Letta

AgentFile (.af) export/import has been removed from Letta Code, and no command moves a Cloud agent to local mode or a self-hosted runtime. Letta's docs say the legacy API export cannot be imported by the local backend or a self-hosted App Server, so restore works only on provider-operated systems.

• Letta Code README (AgentFile deprecation)
• Letta docs: Agent File (legacy)
• Letta changelog
• memory subcommand (export only, no import)

Only memory (a MemFS directory copy) and a plain-text conversation transcript can be exported; the transcript is marked truncated past 200 pages. The system prompt, model, tool and permission config, Cloud schedules (held in Letta's cloud-api database), server-held secrets and the agent identity stay with the provider.

• memory export implementation
• messages transcript export
• Cloud schedules client (cloud-api)
• secrets store (Cloud secrets on Letta server)

In the default offering the agent's state lives on Letta Cloud, and the CLI needs a Letta account or token to start a Cloud agent. There is no exported form that runs without the provider. Local mode is Apache-2.0 and needs no account, but a Cloud agent cannot be moved into it.

• index.ts Cloud auth / setup gating
• Letta Code README (Letta Cloud stores agent state)
• LICENSE (Apache-2.0)

Owners can bring their own keys, and /connect offers Ollama, LM Studio, llama.cpp and any OpenAI-compatible endpoint. However, no minimum model contract is documented. Defaults point to hosted routes: the compaction model is letta/auto and the title model is openai/gpt-6-luna. Full capability with a local open-weight model is therefore not established.

• BYOK providers (local providers)
• constants.ts (default models)
• Letta docs: models

The terms reserve the right to 'suspend or end the Services at any time at our discretion and without notice'. They include no post-termination export window and no shutdown plan. Apart from a locally synced copy of memory, termination ends access to the Cloud-held state, and mirroring memory to an owner-held repository is off by default.

• Letta Terms of Service
• memory-repository command

In the default Cloud mode, message history, agent configuration, schedules and secrets can be read only through Letta's hosted API. Memory is readable as Markdown in a local git clone, and local mode stores readable JSON/JSONL, but no schema is published.

• memory-git.ts (remote defaults to api.letta.com)
• local-store.ts (local formats)

Two shortfalls. (1) On Cloud, context is assembled server-side: default prompts become Cloud-managed (system set to null), and /context shows only token counts, so the base prompt and compaction summaries in effect are not shown. (2) The default model 'auto' resolves to the hosted letta/auto router, and which downstream model runs is not documented.

• system-prompt-versioning.ts
• context diagnostics command
• model-config.ts (proxy-chosen provider)

The privacy policy discloses no retention periods ('We generally discard information about you when it's no longer needed'). It also describes holding data the owner cannot see item by item, such as inferences ('likelihood of retention or attrition'), log data and hashed email used for ad matching.

• Letta Privacy Policy

The provider's own letta/auto router is the default model, and server-supplied 'featured' models sort first in the selector. Both are visible and replaceable via /model. No paid placement was found, but that absence rests on no binding commitment, and letta/auto's routing criteria are undisclosed.

• model-catalog.ts (auto default)
• ModelSelector.tsx (featured first)
• Letta pricing (Letta Auto)

Two or more shortfalls. Hook commands are only printed to the console and not stored durably. Tool returns in the record are truncated at about 30K characters by default, and the overflow file that holds the full output is skipped silently if it cannot be written.

• hooks executor
• truncation.ts
• cron run log

The action record has no integrity data: no hash chain, signatures or checkpoints, locally or on Letta Cloud. MemFS commits are deliberately unsigned.

• local-store.ts (transcript entries)
• memory-git-signing.ts

The default permission mode is 'unrestricted', which auto-allows every tool, and the filesystem sandbox is off by default. The agent's shell environment receives LETTA_API_KEY, so the agent can call the Letta API, which includes a reset of agent messages. It can also edit local transcripts and logs.

