The custody promise
SEAL.
KEEP.
SHARE.
Your agent's memory — sealed on your machine, kept in storage you choose, shared on your terms.
Preserve your agent memories
01 / 03Sealed on-device
Encrypted before a byte leaves your machine. We don't have the keys. We never touch the plaintext.
Zero-knowledge architectureKept where you choose
Use your own bucket, personal Google Drive, or managed Sealkeep Cloud. Every destination receives only encrypted, verified archives.
User-controlled routingShared on your terms
Bundles, recipients, and live bridges. Share across machines, models, and teams.
Cross-model memoryYour last session cost
597,000 tokens a step
Ninety-seven percent of that was re-reading its own history. An AI coding session charges you for its whole transcript on every single request: ask a one-line question and you pay for all of it, run an agent loop and you pay for all of it once per command. Nothing tells you until the limit is gone at 2am, mid-deploy.
Sealkeep already holds your session files, so it can answer the question nothing else can. One command, local files only, no account needed.
$ sealkeep meter
Context cost, last 24h, across 36 sessions.
Read from local session files. Nothing left this machine.
tool where steps per step history total in signals
claude bot 457 597k 97% 272.8M BLOATED
claude sometest 368 474k 96% 174.3M BLOATED STALE
codex spala 581 162k 99% 94.2M BLOATED STALE POLLING
Total sent: 807.8M. The same work from fresh sessions
carrying a 3k-token pack: about 36.5M.
That is roughly 771.4M spent re-reading, 95% of everything you sent.
Real output from one machine, one morning. The meter reads local session files. No recovery phrase, no key, no network, nothing uploaded to produce a number.
Resuming an old session is
the expensive mistake
Pick up a months-old conversation to ask two questions and the entire transcript goes with every request. One real evening, two questions on a resumed session cost 41 million tokens, of which about 220,000 were the actual work. The weekly allowance was gone by 2am, mid-deploy, and nothing had said a word.
Sealkeep gives you the other option: leave the session, keep what it knows. One command prices the choice, writes a small pack of where the work got to, and hands you the command to start fresh.
$ sealkeep fork
The most expensive session you have open is the claude one in bot.
carrying on there 615k tokens per step, 97% of it re-read history
starting fresh 22k tokens per step, carrying a 392-token pack instead
you would save 593k tokens on every step from here on
The full session is sealed and searchable, so nothing is lost by leaving it.
Small enough to carry
Where the work got to, what was being asked for, which files were open. A few hundred tokens instead of a few hundred thousand, written where your next session can read it.
Not the transcriptThe rest is one question away
The pack tells your agent, in words, that the full history is searchable and to ask for the one detail it needs rather than have it pasted in. That is what makes leaving safe instead of lossy.
Search, not pasteIt refuses to lie to you
If the session is not sealed and indexed yet, Sealkeep says so and will not pretend walking away is safe. The promise only holds when the history can genuinely be recalled, so it verifies that first.
Checked, not assumedThree signals, each one true of a session
that ended somebody’s week
Each threshold is deliberately boring, and each one fired on a real machine the night two limits died two hours after they reset.
It never tells your session
the same thing twice
Sealkeep used to re-send the same preamble and the same list of preserved sessions after every prompt and every Bash, Edit and Write. Measured on one real session, 80% of everything it injected had already been given to that same conversation, and because a block added early is re-sent on every request that follows, the repetition cost 81.6 million tokens.
Recall runs exactly as before
Every boundary, still searching against what you just typed. Nothing was taken away, and your agent still knows where you left off the moment you open a project.
Same recallIt remembers what it already said
The framing is said once. A passage that arrived as a preserved session is not sent again as a search excerpt, because it is the same sentence in a different wrapper. Only genuinely new history reaches the prompt.
80% was repetitionOnce per conversation, not once ever
The record is per session. A new conversation is a new reader and gets told where the work is up to. SEALKEEP_RECALL_PUSH=0 narrows it further, to session start only.
Answered, not dodged
One command, reads local files only. It tells you which session to abandon and what that will save. The number is the pitch, and it belongs to you.
The order is the safety property
Nothing is reclaimed before it is verified. Nothing is verified before it is sealed.
$ sealkeep autopilot --reclaim ✓ vault created 7a126017… ✓ recovery phrase shown — 24 words · once · not stored ✓ hooks installed — claude, codex preserve + upload automatically · reclaim explicitly enabled $ sealkeep autopilot status sealed 412 · verified 412 · reclaimed 3.4 GB last cycle 40s ago · next in 5m
Catch
Your agent's session hook records that a transcript exists and where it lives. Nothing is read yet.
Seal
A worker encrypts the session with a key made on this machine and wrapped twice — once for your phrase and once per trusted device.
Verify
The sealed archive goes to your chosen storage, and Sealkeep reads it back. Byte count and checksum must match what was computed locally.
Reclaim
Only a verified, searchable, unchanged and idle session becomes eligible. When you enable reclaim, eligible sessions can have their full local bytes removed. Supported top-level (non-subagent) Codex sessions keep a tiny same-ID resume pointer; unsupported and subagent Codex sessions keep their full local original.
Autopilot preserves, indexes, and uploads on a loop. Reclaim joins that loop only after you explicitly enable it, and Sealkeep notifies you when disk is reclaimed or something needs a decision — never for routine sealing, which would only train you to ignore it.
