AI Agent Security·openshart.dev

Your AI Agents Have a Memory Problem

Every agent you deploy remembers everything. In plain text.That's not a feature — it's a liability.

OpenShart is an open-source encrypted memory framework for AI agents. Shamir's Secret Sharing + AES-256-GCM + zero dependencies. Built because nothing like it existed.

npm install openshart
Read the Case

Agent Memory Is the New Attack Surface

Every LangChain memory store, every CrewAI conversation, every OpenClaw task result — your AI remembers everything your team tells it. Right now, that memory sits in a database with the same security as a spreadsheet.

The Healthcare Clinic

Your scheduling AI remembers patient names, conditions, insurance details, and prescription history. Every conversation stored in plain text memory. One exposed endpoint and you have a HIPAA violation that could shut down the practice.

HIPAA violation — $50K to $1.5M per incident

The Financial Advisor

A portfolio management agent recalls account numbers, risk tolerance, investment positions, and estate plans. Your agent's memory is a complete map of every client's financial life — sitting in a database with the same security as a to-do list.

FINRA violation — firm suspension + client lawsuits

The HR Department

An HR automation agent processes salary data, performance reviews, disciplinary actions, and termination discussions. All of it accessible to anyone with database credentials — including every other agent running on the same infrastructure.

Employee litigation + regulatory penalties

The Sales Team

A competitive intelligence agent collects pricing strategies, deal terms, prospect objections, and acquisition targets. A competitor gains access to your agent's memory store and has your entire strategic playbook in one query.

Competitive intelligence leak — unquantifiable damage

These aren't hypothetical. These are the exact types of agents being deployed today — in healthcare, finance, HR, and sales — with memory layers that have no encryption, no access control, and no audit trail. The agents are sophisticated. The memory security is not.

Why I Built This

I didn't set out to build a security framework.

I was building AI agents for clients through OpenClaw — sales agents, research agents, admin agents — the kind that handle real business data every day. Client financials. Customer records. Competitive intelligence. The agents worked great. The problem was what happened to the data after the agent used it.

Every agent framework stores memory the same way: plain text in a database. Some use SQLite. Some use Postgres. Some use Redis. But the pattern is always the same — the agent's complete memory is a single query away from anyone with database access. One leaked credential, one misconfigured endpoint, and every conversation, every task result, every piece of sensitive data your agent has ever processed is exposed.

I looked for a solution. I expected to find one. I found encrypted databases (SQLCipher, pgcrypto) — but they encrypt at the table level, not the memory level. One breach still exposes everything. I found key management services (AWS KMS, HashiCorp Vault) — but they're designed for infrastructure secrets, not agent context. And none of them understood what PII was, let alone auto-detected it.

Nothing was purpose-built for the specific problem of AI agent memory. So I built it.

“The industry was building increasingly powerful agents on top of a memory layer that had no security model at all.”

— Brandon Charleson, creator of openshart.dev

Three Layers of Defense

Between your agent's memories and anyone who shouldn't have them. Drop-in for any framework — OpenClaw, CrewAI, LangChain, LlamaIndex, or custom.

01

Fragment

Shamir's Secret Sharing

Every memory is split into K-of-N fragments using polynomial interpolation over GF(2^8). No single fragment contains usable data. You choose the threshold — 3-of-5 for standard operations, 5-of-8 for classified environments.

K-of-N threshold reconstruction

02

Encrypt

AES-256-GCM

Each fragment gets its own encryption key derived via HKDF-SHA256. Authenticated encryption means tampering with any fragment is detected automatically. Cracking one fragment tells you nothing about the others.

Per-fragment derived keys via HKDF

03

Distribute

Storage Backends

Encrypted fragments are distributed across storage. No single location holds a complete memory. Even with full database access, an attacker gets meaningless noise — encrypted shards of incomplete data.

