Latest release: v2026.9.2Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
The plugin stores persistent memory under the default ~/.openclaw memory path or a configured dbPath, can use configured storageOptions, and sends text or queries to the configured embedding provider; these are expected for vector memory but should be configured deliberately.
Install Mechanism
Installation is via the declared OpenClaw npm plugin package with runtime extension files and no package lifecycle scripts in package.json; optional LanceDB native dependencies are consistent with the database backend.
Instruction Scope
The plugin registers memory tools and conversation hooks; auto-recall is enabled by default but checks turn tool authority, while auto-capture is off by default and only runs when configured, outside incognito sessions, and after successful agent turns.
Persistence & Privilege
Persistent memory storage and deletion are central to the plugin. memory_store and memory_forget are declared side-effecting, deletion is scoped by agent and memory ID/query, and doctor migrations can assign or remove legacy memory rows as part of state repair.
Purpose & Capability
The README, package metadata, and plugin manifest all describe a LanceDB-backed memory plugin providing memory_store, memory_recall, memory_forget, auto-recall, auto-capture, and vector search; the runtime code implements those capabilities without unrelated behavior.
Scan Findings in Context
[skillspector-report-0] expected: SkillSpector reported no issues and was not applicable because the package declares no bundled skills; this was treated as advisory context, not as the basis for the verdict.
[static:side-effecting-memory-tools] expected: The manifest marks memory_store and memory_forget as side-effecting, and the code stores and deletes rows in the LanceDB memories table scoped by agentId.
[static:auto-memory-hooks] expected: The before_prompt_build and agent_end hooks implement disclosed auto-recall and opt-in auto-capture, with authority checks, incognito-session blocking for capture/store, capture size limits, and prompt-injection filtering.
[static:embedding-and-storage-credentials] expected: Sensitive embedding apiKey and storageOptions are exposed in configuration metadata and used for embedding provider calls and LanceDB connection options; no artifact evidence showed unrelated credential access or exfiltration.
Assessment
Install this only if you want OpenClaw to maintain persistent long-term memory. Review the embedding provider, apiKey/baseUrl, dbPath, storageOptions, autoCapture, and autoRecall settings because memory text and recall queries may be stored locally or sent to the configured embedding provider. Use incognito sessions or disable auto-capture when you do not want conversation details retained.dist/dist-CYiXWwwe.js:2810
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
@openclaw/memory-lancedb
Official LanceDB-backed long-term memory plugin for OpenClaw.
This plugin adds persistent memory tools backed by LanceDB, vector search, auto-recall, and auto-capture.
Install
openclaw plugins install @openclaw/memory-lancedb
Restart the Gateway after installing or updating the plugin.
What it provides
memory_storememory_recallmemory_forget- LanceDB vector storage and hybrid memory retrieval.
Configure
Use the memory plugin docs for embedding provider setup, storage paths, indexing, and recall behavior:
Package
- Plugin id:
memory-lancedb - Package:
@openclaw/memory-lancedb - Minimum OpenClaw host:
2026.4.10