Documentation

claude-mem Adapter

The claude-mem adapter integrates with the claude-mem MCP server, providing encrypted backup and cross-device sync for your AI memories.

How it works:

• Import: Reads observations from claude-mem's SQLite database
• Export: Writes synced observations back to claude-mem SQLite
• Embeddings: Syncs to ChromaDB vector store for semantic search
• Backfill: Automatically embeds existing observations on first sync

Sync flow:

Project Filtering

By default, sine~sync syncs observations from all projects. You can narrow this with include/exclude filters:

• Exclude: sinesync config exclude <project> — skip a specific project during sync
• Include: sinesync config include <project> — re-include a previously excluded project
• Include-only: sinesync config include-only <project> [project2...] — only sync the specified project(s) (exclude all others)
• Clear: sinesync config clear-filters — remove all filters and sync everything

Run sinesync config show to view your current configuration and active filters, or sinesync config projects to list available projects from your memory adapters.

Why CLI Only?

Keypair generation happens in the CLI because it requires your encryption key to protect your private key. The CLI has access to your derived encryption key (from your password + secret key), which the web interface doesn't store for security reasons.

Your private key is encrypted before being uploaded to our servers, ensuring we can never read it.

Generate Your Keypair

If you signed up via the web, simply log in with the CLI:

The CLI automatically generates a keypair if you don't have one. Your public key is uploaded so others can encrypt vault keys for you. Your private key is encrypted locally with your derived key before upload—we never see the raw private key.

To regenerate your keypair (e.g., for key rotation), run:

How It Works

sine~sync uses two-channel key exchange to securely share vaults with new users who don't yet have an account.

Overview

Organizations let teams manage members, enforce SSO authentication via SAML, and automate user provisioning with SCIM. An organization admin can configure identity provider integration, manage verified domains, and control session policies.

Creating an Organization

1. Log in to sine~sync and click Create Organization in the navigation
2. Enter an organization name and choose a URL slug (used for SSO login URLs)
3. Select a plan and billing interval, or start a 30-day free trial
4. You'll become the first admin of the organization

Setting Up SAML SSO

SAML allows your team to log in using your existing identity provider (Okta, Azure AD, Google Workspace, etc.).

1. Add and verify a domain — Go to Organization → Settings → Domains. Add your email domain (e.g. company.com) and create a DNS TXT record with the provided verification token
2. Get SP metadata — In the SAML Configuration section, copy the SP Metadata URL shown at the bottom. Provide this to your IdP when creating the SAML application
3. Configure your IdP — In your identity provider, create a new SAML application for sine~sync. Set the ACS URL and Entity ID from the SP metadata
4. Enter IdP details — Back in sine~sync Settings, fill in:
   • IdP Entity ID — The entityID from your IdP's metadata
   • SSO URL — The SingleSignOnService URL (HTTP-Redirect binding)
   • IdP Certificate — The PEM-encoded X.509 signing certificate
5. Configure attribute mapping — Map the SAML attribute names your IdP sends:
   • Email (required) — The attribute containing the user's email
   • First Name / Last Name (optional) — For display in the members list
   • Groups (optional) — Enables automatic group sync from your IdP
6. Enable SAML — Check the "SAML Enabled" toggle and save
7. Test — Open a private browser window and log in with an email from your verified domain. You should be redirected to your IdP

Setting Up SCIM Provisioning

SCIM automates user lifecycle management — creating accounts when users are assigned in your IdP, and deactivating them when removed.

1. Go to Organization → Settings → SCIM Provisioning
2. Click Generate Token and give it a label
3. Copy the token immediately — it cannot be retrieved again
4. In your IdP's SCIM provisioning settings, enter:
   • SCIM Base URL: https://api.sinesync.ai/v1/scim/v2
   • Bearer Token: The token you just generated
5. Enable provisioning in your IdP. Supported operations: create users, update profiles, deactivate users, and sync groups

Using the CLI as an Organization Member

Organization members who authenticate via SAML use the CLI slightly differently from password-based users.

First Login (New Device)

1. Run sinesync login and enter your email
2. A browser window opens and redirects to your IdP for SAML authentication
3. After authenticating, the CLI detects you're an SSO user
4. First device ever: Encryption keys are generated automatically and secured with a device key stored in your OS keychain. No password or secret key is needed
5. New device (keys already exist): A 6-digit linking code is displayed. On an existing device, run sinesync device approve and enter the code to transfer encryption keys securely

Device Approval

When a team member logs in on a new device, they need another device to approve the key transfer:

1. New device shows: Linking code: 483-721
2. On existing device, run: sinesync device approve
3. Select the pending request and enter the 6-digit code
4. Encryption keys are transferred securely using an Argon2id-derived key — the code expires after 5 minutes and allows only 3 attempts

Day-to-Day Usage

Once set up, the CLI works identically to password-based accounts. All sync, vault, and MCP commands work the same way. Your encryption keys are unlocked automatically from the device keychain on each sinesync login.

Managing Members

Go to Organization → Members to manage your team:

• Admin — Full access to settings, SAML/SCIM config, member and group management
• Member — Standard access to sync, vaults, and their own settings

With auto-provisioning enabled, new users are automatically added as members on first SAML login. With SCIM, your IdP manages the full user lifecycle.

Zero-Knowledge Architecture

sine~sync uses a zero-knowledge encryption model. Your encryption key is derived entirely on your device and never transmitted to our servers. We cannot read your data.

Encryption Flow

Technical Details

• Key Derivation: Argon2id (64MB memory, 3 iterations, 4 parallelism)
• Encryption: AES-256-GCM (authenticated encryption)
• Nonce: 96-bit random nonce per operation
• AAD: Type-specific descriptors (e.g. sinesync-observation-v1) used as additional authenticated data

Doctor Command

Run sinesync doctor to check the health of your installation:

This checks:

• Core: Local storage integrity, daemon status, embedding model health
• Standalone: SQLCipher database access, embedding compatibility, cloud sync status
• claude-mem: Stuck SDK sessions, orphaned messages, embedding backlog, ChromaDB health

To automatically fix issues, add the --fix flag: