-only # Only shared content (for sandboxed agents)
Index markdown files into ChromaDB:
index-digests # Index all files
Extract summaries from session logs:
digest-sessions # Process new sessions only
digest-sessions --all # Reprocess everything
digest-sessions --dry-run # Preview without writing
Scan content for sensitive data before sharing:
privacy-check "text to scan" # Check inline text
privacy-check --file notes.md # Check a file
Detects: emails, API keys, internal IPs, home paths, credentials.
Compress old memory entries to save tokens:
summarize-old # Summarize entries older than 30 days
summarize-old --days 14 # Summarize entries older than 14 days
summarize-old --dry-run # Preview what would be summarized
summarize-old --min-size 1000 # Only summarize files larger than 1000 chars
memory/archive/System health check and auto-repair:
npx jasper-recall doctor # Check system health (default)
npx jasper-recall doctor --fix # Auto-repair issues
npx jasper-recall doctor --dry-run # Verbose mode, show exact commands
Default mode (no flags):
--fix would do❌ ChromaDB not installed → run with --fix to installFix mode (--fix):
python3 -m venv ~/.openclaw/rag-envpip install chromadbpip install sentence-transformers🔧 Installed ChromaDB via pip❌ Node.js <18 — please upgrade manuallyDry-run mode (--dry-run):
--fix would runWould run: ~/.openclaw/rag-env/bin/pip install chromadbExtract [public] tagged entries to shared memory:
sync-shared # Sync recent entries
sync-shared --all # Reprocess all daily notes
sync-shared --dry-run # Preview without writing
For multi-agent setups where sandboxed agents need access to some (but not all) memory:
Tag daily note sections as public or private:
## 2026-02-05 [public] - Shipped new feature
Released v1.0, good reception from users.
## 2026-02-05 [private] - Personal notes
User mentioned travel plans next week.
[public] — Visible to all agents (synced to memory/shared/)[private] — Main agent only (default if untagged)mkdir -p ~/.openclaw/workspace/memory/sharedln -s ~/.openclaw/workspace/memory/shared ~/.openclaw/workspace-sandbox/shared--public-only flag in sandboxed agent's recall queries# Extract [public] entries to shared/
sync-shared
# Index everything (including shared/)
index-digests
# Sandboxed agent queries only public content
recall "product info" --public-only
For Docker-isolated agents that can't run the CLI directly, start an HTTP API server:
npx jasper-recall serve # Default: localhost:3458
npx jasper-recall serve --port 8080 # Custom port
npx jasper-recall serve --host 0.0.0.0 # Allow external access
GET /recall?q=search+query&limit=5
GET /health
# Query from Docker container
curl "http://host.docker.internal:3458/recall?q=product+info"
Response:
{
"ok": true,
"query": "product info",
"public_only": true,
"count": 3,
"results": [
{ "content": "...", "file": "memory/shared/product-updates.md", "score": 0.85 }
]
}
public_only=true is enforced by default — API callers only see public contentRECALL_ALLOW_PRIVATE=true127.0.0.1 (default) to prevent external accessSet environment variables to customize paths:
export RECALL_WORKSPACE=~/.openclaw/workspace
export RECALL_CHROMA_DB=~/.openclaw/chroma-db
export RECALL_SESSIONS_DIR=~/.openclaw/agents/main/sessions
export RECALL_VENV=~/.openclaw/rag-env
Jasper Recall includes an OpenClaw plugin with auto-recall — automatically inject relevant memories before every message is processed.
# Full setup including plugin
npx jasper-recall setup
Add to openclaw.json:
{
"plugins": {
"load": {
"paths": [
"/path/to/jasper-recall/extensions/jasper-recall"
]
},
"entries": {
"jasper-recall": {
"enabled": true,
"config": {
"autoRecall": true,
"minScore": 0.3,
"defaultLimit": 5
}
}
}
}
}
When autoRecall: true, the plugin hooks into before_agent_start and:
minScore (default 30% similarity)<relevant-memories> context<relevant-memories>
The following memories may be relevant to this conversation:
- [memory/2026-02-05.md] Worker orchestration decisions...
- [MEMORY.md] Git workflow: feature → develop → main...
</relevant-memories>
| Option | Default | Description |
|---|---|---|
autoRecall | false | Auto-inject memories before processing |
minScore | 0.3 | Minimum similarity (0-1) for auto-recall |
defaultLimit | 5 | Max results for tool/auto-recall |
publicOnly | false | Restrict to public memory (sandboxed) |
The plugin registers:
recall tool — semantic search from agent code/recall <query> — quick search from chat/index — re-index memory filesAdd to your agent's HEARTBEAT.md for automatic memory maintenance:
## Memory Maintenance
- [ ] New sessions? → `digest-sessions`
- [ ] Files updated? → `index-digests`
Or schedule via cron:
{
"schedule": { "kind": "cron", "expr": "0 */6 * * *" },
"payload": {
"kind": "agentTurn",
"message": "Run index-digests to update memory index"
},
"sessionTarget": "isolated"
}
sentence-transformers/all-MiniLM-L6-v2 (384 dimensions, ~80MB)MIT
FAQs
Local RAG system for AI agent memory using ChromaDB and sentence-transformers
The npm package jasper-recall receives a total of 44 weekly downloads. As such, jasper-recall popularity was classified as not popular.
We found that jasper-recall demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.