The organization vault

Citadel remembers your decisions.dead ends.reasons.sessions.context.

Your team already wrote it down, in commits, sessions, docs, and issues. Citadel captures it as it happens and gives you, and the agents beside you, one place to ask.

Apache-2.0
Open source, self-hosted
269 ms
Median search round-trip, from a client
22
MCP tools for agents
~$55/mo
To self-host the whole node

This page is served by the system it describes. Live numbers, releases, and the roadmap are on the status page.

Both were measured against this deployment on 2026-07-31 and the method is in the repo's bench harness. The cost applies Railway's published prices to 24-hour average resource use across all three services of the project; a trailing-7-day basis comes out nearer $61, so read it as about $55 rather than a figure to the cent. The 269 ms is a round-trip timed from a client, so it carries DNS, TLS and the network path with it, and server-side timing on the same run was lower. Self-hosting the whole server, not just the CLI, is covered in the README.

01 · What it is

Memory with a boundary

Most team knowledge tools ask you to file things. Citadel captures the work you were doing anyway, then keeps the personal and the shared strictly apart.

Capturehooks, no filing
Your Nodeseat scoped
Promotionscan · approve
Centralshared

You and your agents read via MCP, CLI or web: your Node plus Central, never another seat's.

Personal by default

Everything you capture lands in your own Node. No other seat can read it, and no background job promotes it into the shared memory. Sharing is an act, not a setting.

seat scoped

Central is curated

The org's shared memory only holds what a person promoted into it, so it stays worth trusting instead of turning into a dump of everyone's scratch notes.

promotion gated

Agents are first class

Any MCP client, Claude Code, Cursor, or your own agent, searches the same vault under the same seat and the same read isolation as you do.

MCP native

Source linked

Every answer points back at where it came from, a commit, an issue, a session, so you can check the claim instead of taking the vault's word for it.

provenance
The access and data model in one passGo deeper

Citadel is a FastAPI service over a retrieval layer, but the moat is the governance around it.

Read scope

  • A caller sees their own Node, Central, and non-seat datasets, resolved by a four-pass cross-dataset visibility algorithm.
  • Seat presence is universal (every seat is a hub with a slug and counts), but content is caller-scoped. Foreign-seat drill-down returns 404, not 403, so there is no existence oracle.
  • Admin and env tokens bypass for operations; every call is audited.

Write scope

  • All seat-scoped writes land on the owning Node. Untagged writes to Central are rejected (403).
  • Every write path, HTTP, MCP, hooks, feedback, runs the seat write-policy guard and a secret scan.

Promotion to Central

  • The Promotion Agent cross-references GitHub org repos and Central, auto-promotes known work after secret-scan and LLM review, and queues new-project candidates for human approval (dashboard, MCP, or citadel promotion).
02 · How it works

Three moving parts

You install once. After that the interesting part is what you do not have to do.

Capture

It runs without you.

A session hook, a GitHub sync, and a Linear mirror feed your Node while you work. Nothing to file, nothing to remember to save.

Search

One question, both memories.

citadel search and the MCP tools read your Node and Central together, and tell you which one answered.

Promote

Sharing stays deliberate.

When something is worth the whole org knowing, you promote it. Until then it stays on your seat, out of reach of the rest of the org and of their agents.

03 · Where to go next

Two ways in

Use it

Run it on your own work. Install the CLI, hand it a seat token, and your agents search the same memory you do. Self-hosted and Apache-2.0, so you can read every line of what it does.

Work with us

Build it into your project. utxo AG joins consortia as a work-package partner, bringing the vault and the team that wrote it.

04 · Get started

Two commands

Install the CLI, then hand it your seat token. The onboarding wires up the MCP client you already use.

$ pipx install citadel-archive
$ citadel onboard
Already have a seat? Sign in.Watch the node on the live status page.Read the source on GitHub.