Funes Vault

Funes Vault

Give AI agents your memory. Not all of it.
A free, open-source Mac menu bar app that keeps your personal context in a private vault on your Mac, and shares it with Claude, Cursor, Codex and other AI agents only as you allow. Its iPhone app captures thoughts anywhere and answers agents' requests from your pocket.

Download for Mac · iPhone app · Get started · Agent setups · Changelog

[Funes Vault's Home: a greeting, a box to type a memory with a microphone and a Remember button, and the vault's pulse for the last 30 days: this week's numbers in a sentence, bars of new memories by source above a line and memories shared with each agent below it, with red dots for refused requests. Under it, cards for the number of memories and their growth, the sensitivity of the vault next to what was shared, a grid of the memories you saved each day, as many weeks as fit, with today ringed, and the agents that read the vault most.]

• Each agent gets only what you choose. Its own key, and the access you set: read, suggest or save; up to a sensitivity level; in the categories you pick. A new agent can start with nothing.
• You approve the exact text. Before a memory goes to an agent, a small panel shows it, and you can untick what shouldn't go. An approval is used once, within 15 minutes, and is cancelled if anything changes.
• Agents suggest; you decide. What an agent wants to remember waits in your Inbox, where you edit it, apply it or reject it.
• Answer from your iPhone. When an agent asks while you're away from your Mac, your iPhone shows the request, and you share, save or deny it there. Capture a thought anywhere; it reaches your vault when your Mac does.
• Everything stays on your Mac. No account, no server of ours, no cloud copy. Search runs on a small model built into the app. The iPhone app keeps no copy either: it talks to your Mac, end to end encrypted. Cloud agents such as claude.ai and ChatGPT can reach it only through a tunnel you run, with Remote Access (experimental, off by default).

Status: public preview (0.5), with best-effort support. Funes Vault for iPhone (iOS 18 or later, free on the App Store) pairs with it. Works with Claude Code, Claude Desktop, Cursor and Codex, with ready-made setups for VS Code (Copilot), Gemini CLI, Zed, Cline, JetBrains AI Assistant, Devin Desktop and any other MCP client. From the cloud (experimental): claude.ai, ChatGPT, Gemini Enterprise, the Anthropic and OpenAI APIs, and cloud coding agents, through Remote Access.

Get started

1. Install. Download FunesVault.dmg, open it and drag Funes Vault to Applications. If you open it from the disk image or Downloads instead, it offers to move itself there. Or use Homebrew:

   sh

   brew install --cask bereciartua/tap/funes-vault

   Funes Vault needs macOS 15 or later, on Apple silicon or Intel.

2. Open the app. It lives in the menu bar: a click on its eye opens a panel with what waits for you, the Agents and Remote Access switches, a field to remember (⏎) or search (⌘⏎) and the last 24 hours; a right click has Open Funes Vault, Settings, Check for Updates and Quit. Its window opens on Home, with a short setup checklist:

   1. Connect an agent. Add… opens Add Agent, with the agents found on your Mac first. Pick one and a starting access: the default, Read low-sensitivity memories, ask first, lets it read memories up to Low and asks you before each share. For Claude Code, Claude Desktop, Cursor and Codex, Add and Connect… shows exactly what it will change or run first, backs up a settings file before changing it, and never writes the key into the agent's settings. For other agents, copy the setup from the agent's Connect tab.
   2. Approve its first request. Ask your agent something, for example "Plan a week of dinners for me" or "Set up this TypeScript project the way I like it." The agent asks Funes for context, you see the panel, and you choose what to share. The step is done when the agent's first request arrives.
   3. Seed your vault. Answer a few optional questions, import your ChatGPT memories or paste Claude's, or import a Markdown file. What you add goes to the Inbox first, and anything that looks like a secret is never imported. The questions end with the categories agents should never see: those get Deny for every agent, including ones you add later.
   4. Review your Inbox. Apply what's right; edit or reject the rest.

Search shows the part of each memory that matches, with your words in bold. With Search answers on (Settings ▸ AI ▸ Features, off by default), ⌘Return in the Vault's search, or Ask Funes, has the model you chose read the top results and answer in a few short claims, each quoting the memory it came from, with numbers that open that memory; claims it can't quote aren't shown. It can also answer on its own after a short pause, for searches that are questions or for every search. The iPhone has the same Ask Funes, answered by your Mac.

You can also capture a thought at any time with ⌥⌘M, File ▸ Remember… while a window is open, or Services ▸ Remember in Funes in any app, or type it on Home and press Return: it goes to the Inbox either way. ⌘Return on Home searches your vault for what you typed, and the microphone dictates, on your Mac (macOS 26 and later).

