Why Reliquary
Every AI tool, one vault
Claude, ChatGPT, Cursor, VS Code and any MCP client read the same context. Reliquary brings no assistant of its own, so switching tools loses nothing.
Built for agents and people together
Agents read, take notes and propose. People review, approve and talk it through in threads. Every change lands in one append-only log.
Secrets stay secret
No MCP tool, log line or error message returns a value. reliquary run puts it into one process and nowhere else.
Guarded by the database
Every permission is a Postgres row-level security rule with a test that tries to break it on every push. A prompt can't talk its way past it.
Source available
The code is public. Read it, run it, self-host it for free. Each release turns Apache 2.0 two years on, and the CLI is MIT.
Star it on GitHub2 starsYours to take with you
Export a whole vault as plain markdown any time, or delete it for good. No lock-in to us or to any AI vendor.
What your agent can't do
- Approve any change
- Change who approves what
- Add or remove people
- Reveal a secret's value
- Export or delete a vault
Enforced as row-level security in Postgres, not in a prompt. Each rule has a test that tries to break it, and they run on every push. How security works
The problem, and what Reliquary does about it
- Every person and every tool has its own AI memory, so three people get three versions of the project.
- One vault of approved context that every tool and every person reads, kept current by what agents propose and people approve.
- Agents write things nobody checked, and the next agent believes them.
- Agents propose. Nothing becomes canon until a person, or a quorum, approves it.
- API keys travel by Slack and email and sit in
.envfiles any agent can read. - Variables live in the vault.
reliquary runputs them into one process; no AI tool ever gets a value. - Every AI vendor wants to be the one place your context lives, and your team already uses three of them.
- Reliquary brings no assistant of its own and takes any MCP client. Use Claude today and something better tomorrow: the context, the approvals and the log stay, and an owner can export it all as plain markdown at any time.
Who it's for
Teams on several AI tools
Some people use Claude, some ChatGPT, some Cursor, and every CLAUDE.md and rules file drifts on its own. Give everyone the same reviewed context, scoped to what they need, and keep keys out of chat messages.
Agencies and consultancies
One vault per client: everyone on your team only sees what they're scoped to, approvals on anything that becomes fact, credentials used without being pasted, and one log to show the client.
Solo builders
Several AI tools and machines, one source of truth. Stop copying CLAUDE.md between tools and keeping .env files where any coding agent can read them. You approve your own agents' changes, or mark a folder open and let them write.
How it works
brief.md now says "Deploy to: eu-production", and the log records who approved it and when.
Changes requested: the proposal stays open, and the agent gets your note.
$ reliquary run --env development -- npm start DATABASE_URL (value hidden) 1 variable into 1 process. Shown to no one.
Connect any AI tool with one URL
Paste Reliquary's MCP (Model Context Protocol) URL into Claude, ChatGPT or Claude Code and sign in. Other MCP clients use a scoped, expiring token you can revoke.
Agents read and propose
Open folders take notes directly. Canon folders change only when a person approves, with a quorum if you want one. Every change is in an append-only log.
Run with secrets, never show them
reliquary run --env development -- npm startputs variables into one process. No AI tool is ever handed a value; only the process you start sees it.
The log, append-only. An example.
What it looks like
Pricing
Alpha test: free for everyone. Everyone is on Free while we build. The plan is paid vaults for teams that need more room, ways to support the project, and enough to keep the lights on. Nothing is billed today, you’ll hear from us well before anything is, and self-hosting stays free.
-
Free Now
Everyone, during the alpha
$0
- 5 vaults you own
- Up to 10 people in each vault
- 100 MB in each vault
- Unlimited agents and AI tools
-
Pro vault
One vault that needs more room
Coming
per vault, when billing starts
- Upgrade a single vault; the others stay as they are
- Up to 50 people
- 5 GB
Every plan: unlimited agents and AI tools, approvals and quorum, the agent ceiling enforced in the database, the activity log, and export. Storage counts every version of every file and your variables.
Questions
Is Reliquary an AI model or a chatbot?
No. Reliquary runs no chat or writing model (its search uses a small one, inside its own database provider, to match files by meaning), doesn't search your Drive or Slack, and is not a memory that writes itself. It holds context and credentials, and the AI tools you already use connect to it over MCP.
What will it cost after the alpha?
Free stays free during the alpha. The plan is paid vaults for teams that need more room, ways to support the project, and enough to keep the lights on. Nothing is billed today, you'll hear from us well before anything is, and self-hosting stays free.
Is it open source?
The code is public on GitHub. The server is under the Functional Source License: run it yourself for any purpose, except offering it to others as a competing service, and each release becomes Apache 2.0 two years on. The CLI is MIT. Self-host Reliquary.
How do I move an existing .env and CLAUDE.md in?
Paste the .env or send it with reliquary env push, then run the project with reliquary run and retire the file: Move a .env into a vault. Put CLAUDE.md and your rules files in the vault as canon and point each tool at the vault: Connect Claude Code.
How is one client's agent kept out of another client's vault?
Give each client their own vault and connect the agent to that vault only; the database refuses everything else, and a hostile test checks it on every push. Keep client work separate.
Do I need to host anything?
No. Reliquary is hosted for you, and nothing depends on your machine staying on. If you'd rather run it on your own server, you can: Self-host Reliquary.
Which AI provider sees my data?
Only the ones you connect, and only what their agent reads through your account. They process it under your own agreement with them. See sub-processors.
Is it for regulated data?
Not yet. Reliquary has no SOC 2 report or SSO today. Don't store health or payment card data in it.
Can my agents see my secrets?
Not through Reliquary: no MCP tool returns a variable's value, ever. reliquary run puts values into one process, and an agent that can run commands in that process could read them there. Values are encrypted with a key held by the app, not the database, so we, as the operator, could technically decrypt them. The security page says what that means.
How is it different from Claude Projects or ChatGPT memory?
It works across vendors, people approve changes before they become fact, and it holds credentials as well as context.
Can I leave?
Yes. An owner can export a whole vault as plain markdown files at any time, delete it for good, or move it to a self-hosted Reliquary.