AI Memory vs MemMachine

AI Memory 50

v3.3.3 of 3 November 2026 (30). 68 tags from 6 August to 3 November, from v2.x through v3.3.3 (20). Issue and pull-request replies couldn't be read (github.com refused) (0). Not in the official MCP registry, and the repository has no server.json (0 of 15). Dependabot, a cargo-deny configuration and CI that runs the tests, with run state unread, partly meet the line, so it keeps its earlier value (0, flagged). 30+20+0+0+0 = 50.

MemMachine 83

v0.4.0 on PyPI on 8 October 2026, 29 days before the check (30). v0.3.9-post1, v0.4.0, v0.4.1-dev0 and v0.4.1-a1 in 90 days (20). Many open issues and recent reports with few replies (12 of 25). Python and TypeScript clients, both current (12 of 15). uv lock checks, security audit, SBOM and stale-issue workflows (9 of 10). Total 83.

AI Memory 65

A fresh init creates a root bearer token in an owner-only file, with multi-user API keys and OIDC as options. Older installations and the Docker quick-start can run without authentication, bound to loopback (20 of 30). Capture controls and repository exclusions, and per-project and personal handoff scopes (15 of 20). docs/security-boundaries.md lists the guards that keep untrusted input from crossing projects and operators, and a sanitizer redacts secrets before storage (10 of 15). Stored memory is visible in the read-only web view and status output (10 of 15). SECURITY.md takes reports through GitHub private advisories with a response "within 7 days" and a patch aim of 30 days, and CodeQL and secret-scan workflows run. No bug bounty or certification (10 of 20, from 0). 20+15+10+10+10 = 65.

MemMachine 41

Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.

AI Memory 60

Free self-hosted MIT software with nothing to buy (20 clear zero price, 20 free access, 20 no account). No machine payment protocol (0). Optional cloud embedding or LLM providers bill separately. 0+20+20+20 = 60.

MemMachine 40

Self-hosted rule, with the price lines read for the hosted platform. No x402, MPP or L402 (0 of 40). No hosted prices found on the site or docs (0). Free to self-host with no card (20). An agent can install it from PyPI with no account (20). Total 40.

AI Memory 65

Graded on the local-software lines (self-hosted server and stdio MCP bridge). Releases install from GitHub with install.sh or install.ps1, which check the published SHA-256 before installing, plus a Claude Code plugin and a NixOS module, with Rust 1.95 stated (20). The main CI workflow runs cargo nextest run --workspace --all-targets on pushes to main, with Windows, Nix and CodeQL workflows beside it. Run state couldn't be read on 4 November (api.github.com refused), so 15 of 25, from 0. Open crash and regression issues weren't read (github.com refused) (0). A Keep a Changelog file under semantic versioning, with 3.0.0 calling out the removed 1.x token commands and a migration and rollback guide (15). Version 3.3.3 (15). 20+15+0+15+15 = 65.

MemMachine 51

Local-software lines, as a server the owner runs. memmachine-server and memmachine-client on PyPI with Python versions stated, a Docker image and a compose script (20). pytest, integration and installation-test workflows exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 292 open issues and pull requests; the newest bug reports, including a 429 from a provider surfacing as a 500 and a 0.4.0 configuration that no longer starts, have zero to two replies (10 of 25). No changelog file, release notes only on GitHub, which weren't read, and pre-1.0 tags (6 of 15). Version 0.4.0 (0). Total 51.

AI Memory 90

25 MCP tools in crates/ai-memory-mcp/src/server.rs. Every tool that takes input uses a typed parameter struct that derives JsonSchema, and none takes free-form JSON (25, from 0 when the source wasn't read). Markdown guides in the repository, including INSTALL_FOR_AGENTS.md (10). Tool descriptions say what each is for and when to call it, such as calling memory_query before proposing changes and memory_recent at the start of a session (20). Typed inputs with documented fields (10 of 15). Setup and recovery examples (10 of 15). Releases and a dated changelog (15). 25+10+20+10+10+15 = 90.

MemMachine 79

OpenAPI documents for the server (54 operations) and the hosted platform (12) (25). llms.txt on docs.memmachine.ai with Markdown pages (10). Every operation has a description, and the docs explain memory types and scoping (15 of 20). Typed request models generated from the server, with search options for limits and filters (12 of 15). Examples for each client and the MCP tools, but only 422 is documented on the server and the README's first example doesn't run (8 of 15). /api/v2 paths and tagged releases, no changelog (9 of 15). Total 79.

AI Memory 50

MIT source (30). DATA_HANDLING.md and SECURITY.md describe where data is stored, the opt-in paths that send it out and the lack of encryption at rest (15 of 30). Dated 3.0.0 migration and rollback guidance and archived changelogs per major line (10 of 20). DATA_HANDLING.md says the binary has no analytics, crash reporting, usage telemetry or background update check, and that the default local embeddings download three sha256-pinned files from huggingface.co on first start, avoidable with embedding_provider = "none" (20, from 0). 30+15+10+20 = 75.

MemMachine 57

Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.