Home also shows your vault's pulse: what came in each day, from you, your iPhone, agents, imports or the tidy-up, and what went out to each agent, with refused requests marked. Hover a day for its numbers and click it to see that day in Activity. Below it: your memories and their growth, their sensitivity next to what was shared, your rhythm (a square for each day you saved memories, as many weeks as fit, today ringed), and who reads your vault. It shows counts only, never a memory's text.

Setups for every agent, the tool reference and troubleshooting are in the MCP guide.

On your iPhone

Get Funes Vault for iPhone, free on the App Store (iOS 18 or later). On the Mac, open Settings ▸ iPhone, turn on Allow iPhone access and click Pair iPhone…; on the iPhone, tap Pair with Mac and scan the code, then click Allow on the Mac. The two reach each other on the same Wi-Fi, through Tailscale, or through your Remote Access tunnel.

• Home has the box to remember something, typed or dictated, the agents' requests waiting for you, and your vault at a glance in tiles like its widgets: this week across the top, then Memories, Rhythm, Sensitivity and Who reads. Counts only, never a memory's text.
• Capture from Home, the share sheet, Shortcuts and Siri ("Remember in Funes"), a Control or the Remember widget. Captures wait on the iPhone until your Mac has them, even offline.
• Answer agents from a notification, with the same Share, Save and access panels as on the Mac. The notification names the agent and the count, never memory text. It reaches the iPhone through a record holding only a random name and a tag in your own iCloud (ADR-0019); the request itself comes from your Mac, end-to-end encrypted. This needs the same Apple Account on both.
• Search, edit and review the Inbox while your Mac is reachable. Search shows the sentence that matches, and Ask Funes has your Mac answer, with Search answers on. Every Inbox card can be answered on the iPhone, the tidy-up's included. The iPhone keeps no copy of your vault.
• Widgets for your pulse and rhythm, from the last counts your Mac sent, and one to remember something.

No Mac yet? Try Demo on Home shows every screen with sample data. The app's version is at the bottom of its Settings.

From cloud agents (experimental)

claude.ai, ChatGPT and cloud coding agents run on their vendor's servers, so they can't reach an app on your Mac directly. Remote Access lets them, through a tunnel you run, such as Tailscale Funnel:

1. Open Remote Access in the sidebar and follow its four steps: choose a tunnel, turn Remote Access on and start the tunnel, paste its address, test. Funes never starts a tunnel; it shows the command.
2. Add the agent on the Cloud · Experimental tab of Add Agent… (claude.ai, ChatGPT, …), or turn on Allow cloud access on an agent's Cloud tab.
3. Connect it: apps that sign in (claude.ai, ChatGPT, Gemini Enterprise) use Connect a Cloud App… and a six-digit code you compare on the Mac; the others use the agent's remote token. The agent's Cloud tab shows the steps for each.

A cloud agent gets exactly the access you set for it, and the same panels on your Mac: if you're away, its requests wait and expire as for any agent. While Remote Access is on, the vault is reachable through a public address, and what you share with a cloud agent goes to its vendor's servers. It's off by default, and the Remote Access switch in the menu bar panel turns it off at once, cutting every cloud agent off. The MCP guide has the details.

How you stay in control

Funes is the only thing that holds your memories. Agents talk to it, never to the vault directly, and it checks every request against what you allowed.

You choose what each agent may see

Every agent has its own access: whether it may Read, Suggest or Write; a maximum sensitivity (Public, Low, Internal, Sensitive, Restricted or Secret); the categories it may or may not use (a denied category always wins); whether Funes asks before sharing and asks before saving; and an optional expiry date. Health, Finance and Legal memories are Sensitive by default.

You approve the exact text

When an agent asks for context, Funes finds the memories that match its task and are allowed for that agent. If asking is on, a panel shows each one with a checkbox, what the agent says it's for, how long it keeps what it gets, and how many more matched but can't go to it. Share sends only what you ticked; Deny sends nothing. The agent waits up to 45 seconds. If you don't answer in time, the request waits in Pending requests for up to 15 minutes, and the agent picks up your answer later; More Time moves it there at once. Review Request (⌃⌥⌘R) brings a waiting panel forward from any app.

Nothing an agent writes in its task or purpose changes what it may see. Those words only help find relevant memories.

