NEDB
nedb-engine v8.0.0 · live on PyPI · npm · crates.io

Every database stores what.
NEDB also stores when, when it was true, and why.

NEDB is an embedded, tamper-evident database built on a BLAKE2b hash chain and a content-addressed Merkle DAG. Every write is a new immutable version. Every row can carry a causal edge naming the writes that caused it. Any auditor can prove the history was never altered — offline, without trusting the server.

pip install nedb-engine npm install nedb-engine cargo add nedb-engine # one Rust core → three registries, one version, one tag
License BUSL-1.1 — free under $1M revenue, Apache 2.0 at the Change Date In production since June 2026 Platforms macOS arm64+x86_64 · Linux glibc+musl · Windows
The differentiator

Four axes. Everyone else ships one.

A relational database answers what is the value now? NEDB answers four questions natively — not with triggers and side tables, but with queryable, indexed, hash-chained primitives.

Question 1

What?

Current state, stored as content-addressed objects, BLAKE2b-verified on every read.

every document
Question 2

When was it written?

Every version is kept forever. Time travel to any past sequence — no vacuum, no archival tier, no garbage collection.

AS OF <seq>
Question 3

When was it true?

Bi-temporal valid time: what the world believed on a date, independent of when the row was written.

VALID AS OF "<date>"
Question 4

Why did it happen?

Causal provenance: every write can cite the writes that caused it. Trace the chain forward or backward.

TRACE caused_by [REVERSE]
provenance.py — executed against nedb-engine 8.0.0
from nedb import NEDB

db = NEDB("./mydata")

# Time travel — the value at any past sequence, forever
snap = db.seq
db.put("users", "alice", {"age": 32})
db.get("users", "alice", as_of=snap)      # → the prior version

# Causal provenance — an edge in a hash-chained DAG, not a comment field
db.put("inputs", "msg_1", {"text": "user prefers dark mode"})
seq_msg = db.seq
db.put("beliefs", "dark_mode", {"value": True},
       caused_by=[seq_msg], evidence="user_message", confidence=0.95)

db.query('FROM beliefs WHERE _id = "dark_mode" TRACE caused_by')     # → msg_1
db.query('FROM inputs  WHERE _id = "msg_1"     TRACE caused_by REVERSE')  # → dark_mode

# Tamper evidence — verifiable by anyone, offline
assert db.verify()
The proof

History you can audit, not just history you have.

Most systems log events. NEDB chains them. Each write's hash commits to the write before it, the running Merkle head commits to everything, and the state root commits to the present — three separate commitments with different jobs.

seq 41UPDATE orders SET total = 999head: b2:9c14e07a8f3b…
↓ hashes parent
seq 42INSERT audit (caused_by → seq 41)head: b2:7af3c11e42d9…
↓ hashes parent
seq 43DELETE session (tombstone — history kept)head: b2:e3b0c44298fc…
↓ verify() recomputes the whole chain
verify()~21,000 BLAKE2b/sec · 30k objects in 1.38 s · tamper ⇒ verdict false→ True
🔐

Tamper-evident by construction

One flipped byte anywhere in the object store and verify() returns false. Writes are atomic; reads re-verify hashes. There is no mode where the chain is quietly skipped.

🧬

Provenance is native, not bolted on

caused_by is an indexed DAG edge. TRACE walks it in both directions at query speed, and metadata columns (_hash, _seq, _caused_by) select like any other column.

🤝

Verifiable without trusting the server

Merkle proofs verify locally with verify_proof() — a client can check a row existed at a time without database access. State roots compare two replicas in one hash.

Comparisons

How NEDB stacks up.

Judged on the four axes plus the operational basics. NEDB is a single-node embedded/daemon database — it does not pretend to be a distributed cluster; the comparison is about what a database can be asked and prove.

NEDBSQLiteRedisMongoDBPostgreSQLDolt
Time-travel reads✓ any seq, foreverMVCC, until vacuum✓ commit-based
Bi-temporal (valid time)✓ native clause✗ needs extension
Causal provenance (why)✓ graph edges + TRACE
Hash-chain tamper evidence✓ per writeMerkle-ish via commits
Third-party verifiable proofs✓ Merkle proofscommit hashes
Encrypted at rest, built-in✓ AES-256-GCMvia extensionpaid tiersvia extension
SQL surface✓ PostgreSQL grammar (neSQL)own query lang✓ the standard✓ MySQL dialect
Wire protocolsHTTP · RESP2 · PostgreSQLin-process only✓ RESP2✓ own✓ libpq✓ MySQL
Embedded (no server)✓ Python/Node/Rust
Idempotent, replay-protected writesSETNX-class
Git-style branch / merge of datavia nesql CLI (tag/branch/merge)✓ the whole point

SQLite row is the stock engine; extensions (sqlean, SEE) can add pieces. Redis ≥6 has TLS in transit but no native at-rest encryption. MongoDB encrypted storage engine requires Enterprise Advanced. PostgreSQL row reflects core + common extensions (temporal_tables). Every cell is stated to the best of our knowledge as of Sept 2026 — corrections welcome, we apply them publicly.

