Your team's AI forgets between sessions. MemBrain gives it one safe, shared brain.
Your team's AI forgets everything between sessions — and leaks context across tools. MemBrain is a drop-in, self-hosted proxy that gives your whole team one safe, shared brain across every AI provider: relevant knowledge injected when it matches, PII-rescanned and access-controlled, so nothing touches anyone's SaaS. MemBrain now remembers how you worked: every exchange and tool call becomes a private, PII-sanitized episode, and a daily reflection pass proposes at most eight cited lessons for your review.
The Seven Pillars
Shared memory first — safe by default
Memory injects your team's institutional knowledge into the next prompt when it's relevant. Detection rescans it for PII on the way in; Trust keeps every brain tenant-isolated; Coverage extends the same pipeline to shadow AI and MCP traffic. One pipeline, one audit trail, self-hosted.
Memory
Every exchange and tool call is captured as an owner-private, PII-sanitized episode; a daily reflection pass distills at most eight cited lessons into the review queue — new entries land pending and private. Once you approve and share one, your team sees it injected as context when it's relevant — with attribution, PII-rescanned on injection — before it reaches the model. Rather than auto-indexing everything, MemBrain separates episodic memory (owner-private, 90-day retention) from semantic knowledge; only cited, human-approved lessons cross that line. A weekly decay pass flags at most five unused entries for human-confirmed forgetting — nothing is deleted autonomously.
Detection
25+ PII patterns fire on every proxied request, before caching, before logging, before the LLM sees anything — and fail closed under scanner errors. ML NER (Enterprise) layers on where enabled. Cache keys and audit logs are scrubbed of detected PII before write.
Enforcement
Six policy modes — pass, log, alert, redact, block, confirm — with tool-policy fnmatch globs and human-in-the-loop approval for destructive actions. Deliberate, rule-based decisions about what the model is allowed to do.
Routing
Multi-provider across Anthropic, OpenAI, Claude CLI, Ollama and 100+ LiteLLM models, with tier / cost / privacy-based routing, fallback chains, and exact + semantic response cache. The right request to the right model.
Visibility
An audit log with SHA-256 hash chain, encrypted PII mapping, GDPR export and right-to-erasure, an alert engine (webhook + Slack), and a Prometheus /metrics endpoint. An executions timeline reconstructs each session's tool calls step by step, with a non-executable replay export for inspection and audit, and a weekly growth card shows what the shared brain learned, strengthened, and was proposed to forget.
Trust
Multi-tenant isolation across cache, MCP registry, audit, and knowledge, plus RBAC, OIDC SSO + SCIM (Enterprise), peppered API-key hashing, and atomic key rotation. The shared brain stays each team's own. More →
NEW · Multi-Actor Coordination · Team tier
Built for human teams and agent fleets
When multiple actors work in the same project — across timezones, across an agent fleet, or both — MemBrain coordinates them. Every chat already flows through; the substrate already knows who's doing what.
See what teammates already asked
When you start a chat, MemBrain shows related Q&A from your team in a side card. You decide what to use — nothing is added to the prompt without a click. Detected PII gets redacted to canonical labels before it crosses actors.
A shared inbox for humans and agents
Agents escalate decisions to a person, hand off long-running work, or flag duplicates — and pick up tasks meant for them without stepping on each other. One Python SDK call to enqueue, claim, or complete.
Pinned threads
Mark a conversation as available for continuation by a teammate or your future self. Auto-surfaced matches redact detected PII; pinning is the path that shares the conversation as-is — the originator opts in by pinning.
Task coordination + handoff
Declare what files you're touching at checkout. Get a warning if your diff overlaps another in-flight task. On checkin, MemBrain pulls the transcript, writes a structured summary, and leaves it for the next agent to read before starting related work.
Review ceremony
A dashboard review ceremony turns each member's approved private lessons into a meeting agenda with batch share, keep, or archive — the share gate as a team ritual, not a firehose. Actions are owner-only, and everything shared carries attribution.
Audit, REST, SDK, and dashboard for all four surfaces — explore the docs →
See It In Action
A dashboard for your team's shared brain
Real-time visibility into the memory, PII detection, and every AI interaction across your team.
Multi-Layer Architecture
Cognition at every level
One brain per scope — personal, team, organization — each a deployment pattern you run today. Configure shared memory, policy, and PII detection at the scope that fits: an org-wide baseline, team defaults, or personal additions on top.
Personal brain
Run a MemBrain on your own machine as your personal deployment. Detected PII gets redacted at your edge before anything you choose to share leaves it. Add your own memory and policies alongside your team's defaults.
Team brain
Sales, Engineering, Legal — each team gets its own scoped brain with shared memory, specialized policies, and scoped knowledge. Teams collaborate independently; the org sees the trail.
Organization brain
Deploy MemBrain at the org edge and configure PII detection, policy, and budgets as your organization's baseline. Each team or personal deployment layers its own config on top — designed to keep detected PII from reaching external models, subject to your configured patterns and NER model.
