Bloom — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bloom (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Persistent cross-session memory for [Claude Code](https://claude.com/claude-code) and any MCP-compatible client. Built to survive Opus 4.7's small context window.
Bloom is a single-file SQLite memory that survives between sessions. Ask Claude Code "what did we decide about X last week" and it can actually answer — by searching every prior turn it has saved.
If you've used Claude Opus 4.7 in long sessions, you already know the pain:
Bloom is the direct counter to that:
recall("the postgres decision") pulls the exact original turn back into context only when needed — ~200 tokens to retrieve, vs. 20K to keep it loaded the whole session.remember the conclusion of a working session, throw away the verbose path. The next session resumes with the result, not the journey.The trick is keeping recall out of the model's context until it's needed. Loading 200 turns at session start would defeat the purpose. Loading the 5 most relevant on demand is the architecture.
$ pipx install bloom-mcp
$ bloom-mcp init
$ # Bloom is now wired into Claude Code. Open a new session and ask it to recall.bloom-mcp[openai] (or [anthropic] forVoyage AI, or [local] for offline sentence-transformers), set the API key, and recall re-ranks the top FTS5 candidates by cosine similarity. Falls back cleanly to keyword-only on any embedder failure.
recall, remember, recent, sessions, forget, stats.~/.bloom/loom.db. No daemon, no Docker, no cloud.Note — Bloom is an independent open-source project, not affiliated with Anthropic. "Claude" and "Claude Code" are trademarks of Anthropic PBC.
The recommended way is pipx (isolates Bloom from your system Python):
pipx install bloom-mcpOr if you prefer plain pip / uv:
pip install bloom-mcp
# or
uv tool install bloom-mcpbloom-mcp initThe wizard runs five steps:
~/.bloom/loom.db).none is recommended — works offline, no API key).If you pick openai, anthropic (Voyage), or local, it can also capture the API key into ~/.bloom/.env (chmod 600).
top_k, max snippet chars).claude mcp add ...).Defaults to no — re-run bloom-mcp register later if you change your mind.
Code session opens with a recent-memory block.
In Claude Code, the assistant now has six new tools available. Try:
"Search Bloom for what we said about the postgres migration."
Claude will call recall("postgres migration") and surface relevant past turns.
Bloom solves one problem: Claude Code forgets every session. Even with --resume, you lose context across days/weeks/projects. Bloom adds a tiny memory layer:
marked with deleted_at and hidden from recall, but the content is still in the SQLite file until you run bloom-mcp purge --hard).
You can use it as a Python library too:
from bloom.config import Config
from bloom.db import Database
from bloom.tools import tool_remember, tool_recall
cfg = Config.load()
db = Database(cfg.db_path)
tool_remember(db, cfg, content="we picked Postgres SKIP LOCKED for the queue", session="proj-x", tags="decision")
print(tool_recall(db, cfg, query="queue choice"))Bloom's default none embedder uses keyword + recency scoring backed by SQLite FTS5. It's fast, offline, and good enough for most use cases — turn it on only if you want semantic recall (queries that don't share keywords with the stored content).
| Provider | Install | Auth | Cost |
|---|---|---|---|
none | (default) | — | Free |
openai | pip install bloom-mcp[openai] | OPENAI_API_KEY | ~$0.02 / 1M tokens |
anthropic (Voyage AI) | pip install bloom-mcp[anthropic] | VOYAGE_API_KEY | ~$0.02 / 1M tokens |
local | pip install bloom-mcp[local] | — (downloads model) | Free, ~80 MB |
Pick the provider in bloom-mcp init (Step 2) or edit ~/.bloom/config.toml:
[embedder]
provider = "openai"
model = "text-embedding-3-small"The wizard saves the API key to ~/.bloom/.env (chmod 600) so the server picks it up without an extra shell-export step.
remember calls the embedder's embed_doc(content),serializes the float32 vector, and stores it in the row's embedding BLOB.
recall searches **twopools*: the FTS5 keyword candidates and a semantic pool (the most recent N rows that have an embedding, default 200) ranked by cosine similarity to the query embedding. The two pools are unioned and scored with `0.4 bm25 + 0.5 cosine + 0.1 recency — so a query that shares no keywords with the stored turn ("queue choice" → "we picked postgres SKIP LOCKED for the worker pipeline") can still surface by meaning alone. The semantic pool size is configurable via [semantic] pool_size = 200 in config.toml or the semantic_pool_size argument to recall()`.
the API key is missing, or the optional package isn't installed, recall silently degrades to keyword-only ranking and remember writes the row with no embedding (it can be backfilled later).
If you enable an embedder after you've already used Bloom, you'll have rows with no embedding. Backfill them in one go:
bloom-mcp backfill-embeddings --confirm
# Backfilling embeddings for 1500 turns using openai...
# Processed 100/1500…
# Processed 200/1500…
# ...The command batches API calls (100 per request by default — tune with --batch), prints progress, handles Ctrl-C cleanly, and is safe to re-run.
--confirm is required for cloud embedders (openai, anthropic) because backfill is the one bulk-send operation Bloom performs — without the flag it refuses to upload your full memory store. Local sentence-transformers (local) stays on-device and skips the prompt.
For OpenAI's text-embedding-3-small at ~$0.02 / 1M tokens, an average turn of ~1000 tokens costs ~$0.00002. Embedding 10,000 turns end-to-end costs roughly $0.20.
~/.bloom/config.toml:
[storage]
db_path = "/home/you/.bloom/loom.db"
[recall]
top_k = 5
max_chars = 4000
snippet_max_chars = 600
[embedder]
provider = "none"
[logging]
level = "INFO"All values can also be set via env vars: BLOOM_DB_PATH, BLOOM_EMBEDDER, BLOOM_EMBEDDER_MODEL, BLOOM_RETRIEVE_TOP_K, BLOOM_LOG_LEVEL, BLOOM_HOME, BLOOM_DEBUG.
~/.bloom/.env is a secrets-only sidecar — Bloom reads it after config.toml and only injects credential-shaped keys (e.g. OPENAI_API_KEY, VOYAGE_API_KEY) into the environment. Any BLOOM_* line in .env is ignored with a one-line stderr warning so config can't be silently overridden by a stale .env file.
Bloom is per-user, local-first by design. Every install gets its own SQLite file. There is no cloud component, no telemetry, no shared backend. Your conversations live on your machine.
If you want a shared team memory, the right approach is:
remember to both.A first-party "team Bloom" mode is on the roadmap but not in v0.1.
MIT — © 2026 Jonah Tebaa.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.