Lemma is a local-first MCP server for AI coding agents such as Claude Code, Cursor and Windsurf. It cuts what enters the model's context (repeated reads, command output, unused tool schemas), stores memories next to the hashes of the files they came from so changed code makes them STALE, and keeps a ledger of what it actually saved.

How is the Brain different from a semantic cache?

A semantic cache returns an old answer when a new question looks similar. The Brain stores each memory with hashes of its source files and serves it only while they still match; every result says whether it is a hit, a near-miss or stale.

Yes. 60 of its 110 tools are free, including the whole memory lifecycle and the token ledger. Pro is $5 per month and adds the tools that write, run commands, refactor and review pull requests.

Is Lemma open-source?

The core is MIT-licensed and published on npm as @nxuss/lemma. Pro features require a license.

Lemma is built and maintained by Nxus Studio in Guadalajara, Jalisco, Mexico.

Privacy Notice

Last updated: 2026-11-01 · This is a translation. The Spanish version governs.

Juan Carlos Díaz Mendoza ("Nxus Studio"), an individual based in Guadalajara, Jalisco, México, who receives any communication about your data at juan.carlos@nxus.studio, is responsible for your personal data when you use lemma.nxus.studio, buy Lemma Pro or use Lemma Cloud. This notice complies with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.

1. First: local Lemma does not send us your code

The npm package runs on your machine and keeps its Brain on your disk. It does not send your code, memories or commands to any server of ours. The only thing it sends is your Pro license, when you activate it or it checks that the license is still valid.

Lemma Cloud only receives data if you or your team configure a Cloud key. From then on, what is stored is described below.

2. The data we process

Identity and contact: name and email address (waitlist, Pro purchase, members of a Cloud workspace and their role).

Billing: your Stripe customer and subscription identifiers, payment status and, if you ask for an invoice, your tax details. Card details are received and stored by Stripe; we never see them.

Licenses and keys: your Pro license and, for Cloud, a hash of each key, its name, its prefix and when it was last used. We never store the key itself.

Cloud content: the memories your agents store (text, file paths, repository name, hashes of the files they cite and the author of each memory). It may contain code snippets.

Usage: how many requests and tokens each key uses, of what kind and when, to enforce plan quotas and show activity in the console.

Technical data: IP address, browser and time of each request, kept in the server logs; and cookieless visit metrics for the website (Vercel Analytics).

We do not process sensitive personal data. Please do not store third parties' personal data inside memories.

3. What we use it for

Necessary purposes: providing the service you signed up for; authenticating keys and console sessions; enforcing plan limits; billing, invoicing and managing your subscription; sending service emails (sign-in, license, billing and change notices); support; and protecting the service against abuse.

Secondary purposes: telling you about Lemma news and asking for feedback. You can opt out at any time by writing to juan.carlos@nxus.studio or with the unsubscribe link in each email, without affecting the service.

We do not sell your data or use your content to train artificial-intelligence models.

4. Who we share it with

We use providers that process data on our behalf and only to provide their service to us: Google Cloud (Lemma Cloud servers and database, United States, region us-central1), Vercel (website and analytics), Stripe (payments), Supabase (waitlist and licenses) and Resend (email delivery).

Several are in the United States, so your data may be transferred outside Mexico. Under the law these transfers to processors do not require your consent, and we require each provider to apply equivalent security measures.

Inside a Cloud workspace, its members see the team's memories and activity, including who stored each memory.

We only hand data to an authority when a law or a duly grounded order requires it.

5. How long we keep it

Cloud memories are kept while your workspace is active or until you delete them. If you cancel and ask for full deletion, we do it within 30 days; backups rotate out within 7 more days.

Server technical logs are deleted after 30 days. Billing data is kept for as long as tax law requires.

6. How we protect it

Encrypted connections (HTTPS), keys stored only as hashes, per-workspace isolation on every database query, secret masking before a memory is stored, single-use short-lived sign-in links, and daily backups. No system is invulnerable: if a breach affects your rights, we will tell you without delay.

7. Your ARCO rights

You can access, rectify or cancel your data or object to its processing, and revoke your consent or limit its use. Write to juan.carlos@nxus.studio with your name, the email on your account, the right you want to exercise and, where applicable, a document proving your identity or representation.

We answer within 20 business days and, if it applies, carry it out within the following 15 business days. If you are not satisfied with the answer, you can go to the competent personal-data protection authority.

8. Cookies

The website uses no advertising or tracking cookies. Vercel's analytics works without cookies. The Cloud console uses a single session cookie, needed to keep you signed in, and the site remembers your language in your browser's storage.

9. Changes to this notice

We will publish any change on this page with its update date and, if the change is material, tell you by email.