Agents suggest, you decide

Agents propose memories, and by default each one waits in the Inbox as a card you can edit before Apply (Replace or Keep Both for a correction), Reject or Later. Cards say who proposed what, quote the agent's reasons as reported, point out similar memories, and show a correction as old and new text. Your own captures and imports land there too. With Split into separate memories on (Settings ▸ AI ▸ Features ▸ New memories, with a local server or cloud model), what arrives is split into one suggestion per claim, each marked New, Updates a memory, Already saved or Removes a memory, on one card with Apply All and Keep as One. With the Daily tidy-up on (Settings ▸ AI ▸ Features, off by default), Funes also looks once a day for copies, out-of-date memories, memories to merge or split and contradictions, and proposes them in the Inbox's Tidy-up section; conflicts always ask you which is true. Tidy Up in a memory's detail (or the Vault's right-click menu) checks just that memory against up to 5 related ones, whenever a tidy-up model is chosen; what it finds waits in the Inbox, and it doesn't count as the day's run.

You see everything, and stop anything

Activity lists what each agent asked for and what happened, by day, with filters. Its log stores only ids and reason codes, never text: it shows the memories involved by their current title when you open a row, says what was withheld and why, and links to fix a refusal. Pause an agent to refuse its requests while keeping its setup, Remove… it to cut it off, or turn off the Agents switch in the menu bar panel to pause all agents for an hour, until tomorrow or until you resume. When a memory changes (your edit on the Mac or iPhone, an agent's write, a suggestion you apply, archiving or restoring), Funes keeps the version it replaced for 90 days, at most 50 a memory: a memory's History and Activity show the change as before → after. Earlier versions stay in the vault on your Mac (and so in its backups), never go to agents, exports or your iPhone, and can be forgotten (Forget Earlier Versions… in History) or turned off (Settings ▸ Data & Backups).

Under the hood

• Local by default. The MCP server listens on 127.0.0.1:47625, never on a network interface. No account, no analytics, no server of ours. Remote Access, off by default, opens a second loopback port only a tunnel you run can expose. iPhone access, off by default, opens port 47626 to the iPhones you paired, and every message on it is signed and end-to-end encrypted.
• A key per agent. Each agent has its own 256-bit key in a private file; the vault stores only its hash. One-click setups and the launcher read the file instead of putting the key in the agent's config.
• Fail closed. Any doubt about an agent or a request is a refusal. Refusals tell the agent how many memories were withheld and why, never which ones.
• Single use. An approved share is delivered once, within 15 minutes, and only if the memories and the agent's access are unchanged.
• Secrets stay out. A secret scanner checks captures (on the iPhone too), suggestions and imports, and everything sent to a model you chose.
• Signed updates. Updates come from GitHub, signed for Funes Vault and checked before they install. Installing always takes a click.
• Open source. Read the code, the architecture and the test record.

What it doesn't protect against: another program running as your macOS user can read the same vault and key files. Access settings separate the agents you connect; they aren't a defense against malware already on your Mac. Details are in Security boundary.

What agents can do

Agents see four main tools, and only the ones their access allows:

A fifth, open_in_funes, only brings Funes to the front at one of the agent's own pending requests or suggestions. The MCP guide has every argument and outcome.

FAQ

Something else? Open an issue.

Security boundary

• MCP server. Runs while Settings ▸ Agent Server ▸ Let agents connect is on (the default), and listens only on 127.0.0.1 (port 47625 unless you change it in the same pane). Every request needs an agent's own key; the vault stores only its SHA-256 hash. Requests with a foreign Host, any Origin (web pages) or tunnel forwarding headers are refused, and repeated failed sign-ins are locked out for a minute. Paused and expired agents are refused; removed agents' keys no longer work.
• Agent keys. Each key is a file only you can read (mode 0600, in a 0700 folder) under ~/Library/Application Support/FunesVault/agent-keys/. The funes-mcp launcher sends it only after checking that the program on the port is your own Funes Vault. Rotate Key… replaces it at once.
• Access decisions. Made inside Funes from the agent's access, each memory's sensitivity and categories, and your answer, never from what the agent writes. An approval is bound to the exact memories and versions you saw.
• Data at rest. The vault is an SQLite file in your Application Support folder, protected by FileVault, not by its own encryption. Backups stay in the same folder.
• Models. Text goes to a model provider only if you added one and chose it, never above your cloud limit for a cloud provider, and never when it looks like a secret.
• iPhone access (off by default). While it's on, a third listener, on port 47626, answers only the iPhones you paired by scanning a QR code and clicking Allow on the Mac: from your local network (Same Wi-Fi), your tailnet (Tailscale), or 127.0.0.1 behind a tunnel you run. Every call is signed by a key in the iPhone's Secure Enclave and sealed to the Mac's key, so the network, Tailscale or a tunnel can't read or forge it; replays and stale messages are refused. A paired iPhone acts as you. Remove… cuts one off at once. To wake the iPhone for an approval, the Mac saves a record holding only a random name and a tag in your private iCloud database; the iPhone then fetches the request from the Mac.
• Remote Access (experimental, off by default). While it's on, a second listener on 127.0.0.1 (port 47627 unless you change it on the Remote Access page) answers what a tunnel you run forwards from the internet. Every route sits under a 128-bit secret path (anything else is 404), Host must be your tunnel's address (or the loopback address, for tunnels that rewrite it), and every call needs a credential of an agent you allowed cloud access: its remote token, or an OAuth token from a cloud app you approved with a six-digit code while pairing was open for that agent. Local keys don't work remotely and remote credentials don't work locally. Repeated failed sign-ins from one address are locked out for 5 minutes, and remote calls have a stricter rate limit. The same access, panels and pending list apply as for agents on your Mac. Text you share with a cloud agent goes to its vendor; some tunnels (Cloudflare, ngrok) can read the traffic, while Tailscale Funnel ends TLS on your Mac.