Why MemBrain
How MemBrain compares
Routing and PII redaction are table-stakes — several gateways do them well. Of the gateways compared here, shared, governed, self-hosted memory is what MemBrain adds.
| Open Source, Self-Hosted | PII Detection / Redaction | Multi-Provider Routing | Shared Governed Memory | Shadow-AI & MCP Coverage | |
|---|---|---|---|---|---|
| MemBrain | ✓ Apache 2.0 | ✓ 25+ patterns (+ ML NER, Enterprise) | ✓ Anthropic, OpenAI, Claude CLI, Ollama, 100+ via LiteLLM | ✓ Human-approved, owner-shared, attributed — PII-rescanned, tenant-isolated | ✓ Transparent proxy + MCP |
| LiteLLM | ✓ Yes | ✓ Presidio | ✓ 100+ models | — | — |
| Cloudflare | — SaaS only | ✓ DLP | ✓ AI Gateway | — | — Edge only |
| Portkey | ✓ Apache 2.0 | ✓ Guardrails | ✓ 250+ models | — | — Partial (MCP) |
| Kong | — OSS core + enterprise | ✓ Via plugins | ✓ Via plugins | — | — |
Comparison based on publicly documented capabilities as of June 2026 — verify current offerings. MemBrain is pre-1.0 (0.10.1) and holds no compliance certifications yet; several listed competitors publish SOC 2 / ISO 27001 attestations — check each vendor's current trust page. Competitor offerings change frequently.
How It Works
Deploy in minutes, not months
Whether you're one developer or an entire organization, MemBrain drops in without code changes.
Personal
Install and run
docker compose up — your personal MemBrain is running in under 60 seconds.
Point your API calls at localhost
Set OPENAI_BASE_URL=http://localhost:8001/v1. Memory, PII detection, and policy enforcement apply to every request routed through the gateway.
Your data stays yours
Detected PII gets redacted at your edge before it reaches a shared brain or an external model. You choose what to share.
Organization
Deploy at the org edge
Docker Compose, Kubernetes, or network proxy mode — fits your existing infrastructure.
Route all AI traffic through MemBrain
Org-wide PII detection, policies, and budgets enforced across configured teams.
Spin up team brains, enforce, audit
Give Sales, Engineering, and Legal their own brains. Import team memory, review audit logs, export compliance reports. Full visibility across every AI interaction.
Pricing
Start free, scale as you grow
Self-hosted and open core. Pay only for enterprise features.
Community
- Personal + team shared memory (team sharing requires per-person API keys)
- Multi-provider routing (OpenAI, Anthropic, Claude CLI, Ollama)
- PII detection & redaction (25+ patterns)
- Real-time dashboard
- Rate limits & budgets
- Tool policy enforcement (fnmatch globs)
- Response caching
- Semantic search with episodic capture — at most eight cited daily lessons into a 2-minute review
- Full audit trail (HMAC-SHA256 hash chain)
- Prometheus metrics
Team
- Everything in Community
- Team queue & multi-agent coordination
- MCP governance & policy
- Alerting & webhooks
- Compliance reports (GDPR, PII summary)
- Up to 10 seats
- Email support
Enterprise
- Everything in Team
- SSO (OIDC) & SCIM provisioning · SAML coming soon
- ML NER PII detection (BERT)
- SIEM export (Splunk, Datadog)
- Vault integration
- Unlimited seats
- Dedicated support & SLA
Add-ons
À la carte modules for teams that want a single Enterprise feature without the full tier.
- Shadow AI detection
- Custom PII patterns
- Advanced model routing
- Dedicated deployment review
FAQ
Common questions
Everything you need to know about getting started.
Both are real open-source gateways that route to models and redact PII — Portkey's full gateway is Apache-2.0 with 40+ guardrails, and LiteLLM masks PII with Presidio. They route and redact; of the gateways compared here, shared, governed, self-hosted memory is what MemBrain adds. MemBrain injects your team's approved, owner-shared, attributed knowledge when it's relevant — PII-rescanned, tenant-isolated — all under one audit chain.
No. MemBrain works as a drop-in proxy. Point your existing OpenAI or Anthropic SDK at the MemBrain gateway URL. For org-wide protection, deploy at the network level with a DNS override — no code changes, no agent installs, covering AI tools routed through your network.
OpenAI, Anthropic, Claude CLI, and Ollama are supported natively. With the optional LiteLLM integration, you get access to 100+ models including Azure OpenAI, Google Gemini, AWS Bedrock, and more.
An LLM forgets everything between sessions, and each teammate's context lives in a different tool. MemBrain gives your whole team one shared brain: a governed memory layer (Memory) that injects institutional knowledge when it's relevant — approved and owner-shared, with attribution — rescanned for PII on the way in (Detection) and kept tenant-isolated (Trust). The logo is a brain because the memory is the point — self-hosted, so it stays yours.
Yes. The Community tier is free forever and includes the core proxy, PII detection, dashboard, rate limits, budgets, caching, and full audit trail. Enterprise features require a license.
The community core is open source under Apache 2.0 and free to self-host. Paid tiers add enterprise features — SSO/SCIM, team queue, and advanced detection. No waitlist, no trial clock.
From the Blog
Notes on operating LLMs safely
Pending by Default: Governing What Your AI Remembers
An Enforceable Framework for Operating LLMs Safely
Shadow AI: The Blind Spot Application Gateways Miss
Give your team one safe, shared brain
Open source under Apache 2.0. Self-host it in minutes.
Get started View Documentation