Where NEDB wins outright

Audit-shaped workloads: agent memory (every belief cites its evidence), blockchain state (itcd runs its chainstate on NEDB), compliance trails, financial ledgers, RAG pipelines where a fact must be traceable to its source, and anything a regulator or a counterparty may one day ask you to prove.

Where to pick something else

Massively concurrent distributed writes (Postgres/CockroachDB territory), sub-microsecond cache reads (Redis), or multi-TB analytical scans (column stores). NEDB is honest about its lane: proof-permitted, permanent-history storage for systems that think.

Performance

Provenance that doesn't cost you the database.

Every number below is dated, names its machine, and ships with the command that reproduces it. Absolute figures aren't cross-machine comparable — read the ratios. Time travel costs ~30%, not 10×.

63.5K /s
durable PUTs, hash-chained (15.7 µs avg)
1.33M /s
point reads of current state
942.9K /s
reads through time — AS OF queries (70% of current-state speed)
embedded core · Linux x86-64 · bench/benchmarks.py --save
OperationThroughputLatency
PUT (durable, hash-chained)63.5K/s15.7 µs
GET (current state)1.33M/s0.75 µs
GET (AS OF — time travel)942.9K/s1.06 µs
Query, eq index1.45M/s0.69 µs
Query, full-text SEARCH492.3K/s2.03 µs
daemon over HTTP · v2.2.31, Intel iMac, AES-256-GCM on · tests/test_dag_perf.py
OperationThroughputp99
Sequential writes418 ops/s3.3 ms
Point reads478 ops/s3.0 ms
Batch writes (500/req)1,104 ops/s1.2 ms
Hash join vs nested loop90.6× faster on equality joins
Indexed point lookup (20k rows)137 ms → 0.01 ms (17,000×)
the v3 segment store, measured on a real blockchain node — itcd, FlushStateToDisk on live chainstate
Flush (coins → disk)v2 loose storev3 segment store
2,002 coins / 275 kBminutes1.93 s
2,549 coins / 366 kBminutes1.71 s
Surfaces

It speaks what you already speak.

NEDB is one Rust core with five ways in. No bespoke protocol lock-in — the PostgreSQL grammar is vendored wholesale (19,513 lines, 492 keywords, from PostgreSQL 17.4) and extended with the clauses only a permanent store can answer.

🐘

PostgreSQL wire protocol

psql, psycopg3, asyncpg, JDBC, Metabase, DBeaver — both simple and extended protocols. A SQL UPDATE is a new version, a DELETE is a tombstone, and AS OF SYSTEM TIME works right in your existing SQL.

🟢

Redis compatible

RESP2 wire protocol answers redis-cli directly, and wrap_redis() shadows an existing Redis app's writes into NEDB with one flag — the audit trail grows behind a running system.

🐍

Native bindings

Embedded Python and Node cores, a Rust crate, HTTP/JSON, and the nesql CLI that opens a store directly — no daemon, no port, machine-readable exit codes.

psql — history is a SQL clause
shop=> UPDATE orders SET total = 999 WHERE _id = 'o1';
shop=> SELECT total FROM orders WHERE _id = 'o1';                        -- 999
shop=> SELECT total FROM orders AS OF SYSTEM TIME 0 WHERE _id = 'o1';   -- 120 — the old value, forever
Agent-native

Built for systems that must show their work.

NEDB was designed in production for AI agent memory — where "the model said so" is not an audit trail. It ships with the machinery to keep one honest.

🗣️

Cast — English in, queries out

A 3.33M-parameter local model turns prompts into queries on CPU, with the engine checking every plan against the live schema — invented collections get a 422 with the reason, never silent zero rows. Drift detection flags hallucinated literals. execute defaults to false.

🔗

Training-lineage receipts

NEDB's own model was trained with datasets → runs → checkpoints → evals all chained by caused_by. Any score traces to the exact data that produced it. The same primitive is yours for any pipeline.