These controls do not isolate another process running as the same macOS user. Such a process can read the vault, the backups and the key files. Funes also can't recall or control text after you've shared it with an agent. An access setting is a boundary between the agents you connect, not a defense against a compromised user account. See the threat model.

Report vulnerabilities privately, as described in SECURITY.md.

Privacy

The app has no analytics, telemetry or crash reporting, and no account. Your memories, agents, keys and Activity stay on your Mac. These are the connections it makes:

Notifications, shown by macOS, never include memory text. What an agent receives through Funes goes to that agent and its AI provider, under their privacy terms, so give each agent only what it needs. With Remote Access, that includes the cloud agents you allow, and the tunnel provider if its TLS ends at its edge. The full statement is in PRIVACY.md and at funesvault.com/privacy.

Docs

Building from source

You need Xcode 27 (which runs on macOS 26.6 or later) with the iOS platform installed, and Python 3.11 (to convert the embedding model once). The app you build runs on macOS 15 or later.

sh scripts/fetch_embedding_model.shsh scripts/test.sh

The first command downloads the bundled embedding model (bge-small-en-v1.5) at a pinned revision, checks its checksums and converts it to Core ML in ~/Library/Caches/com.funesvault.dev/; it isn't in git. The second runs the package tests, the MCP harness and the other checks, and builds the Mac and iPhone apps unsigned. To work on the app, open FunesVault.xcodeproj in Xcode and run the FunesMac scheme. Debug builds honour FUNES_DATA_DIR, so a development vault never touches your real one. See Contributing.

Uninstall

1. If you used Remote Access, turn your tunnel off: the Remote Access page shows how.
2. Quit Funes Vault from its menu.
3. Remove Funes from your agents' configs (for example claude mcp remove --scope user funes).
4. Delete the app from Applications, and its data: ~/Library/Application Support/FunesVault (the vault, backups, agent keys and Activity). Its settings are in ~/Library/Preferences/com.funesvault.mac.plist. If you linked the launcher, delete ~/.local/bin/funes-mcp. API keys for model providers you added are in the Keychain under com.funesvault.provider, and the Mac's iPhone pairing keys under com.funesvault.companion. If you paired an iPhone, delete Funes Vault there too, or tap Unpair This iPhone… first.

To start over without uninstalling, Settings ▸ Data & Backups ▸ Erase All Data… deletes every memory, suggestion, agent and key, paired iPhone, Activity, backups, provider keys and settings, then relaunches empty. The Mac's iPhone pairing keys stay in the Keychain, so pair your iPhone again afterwards.

Installed with Homebrew, brew uninstall --cask funes-vault removes the app; brew uninstall --zap --cask funes-vault also moves the data folder, caches and preferences to the Trash (provider API keys stay in the Keychain).

License

Funes Vault is licensed under the Apache License 2.0; see NOTICE. The app bundles BridgeKit (Apache License 2.0, by the same author), and GRDB.swift, Sparkle and the bge-small-en-v1.5 model by BAAI, each under the MIT License; their licence texts ship in the app. The license doesn't grant rights to the project's name or icon. Apple, Mac and macOS are trademarks of Apple Inc. This project is not affiliated with or endorsed by Apple, Anthropic, OpenAI or BAAI.

Funes Vault is made by Martin Bereciartua, who also makes EK Bridge.