Memory and knowledge
How PentAGI remembers commands, results and relationships across a flow.
PentAGI keeps three kinds of memorymemoryWhat agents keep so they can build on earlier work instead of starting from scratch: long-term, working and episodic memory. so agentsagentAn AI agent of PentAGI: a model with its own prompt, settings and tools that does one kind of work in a flow, such as testing, writing code or searching the web. can build on earlier work instead of starting from scratch.
| Memory | Where it lives | What it holds |
|---|---|---|
| Long-term | PostgreSQL with pgvector | Embeddings of results, successful approaches and tooltoolWhat an agent acts through: a built-in capability such as the terminal, the isolated browser or web search, or a program in the sandbox such as nmap, metasploit or sqlmap. knowledge |
| Working | FlowflowOne run of PentAGI: a goal, the tasks created from your messages, and everything the agents did along the way. context | The current goal, tasktaskOne request in a flow: its first message, or a later message that does not answer an agent's question. PentAGI splits each task into subtasks. state and available resources |
| Episodic | Command history | Past actions, their outcomes and patterns that worked |
Every command and its output is stored in PostgreSQL. Agents query the vector storevector storeThe database of embeddings that lets agents search memory and documents by meaning. for similar cases before acting, and write their findingsfindingSomething the test discovered and recorded, such as a host, a running service or a vulnerability. back — the memorist and searcher agents do most of this lookup work.
Knowledge graph (optional)
With the knowledge graphknowledge graphThe graph of hosts, services, vulnerabilities and the access between them that PentAGI builds during a test when this optional feature is enabled. It shows how findings connect. stack enabled, PentAGI sends agent responses and tool executions to Graphiti on Neo4j. With the ingest rules of the .env template, it extracts entities and relationships — hosts, services, vulnerabilities, techniques and how they relate over time — from terminal and file operations, and keeps the other events searchable without extraction.
GRAPHITI_ENABLED=true
GRAPHITI_URL=http://graphiti:8000
GRAPHITI_CONFIG_DIR=llm_configs
GRAPHITI_LLM_CLIENT_TYPE=openai
NEO4J_URI=bolt://neo4j:7687
NEO4J_PASSWORD=replace_with_a_strong_passwordgit clone --depth 1 https://github.com/vxcontrol/pentagi.git pentagi-src
cp -r pentagi-src/examples/graphiti ./graphiti
cp -r pentagi-src/examples/neo4j ./neo4j
rm -rf pentagi-src
curl -O https://raw.githubusercontent.com/vxcontrol/pentagi/main/docker-compose-graphiti.yml
docker compose -f docker-compose.yml -f docker-compose-graphiti.yml up -dGraphiti runs its own model: GRAPHITI_ picks the preset — openai, gemini, litellm or custom — whose models are set in ./, and the matching key comes from .env (OPEN_ for openai). An .env from before 2.2.0 lacks these lines and the GRAPHITI_ rules: copy them from the current .env.example.
Graphiti is a beta integration and is off by default. Recall is scoped to the active flow; the bundled Graphiti API has no authentication, so keep it and Neo4j on a private network. Extraction and embeddings are billed separately from the flow's own model.
PentAGI checks Graphiti only when it starts, for a few seconds. If Graphiti is not ready by then, PentAGI logs a warning and runs without the knowledge graph until its next restart, so once Graphiti reports healthy, run docker restart pentagi.
Last updated on