📡

Replication contract

tip(), a bounded since() changefeed, and a scan_status() readiness gate — plus state roots to prove two stores agree. SSE streams every write and its new Merkle head, live.

Honesty

The limits, stated rather than buried.

An evaluator's first job is finding out what a product won't claim. Here is ours, in writing.

  • Single-node by design, for now. The engine is embedded or a single daemon. Replication is contract-level (tips, changefeeds, state roots) — there is no distributed consensus layer. Don't size it like CockroachDB.
  • History costs disk. Nothing is garbage-collected unless an operator explicitly runs compaction — which is deliberate, off by default, and announces that history will be pruned.
  • SQL writes are append-only under the hood. That's the feature. If you need destructive TRUNCATE, NEDB refuses it on purpose.
  • Every benchmark is a dated snapshot. Machine named, command shipped, ratios preferred over absolutes. None of these numbers are rounded up.
  • Cast's model is small and honest about it. 92.3% exact-plan match on eval, and its failure modes are published with examples — including the drift cases — not hidden behind a demo.
Track record

Three storage generations in 95 days, zero API breaks.

Every entry below is a real tag in this repository's history — git tag is the audit. Same hash-chain API across all of it: stores migrate forward automatically, client code never rewrote.

172
versioned releases (git tags)
502
commits on master
95
days, first commit to v8.0.0
~13 h
average release cadence
Jun 12, 2026 · v0.1.0
Day one: the whole architecture

First commit ships the reference Python engine, the Rust core, and the tri-registry publish pipeline — together, on purpose.

Jun 14, 2026 · v0.9.0 → v1.0.0
Provenance and bi-temporality in the first 72 hours

v0.9.0: Causal Write Provenance — the commit calls it "the first embedded database with sealed causal chains." v1.0.0, same day: bi-temporal VALID AS OF. Day 3 of the project.

Jun 15, 2026 · v1.1.0
wrap_redis — NEDB as a Redis layer-2

Shadowing, backfill, isolation guarantee. The adapter family starts here.

Jun 16, 2026 · v2.0.x
The v2 DAG engine

Content-addressed Merkle DAG replaces the AOF; --dag wired end-to-end within a day of the first alpha. Fourteen point releases in 24 hours.

Jun 22–27, 2026 · v2.2.31 → v2.4.468
v3 segment store + tri-distribution discipline

Append-only packs, one fsync per batch, macOS fast-fsync. June 27: all three distributions aligned at one version on one tag — the pattern every release since has kept.

Jun 27, 2026 · v2.5.0
The durability pass

Flush-on-exit, nedb-cli, the inspector, and the replication contract (tip / since / scan_status).

Jul 11, 2026 · v2.7.0
Official Python client + daemon TTL

nedb.client.NedbClient — the HTTP surface gets a first-class client with CAS transactions and Merkle proofs.

Jul 27, 2026 · v2.8.0 – v2.8.2
Cast — the database understands English

A 3.33M-parameter model trained inside the engine's own parser, shipped in the engine. Drift detection follows in v2.8.2.

Sep 4–5, 2026 · v2.8.3 → v2.8.6
The durability trilogy

Three defect classes found by killing a real engine at every persistence boundary — failed flushes, unobservable errors, a repair that couldn't repair.

Sep 8, 2026 · v3.0.0 → v3.2.2
Five releases in one day

The MIT era closes, the wrap family lands in all three languages, embedded bindings learn to flush on a cadence. v3.0.0–3.3.1 stay MIT forever.

Sep 11, 2026 · v3.3.0 + v4.0.0
The query language grows up; BUSL-1.1

Full boolean predicates in both engines, nine silent defects fixed, parity gated — then the relicensing: free under $1M revenue, Apache 2.0 at the Change Date.

Sep 12, 2026 · v4.2.0 → v4.3.1
The pgwire compatibility day

Subqueries, set operations, LATERAL, the full psql \d matrix driven by the real binary — and the qualified-WHERE silent-zero-rows bug found and killed.

Sep 13, 2026 · v5.0.0 + v6.0.0
State roots and the grammar land

Cross-engine state-root vectors pinned; NQL's verbs folded into the SQL evaluator; the published grammar rewritten to match the product. neSQL reaches master.

Sep 14, 2026 · v7.0.0
The HTTP endpoint speaks neQL

One router for the daemon and the CLI — two front-ends can no longer disagree about what a statement means.

Sep 15, 2026 · v8.0.0
One name, the equation

PostgreSQL's grammar + NEDB's clauses, the CLI that can actually publish, and the README rebuilt around provenance. Today.