Citadel runs on your own machine — the client starts it, so there is no endpoint to ping. 474 installs a week from pypi. Last commit 28 Sep 2026.
Encrypted-first embedded database with vector search and agent memory, exposed as MCP tools
What the code does
We read the source, 3 d ago · rules 995398eba69f
A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.
fs::read_to_string(&path).map_err(|e| ToolError::Failed {
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
A tool parameter here reaches a dangerous call
That is not a flaw by itself — but it is where things go wrong when it is not the job. We re-read this code on every release. Watch it and you hear from us the day another one appears.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add mcp -e 'CITADEL_KEY=<CITADEL_KEY>' -- uvx citadeldb-mcp{
"mcpServers": {
"mcp": {
"command": "uvx",
"args": [
"citadeldb-mcp"
],
"env": {
"CITADEL_KEY": "<CITADEL_KEY>"
}
}
}
}[mcp_servers.mcp]
command = "uvx"
args = ["citadeldb-mcp"]
env = { CITADEL_KEY = "<CITADEL_KEY>" }{
"mcpServers": {
"mcp": {
"command": "uvx",
"args": [
"citadeldb-mcp"
],
"env": {
"CITADEL_KEY": "<CITADEL_KEY>"
}
}
}
}{
"servers": {
"mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"citadeldb-mcp"
],
"env": {
"CITADEL_KEY": "<CITADEL_KEY>"
}
}
}
}Put your own value in place of
<CITADEL_KEY> (Passphrase used to unlock the encrypted Citadel database).
The author’s registry entry marks it as required.
Alternatives to Citadel
same job, measured the same wayEmbedded memory for AI agents with SQLite, pgvector, and Neo4j graph search.
Exposes the full Qdrant vector database API as 56 MCP tools, not just store/find.
Local-first graph memory for AI assistants with SQLite, semantic search, and MCP tools.
Persistent memory for AI coding agents. Local-first SQLite + vector search. 17 MCP tools.
Local FAISS vector database for RAG with document ingestion, semantic search, and MCP prompts.
Local-first, auditable memory for MCP-compatible AI agents with explicit writes and SQLite storage.
MCP server for encrypted SQLite databases (SQLCipher 4) - Works with MoneyMoney, KeePass and more
Memory, reflection and safety for AI agents. Hosted or local, no vector database.
Citadel — questions
Answers built from our own checks of this server.