Memory, SQLite, or PostgreSQL

+

ChainLock Temporal Sequence Locks

At government+ security levels, fragments must be decrypted in a cryptographically random sequence, within strict time windows, with chain tokens linking each step. Stolen fragments are useless without the sequence. Automated extraction attempts are detected via timing analysis. The sequence rotates after every successful recall.

agent.ts
import { OpenShart, MemoryBackend, Classification } from 'openshart';
import { randomBytes } from 'node:crypto';

const shart = await OpenShart.init({
  storage: new MemoryBackend(),
  encryptionKey: randomBytes(32),
  securityLevel: 'government',
});

// Store — PII auto-detected, fragmented, encrypted
const { id } = await shart.store(
  "Patient John Doe, SSN 123-45-6789, diagnosed with hypertension",
  {
    classification: Classification.SECRET,
    compartments: ['MEDICAL'],
    tags: ['patient', 'diagnosis'],
  }
);

// Search — HMAC tokens only, content never decrypted
const results = await shart.search('patient diagnosis');

// Recall — ChainLock sequence enforced, access control verified
const memory = await shart.recall(id);

// Forget — DoD 5220.22-M 3-pass overwrite + cryptographic erasure
await shart.forget(id);

Pick Your Security Level

From SaaS startup to defense contractor. One line of config.

Standard

SaaS & Startups

Sales agents, customer support bots, marketing automation

  • ▸AES-256-GCM encryption
  • ▸Shamir fragmentation (3-of-5)
  • ▸PII auto-detection
  • ▸SHA-256 hash-chained audit log
securityLevel: 'standard'

Enterprise

Regulated Industries

Healthcare AI, financial advisors, HR automation, legal tech

  • ▸Everything in Standard
  • ▸Role-based access control (RBAC)
  • ▸Department isolation with encryption namespaces
  • ▸Key rotation + SOC2-ready controls
securityLevel: 'enterprise'

Government

High-Security Environments

Defense contractors, intelligence analysis, classified operations

  • ▸Everything in Enterprise
  • ▸ChainLock temporal sequence locks
  • ▸FIPS 140-2 algorithm enforcement
  • ▸Bell-LaPadula model + classification labels
securityLevel: 'government'

There's also a classified level for TS/SCI compartments with 5-of-8 fragmentation, two-person integrity, and air-gap architecture. See the full docs.

What Exists Today vs. What's Needed

Existing solutions weren't built for AI agent memory. They're general-purpose security tools being retrofitted into a problem they weren't designed to solve.

FeatureEncrypted DBsVaultsCloud KMSopenshart.dev
Purpose-built for AI agentsNoNoNoYes
Fragment-based (Shamir SSS)NoNoNoYes
Search without decryptingNoNoNoYes (HMAC)
Automatic PII detectionNoNoNoYes
Works with LangChain/CrewAIManualManualManualNative
Temporal sequence locksNoNoNoChainLock
Classification levelsNoPoliciesIAMBell-LaPadula
Self-hosted / air-gappedYesYesNoYes
Runtime dependenciesVariesManySDKZero
CostVaries$$$Pay-per-useFree (MIT)

Each technique OpenShart uses (Shamir's SSS, AES-256-GCM, HMAC-based searchable encryption) is well-established individually. The novelty is composing them into an agent-native memory layer with automatic PII classification that adjusts fragmentation based on content sensitivity.

Why Open Source

AI agents are being deployed faster than the security tooling to protect them. This needs to be a shared solution, not a proprietary moat.

Security Through Transparency

Closed-source security is security theater. If you can't read the code that protects your data, you can't trust it. Every line of OpenShart is auditable.

MIT Licensed

No vendor lock-in. No usage restrictions. Use it, fork it, modify it, ship it in your product. The license is as permissive as the security is strict.

Community-Driven

69 tests across 8 suites. CI running on Node 20 and 22. Contributions welcome — from bug reports to protocol improvements to new storage backends.

Zero Dependencies

Node.js built-in crypto only. No supply chain risk. No transitive dependency vulnerabilities. No bloat. The attack surface is the Node.js runtime itself — nothing more.

Getting Started

One install. Five lines to fortress.

npm install openshart
minimal.ts
import { OpenShart, MemoryBackend } from 'openshart';
import { randomBytes } from 'node:crypto';

const shart = await OpenShart.init({
  storage: new MemoryBackend(),
  encryptionKey: randomBytes(32),
  securityLevel: 'enterprise',
});

// Store, search, recall, forget — that's the entire API
await shart.store("Sensitive business data here", { tags: ['client'] });
const results = await shart.search('business data');

GitHub

Source code & issues

npm

Package registry

Documentation

openshart.dev

We deploy secure agents

Need encrypted agent memory in your deployment?

We build production AI agent systems with openshart.dev baked in — from HIPAA-compliant healthcare agents to SOC2-ready enterprise deployments.

If you'd rather have a team that's already built this handle the security layer, we're happy to talk.

orView Our Services

No commitment — 15 minutes to see if we're a fit

Back to Resources