Six months of reasoning,
still searchable
Find the session by what you said in it
Six weeks later you remember the bug, not the folder. The content index is sealed with the same machinery as your archives and synced beside them — so every machine of the vault searches your whole history, and your agents search it too, over MCP.
Archiving must never cost you a resume
For supported top-level (non-subagent) Codex rollouts, reclaim leaves a valid three-line transcript at the same native path and session ID. Unsupported and subagent Codex rollouts stay on disk. Resume from an eligible pointer starts immediately; Codex can search preserved memory through the local Sealkeep MCP, while full byte restoration stays an explicit choice.
Actually frees local space
Reclaim is off by default. When enabled, Sealkeep removes an unchanged local original only after its complete encrypted archive is verified remotely and covered by search.
The remote archive stays encrypted, verified and explicitly restorable.
Your bucket sees noise
Every path segment — project, date, session — is an HMAC under a key derived from your phrase. No project names, no dates, no session ids.
Watch a session live
Share an ongoing session on a channel; teammates follow it read-only. Every delta is sealed on your machine before it moves, and followers verify a hash chain before a byte lands in their mirror.
Restores on a machine that never saw it
Each archive carries its own envelope, so a restore needs your phrase and an account. Not the original laptop, not a config file, not an index you forgot to copy.
checked again after decryption
Your agents know the vault is there
One command registers a local MCP server with Claude Code and Codex, so the agent itself can search your sealed history and restore a session it needs.
What the control plane can and cannot see
It coordinates devices, quotas and upload permissions. Sealing happens before any of that, on your machine.
Lose your recovery kit and every device you registered, and your archives are unreadable. Support cannot get them back. That is not a gap in the product — it is the product.
Twenty-four words,
not a base64 string
Words survive bad handwriting, can be read aloud, and carry a checksum — so a misread word is caught and corrected rather than silently locking you out.
Type it back with sealkeep recovery verify to prove your copy works. Case and spacing do not matter; a wrong word is named with suggestions — Word 1 “acron” is not in the list. Did you mean acorn, arrow?
Whose bucket
Not the same product with a different quota. On free, archives go to a bucket you own under your own credentials — we never hold them and cannot count them.
Pick this if you have a cloud account and would rather hold your own data than trust anyone with it.
- Every personal-vault capability — sealing, verify, search, retention, MCP, restore
- Guided setup: console links, filled-in commands, a least-privilege policy
- Credentials go to your OS keychain, never a config file
- You paste each IAM step yourself
- No escrow — your recovery kit is the only copy of the key
Pick this if you bought “it just works” — and would rather not be the only backup of your own key.
- No provider to name. Quotas and uploads are brokered for you.
- A sealed copy of your key that survives losing the machine, openable only by your phrase
- Storage meter, archive list and device revocation in the account panel
- Your keys and your phrase still never leave your machine
Pick this if you keep your own bucket or Google Drive — and want the parts of an account that save a bad day.
- Sealed key escrow — a copy we cannot open, your phrase can
- Machines signed in: enroll a new laptop with one code, revoke a stolen one from the panel
- Drive or bucket stays yours — we still hold no bytes
Pick this if one project's memory belongs to several people — and to their agents.
- Project-scoped members: a colleague opens what the team sealed, nothing else
- Shared sessions require a managed project copy; managed storage is billed separately. Personal Drive and bucket routes stay private to their owner
- Live session bridges, relayed through our plane — ciphertext in, ciphertext out
- The round table: add and revoke members from the dashboard
Or skip storage entirely and keep everything local — Sealkeep still seals every archive, it just has nowhere to copy it.
Four steps either way
The phrase step is the one that matters.
Install
npm install -g sealkeep
Choose free, pick a provider
Three questions: provider, bucket, prefix.
sealkeep start
Write down the phrase
Twenty-four words, shown once, generated here and never sent anywhere.
Create the bucket, then run it
Sealkeep prints the console links, the commands, and a policy scoped to your prefix.
sealkeep storage setup sealkeep autopilot
Install
npm install -g sealkeep
Create an account
Below, or in the terminal. Nothing else to set up.
sealkeep start
Write down the phrase
Your keys are generated on your machine. We store a copy sealed with this phrase, which never reaches us.
Let it run
Your machine requests a signed URL and uploads directly. The bytes never pass through our servers.
sealkeep autopilot sealkeep cloud status
What ships now,
and what advances next
Production capabilities today, with dated milestones for the next assurance gates.
Independent-review preparation is active. Encryption format v2 uses published authenticated-encryption primitives and ships with deterministic vectors plus byte-by-byte tamper coverage. The public assurance roadmap tracks external cryptographic review as the next gate; no completed third-party audit is claimed today.
The ones that actually matter
What happens if I lose the 24 words?
Can Sealkeep delete my sessions by accident?
Will archiving break --resume?
codex resume <session-id> still opens immediately and can call sealkeep_search for relevant memory. Unsupported and subagent Codex sessions keep their full local original. Full restoration is deliberately explicit—use the recovery command shown in that pointer—so startup never waits on a multi-gigabyte download.Can you read my transcripts?
Do I need a cloud account?
Is the encryption audited?
Two commands.
Then nothing.
Install it, write down twenty-four words, and stop choosing between your disk and your history.