• permissions/mode.ts (DEFAULT_PERMISSION_MODE)
• shell-env.ts (LETTA_API_KEY)
• shell-sandbox.ts (off by default)

The client is Apache-2.0, and npm shows SLSA provenance for 0.34.0. But the default mode requires Letta Cloud, and its schedule service is documented in code as 'served by the Letta API (cloud-api), not the OSS core server', which is a closed required component.

• Cloud schedules client
• release workflow
• letta-ai/letta README (V1 server retired)

The agent's identity is a Letta-issued ID (agent-<uuid>) created by the Cloud API, and memory commits use <agentId>@letta.com. No owner-held key, DID or domain identity exists.

• backend.ts (agents.create)
• Letta docs: terminology

MemFS git versions memory, the prompt and skills, and memory backup/restore exists. But owner edits are committed under the agent's own identity, so authors cannot be told apart. Settings, permissions, tools and model changes are not versioned, and Cloud-held state is not covered.

• listener memory commands (authorEmail)
• memory subcommand (backup/restore)
• Letta docs: MemFS

The base prompt can be replaced with --system-custom, and custom prompts are never overwritten. Bundled skills can be overridden or disabled. The text of the injected system reminders is hard-coded and can only be switched on or off, not rewritten.

• args.ts (--system-custom, --no-bundled-skills)
• reminders catalog
• skills.ts (override precedence)

MemFS memory files can be itemised, edited and deleted via /memory, /palace and plain files. Conversation history, which the agent searches across sessions, can only be deleted whole (whole conversation or /clear-messages), not edited per item.

• messages subcommand
• command registry

Owners can add MCP servers, skills, mods and custom subagents without provider review. Built-in tools can be removed with --tools, --disallowedTools, /toolset or deny rules, and server-side base tools are chosen with --base-tools.

• tools filter
• args.ts

Most protections can be switched off: sandbox (LETTA_FS_SANDBOX), memory guard (--disable-memory-guard), overflow and channel gating. Some are locked: in subagents the cross-agent guard is 'unbypassable by any mode, rule, or flag', and Windows deletes against protected paths are always refused.

• permissions checker
• windows-command-safety.ts

Auto-update is on by default and installs patch releases silently. On resume, default Cloud prompts become server-managed and can change without notice. The default model is a hosted alias (letta/auto), and the terms say 'we may automatically upgrade our Services'. Env-var opt-outs exist for the client, but server-side behaviour cannot be pinned.

• auto-update.ts
• cloud-managed-system-prompt.ts
• Letta Terms of Service

Per-tool and per-path allow/deny rules exist. Nothing stops the agent from editing its own settings and permission files, and memory subagents may write all of ~/.letta. There are no network egress or domain limits for the shell. Group channels default to open.

• permissions types
• sandbox-policy.ts
• channels access-control

Any client tool can be gated with ask/alwaysAsk rules or strict mode, and headless mode denies unapproved actions. Server-side tools (web_search, fetch_webpage) run on Letta Cloud outside client gates.

• permissions/mode.ts
• create-agent-request.ts (server tools)

Esc aborts the foreground turn and sends a server cancel request whose errors are ignored. Background subagents run as detached processes and keep running. Crons and Cloud schedules need separate commands to stop.

• use-interrupt-handler.ts
• subagent-process.ts

The privacy policy says hosted-service message requests and responses may be used 'to train new models' and offers no opt-out. Telemetry is on by default and sends a device ID, the agent ID, startup arguments and error output to api.letta.com, including in local mode. The privacy policy changes on continued use.

• Letta Privacy Policy
• telemetry/index.ts
• metadata.ts (telemetry endpoint)

Cloud secrets and provider keys can be listed and removed individually (/secret, /connect), and /logout revokes the token. There is no single list of all credentials, and no commitment that provider-side copies are deleted on revocation.

• secret subcommand
• Letta docs: secrets

Agent deletion calls a single API delete and leaves the local MemFS clone, crons and logs in place. No deletion limit, backup coverage or confirmation is documented. Account deletion is only by a privacy-rights email request, which Letta 'may deny'.

• backend.ts (agents.delete)
• Letta Privacy Policy