Enterprise-Grade Encrypted Memory for AI Agents

If your agent memory leaks, you're going to OpenShart yourself.

OpenShart is a zero-dependency encrypted memory framework for AI agents. It fragments, encrypts, and distributes agent context using Shamir's Secret Sharing, AES-256-GCM, and HMAC-based searchable encryption — with enterprise hierarchical access control, government classification levels, and ChainLock temporal sequence locks.

No single storage location holds a complete memory. No database breach reveals usable data. No admin can read agent context without the agent's key.

The name is intentional. The security is not a joke.

• 🔐 AES-256-GCM authenticated encryption with per-fragment derived keys
• 🧩 Shamir's Secret Sharing — K-of-N threshold reconstruction
• 🔍 Searchable encryption — HMAC-SHA256 tokens, zero content exposure during search
• 🏛️ Government classification — UNCLASSIFIED → CUI → CONFIDENTIAL → SECRET → TOP SECRET → TS/SCI
• ⛓️ ChainLock — temporal sequence locks with breach detection
• 🛡️ Bell-LaPadula MAC — mandatory access control (no read up, no write down)
• 🏢 Enterprise RBAC — role hierarchy, department isolation, delegated keys
• 📋 Tamper-evident audit — SHA-256 hash chain, compliance export
• 🗑️ GDPR Article 17 — DoD 5220.22-M 3-pass cryptographic erasure
• 🔑 FIPS-ready — approved algorithms, key entropy validation, self-tests
• 🏥 HIPAA PHI detection — Safe Harbor patterns, minimum necessary enforcement
• 📦 Zero runtime dependencies — Node.js crypto only

npm install openshart

import { OpenShart, MemoryBackend, Classification } from 'openshart';
import { randomBytes } from 'node:crypto';

const shart = await OpenShart.init({
  storage: new MemoryBackend(),
  encryptionKey: randomBytes(32),
  securityLevel: 'government',
});

// Store — PII auto-detected, fragmented, encrypted, ChainLock-secured
const { id } = await shart.store(
  "Patient John Doe, SSN 123-45-6789, diagnosed with hypertension",
  {
    classification: Classification.SECRET,
    compartments: ['MEDICAL'],
    tags: ['patient', 'diagnosis'],
  }
);

// Search — HMAC tokens only, content never decrypted
const results = await shart.search('patient diagnosis');

// Recall — ChainLock sequence enforced, access control verified
const memory = await shart.recall(id);
console.log(memory.content);

// Forget — DoD 5220.22-M 3-pass overwrite + cryptographic erasure
await shart.forget(id);

await shart.close();

ChainLock is OpenShart's novel security primitive. Fragments must be decrypted in a cryptographically random sequence, within strict time windows, with chain tokens linking each step.

Recall Request
     │
     ▼
┌──────────────────────────────┐
│  1. Generate session nonce    │
│  2. Decrypt sequence order    │
│  3. Start temporal clock      │
└──────────────┬───────────────┘
               │
     ┌─────────▼─────────┐
     │  Step 1 (≤2000ms)  │──→ chain_token_1
     └─────────┬─────────┘
               │
     ┌─────────▼─────────┐
     │  Step 2 (≤2000ms)  │──→ chain_token_2
     └─────────┬─────────┘
               │
     ┌─────────▼─────────┐
     │  Step N (≤2000ms)  │──→ chain_token_N
     └─────────┬─────────┘
               │
     ┌─────────▼─────────┐
     │  ✅ Reconstruct     │
     │  🔄 Rotate sequence │
     │  🧹 Wipe ephemeral  │
     └───────────────────┘

Why it matters:

• Stolen fragments are useless without the sequence, timing, and chain tokens
• Automated attacks detected via timing analysis (uniform step durations = bot)
• Replay attacks prevented — sequence rotates after every successful recall
• Breach lockdown — configurable failure threshold triggers lockdown

┌─────────────────────────────────────────────────────────────┐
│                     AGENT APPLICATION                        │
│           (OpenClaw, LangChain, CrewAI, custom)              │
└────────────────────────────┬────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│                      OPENSHART SDK                           │
│                                                              │
│  ┌─────────┐ ┌────────┐ ┌────────┐ ┌────────┐              │
│  │  STORE  │ │ SEARCH │ │ RECALL │ │ FORGET │              │
│  └────┬────┘ └───┬────┘ └───┬────┘ └───┬────┘              │
│       │          │          │          │                     │
│  ┌────▼──────────▼──────────▼──────────▼──────────────────┐ │
│  │  ACCESS CONTROL · BELL-LAPADULA · CLASSIFICATION       │ │
│  │  FIPS Crypto · Key Rotation · Need-to-Know             │ │
│  └──────────────────────────┬─────────────────────────────┘ │
│                             │                                │
│  ┌──────────────────────────▼─────────────────────────────┐ │
│  │          PII DETECTION + AUTO-CLASSIFICATION            │ │
│  └──────────────────────────┬─────────────────────────────┘ │
│                             │                                │
│  ┌──────────────────────────▼─────────────────────────────┐ │
│  │          FRAGMENT ENGINE (Shamir SSS) + CHAINLOCK       │ │
│  │       K-of-N shares → AES-256-GCM → Temporal Lock      │ │
│  └──────────────────────────┬─────────────────────────────┘ │
│                             │                                │
│  ┌──────────────┐ ┌────────▼──────┐ ┌──────────────────┐   │
│  │ SEARCH INDEX │ │  AUDIT LOG    │ │ KEY MANAGEMENT   │   │
│  │(HMAC-SHA256) │ │ (hash chain)  │ │(HSM · rotation)  │   │
│  └──────┬───────┘ └──────┬────────┘ └──────┬───────────┘   │
└─────────┼────────────────┼─────────────────┼────────────────┘
          ▼                ▼                 ▼
┌─────────────────────────────────────────────────────────────┐
│                    STORAGE BACKEND                           │
│  ┌──────────┐  ┌────────────┐  ┌──────────┐                │
│  │  SQLite  │  │ PostgreSQL │  │  Memory  │                │
│  └──────────┘  └────────────┘  └──────────┘                │
└─────────────────────────────────────────────────────────────┘

OpenShart supports the full US government classification hierarchy with cryptographic enforcement:

import { Classification, checkClassifiedAccess } from 'openshart';

// Classification levels:
// UNCLASSIFIED → CUI → CONFIDENTIAL → SECRET → TOP_SECRET → TS_SCI

// SCI Compartments: GAMMA, HCS, SI, TK
// Dissemination controls: NOFORN, ORCON, REL TO

// Bell-LaPadula enforced at the cryptographic level:
// - No Read Up: agents cannot read above their clearance
// - No Write Down: agents cannot write below their clearance

import { OpenShart, ContextFlowManager, DepartmentManager, Role } from 'openshart';

const departments = new DepartmentManager();
departments.registerDepartment({
  id: 'engineering',
  name: 'Engineering',
  encryptionNamespace: 'eng-ns-2026',
});

const flow = new ContextFlowManager(departments);

// Context flows DOWN with automatic PII redaction
const pushed = flow.pushDown(
  'Q3 target: $2M ARR. Contact jane@corp.com for details.',
  Role.EXECUTIVE,
  Role.CONTRIBUTOR,
);
// pushed.content: 'Q3 target: [FINANCIAL_REDACTED]. Contact [EMAIL_REDACTED] for details.'

import { KeyRotationManager, createEscrow, SecureBuffer } from 'openshart';

// Secure key wrapper — auto-zeros on destroy
const key = new SecureBuffer(masterKeyBuffer);

// Key escrow — Shamir split of master key for M-of-N recovery
const shares = createEscrow(masterKey, custodianKeys, {
  threshold: 3,
  totalShares: 5,
});

// Key rotation — re-encrypts all fragments
const rotator = new KeyRotationManager(storage);
await rotator.rotateAll(oldKey, newKey);

Q: Is the name a joke? A: Yes, the name is intentional. The security is not a joke. OpenShart implements AES-256-GCM, Shamir's Secret Sharing, Bell-LaPadula mandatory access control, FIPS-ready cryptography, and government classification with compartmentalization. The absurdity of the name is inversely proportional to the seriousness of the security.

Q: Can I use this in production? A: Yes. OpenShart is designed for production use in environments ranging from standard SaaS to classified government systems. SOC2, HIPAA, and GDPR compliant by design.

Q: Why not just use a normal database with encryption? A: Because a database breach exposes everything. OpenShart fragments data using Shamir's Secret Sharing — no single storage location holds a complete memory. Even with full database access, an attacker gets meaningless encrypted shards.

Q: Does it really support TS/SCI? A: The classification model, access control, and compartmentalization are architecturally complete. Formal certification (FedRAMP, Common Criteria) requires third-party assessment. The crypto is real. The access control is real. The name is... what it is.

Q: My CISO asked about the name. A: Tell them it stands for Open Secure Hierarchical Agent Recall & Tokenization. That's not true, but it works in a slide deck.

Q: What happens if there's a security breach? A: The attacker gets useless encrypted fragments and you get to say "good thing we used OpenShart" in the incident report.

Q: How do I explain this to my board of directors? A: "We've implemented enterprise-grade cryptographic memory fragmentation with temporal sequence locking." Then hope nobody Googles the npm package name.

Q: Can I put this on my resume? A: "Led implementation of OpenShart across the organization" is technically accurate and a great conversation starter.

Q: Our compliance team flagged the package name. A: Show them the Shamir's Secret Sharing implementation, the FIPS compliance mode, and the Bell-LaPadula access control. Then watch them slowly nod and pretend the name doesn't bother them.

Q: Is there an enterprise version with a different name? A: No. The security is the same whether you call it OpenShart or "Open Secure Hierarchical Agent Recall & Tokenization." We just prefer honesty.

Q: My PR adding OpenShart as a dependency was rejected. A: npm install openshart hits different in a code review. We recommend adding it on a Friday afternoon.

Q: I ran npm install openshart and my coworker saw my screen. A: You're welcome. That's a core memory now.

git clone https://github.com/bcharleson/openshart.git
cd openshart
npm install
npm test

Security vulnerabilities: Do not open a public issue. Email security@openshart.dev.

MIT — see LICENSE.

OpenShart — because agent memory should be as secure as the name is unfortunate.