Basic Memory vs claude-mem

Basic Memory 82

AGPL-3.0, an OSI licence (30). The terms and privacy policy of 27 October 2026 agree on 30-day retention after cancellation, backups up to 90 days and no training on or sale of content, and name the infrastructure providers (26 of 30). The 1.0 release ships a migration guide mapping every removed tool and command, without a written deprecation period (14 of 20). Telemetry is disclosed in the README with what is and isn't sent and one opt-out, but it is on by default (16 of 20). Total 86.

claude-mem 46

Apache-2.0 engine with the hosted observer, sync and team functions reserved as closed, per docs/ip-boundary.md (25 of 30). SECURITY.md lists every route by which data leaves the machine, but the cmem.ai privacy page, re-read on 4 November, still says "Nothing leaves your device unless you explicitly turn on cloud sync" and that sensitive details are filtered before storage, while secret redaction defaults to off, doesn't cover the hosted observer, and names no retention periods, subprocessors or legal entity. Locally, raw tool uses are kept forever by default (CLAUDE_MEM_TOOL_USES_RETENTION_DAYS 0) and daily logs 30 days since 15.7.0 (12 of 30). Release notes date breaking changes with migration steps, such as 15.0.0 and the removal of Gemini CLI support in 13.10.0, but no written deprecation policy (8 of 20). Telemetry is on by default, documented field by field (including PostHog's city-level location from the sender's IP) with telemetry disable, DO_NOT_TRACK and a separate error-reporting switch, and the installer asks once; the README doesn't mention it (16 of 20).

Basic Memory 50

Self-hosted rule, with the price lines read for the cloud. No x402, MPP or L402 (0 of 40). Cloud plans are public, and credits are $0.01 each, but what a credit buys isn't priced per unit (10). The open-source server is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 50.

claude-mem 20

No x402, MPP or L402 (0). Scored on the hosted option, as the brief says for open-source software with a paid service. CMEM Pro $30, Heavy $70 and CMEM Max $100 a month are public, but the included usage is shown only at checkout (10 of 20). The engine is free with no card, but the pricing page says the CMEM Pro trial needs a credit or debit card while the README says sign-in needs none (10 of 20). The hosted service needs a browser sign-in by magic link (0).

Basic Memory 91

v1.0.0 on 29 October 2026 (30). v0.24.0 and v0.24.1 on 22 October and v1.0.0, three releases in 90 days (20). Recent issues from outside users got maintainer replies within a few days (20 of 25). Verified namespace io.github.basicmachines-co/basic-memory in the official MCP registry, published by a workflow (15). uv.lock and CI, with an open report of an unmaintained dependency (6 of 10). Total 91.

claude-mem 76

v15.9.0 tagged on 2 November 2026, with its changelog entry dated the same day (30). Tags v15.0.0 (20 October) to v15.9.0 in the shallow clone alone, 16 in two weeks, and 78 GitHub releases from 1 August to 29 October per the 30 October reading (20). Issue #5078, reported on 26 October 2026, was fixed by a contributor's pull request and released in 15.3.0 the same day; the 15.9.0 notes thank 25 outside contributors; reply times weren't re-read (18 of 25). Not in the official MCP registry per the 30 October search (0). CI configured on main, Dependabot per SECURITY.md, two runtime dependencies in the published package (8 of 10).

Basic Memory 85

13 tools, one hidden unless enabled, so the 11 to 30 band (15), with 6 back for the manual tool and the progressive-discovery tags (21 of 25). Search narrows by mode, filters, note types, items, since, path and line context (18 of 20). Refusals are tool errors with typed codes an agent can act on (17 of 20). Every tool has readOnly, destructive and idempotent hints, and edits take an expected checksum that refuses a stale write (19 of 20). Most arguments are optional and the server starts with one command, but there is one language and no SDK beyond the CLI (10 of 15). Total 85.

claude-mem 74

19 tools advertised by default with about 10,000 characters of descriptions across all 26 by our count (15), plus 3 back because TeamBrain and server-only tools stay hidden until used and the work-state tools can be switched off (18 of 25). search takes limit, offset, project, platform source, type, observation type, date range and order, and timeline and get_observations take depth and limit (20). Worker errors are JSON with 400 and 404 documented, and MCP errors name the fix ("Join a team with npx claude-mem teambrain join"), but no error catalogue (14 of 20). 17 tools carry readOnlyHint, none carries destructiveHint or idempotentHint, and work_state_write appends on each call (12 of 20). Most parameters are optional with stated defaults; the only official library is the TypeScript npm package (10 of 15).

Basic Memory 61

Local stdio server with no credential, and cloud OAuth 2.1 through WorkOS with read-only or project-scoped keys on Pro (22 of 30). Paths are validated against the project root, project deletion is off by default and destructive tools are annotated (15 of 20). SECURITY.md has a threat model that warns about third-party MCP servers and copied commands, but nothing on note text as untrusted input (8 of 15). A local log file, and cloud audit logs only on Business (8 of 15). SECURITY.md gives an email and a 72-hour response aim but lists only 0.x.x as supported; no security.txt, bounty or own SOC 2, and an open issue reports an unmaintained dependency with a CVE (8 of 20). Total 61.

claude-mem 50

The worker and MCP HTTP transport bind to loopback and check Host and Origin, with no credential (20), the server beta's cmem_ keys are scoped and stored hashed (5), and the hosted private MCP link is a bearer secret in the URL per the privacy page (less 10), 15 of 30. Plan mode prompts before the writing tools, <private> tags keep content out of storage and work state can be disabled, but hooks capture all tool input and output by default and the Antigravity adapter answered allow to every agy tool call until 26 October 2026 (10 of 20). Stored observations summarise tool output that can carry injected text and are injected at the next SessionStart; we found no guidance on that, and redaction of secrets is off by default (3 of 15). Local logs, the My Work viewer, an SSE event stream and raw tool I/O through get_tool_uses (12 of 15). SECURITY.md (moved to .github/SECURITY.md in 15.8.1) with a private advisory route, a 48-hour acknowledgement and a published fix history; no security.txt, bug bounty or certification (10 of 20).

Basic Memory 83

Local-software lines, as a stdio MCP server the owner runs. basic-memory on PyPI with Python 3.12 or newer stated, installed with uv (20). Test, SQLite lifecycle and Docker workflows run on the repository, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 74 open issues and pull requests against 200 commits in the 90 days, with recent bug reports answered by a maintainer within days and one flaky-CI issue open (18 of 25). The changelog calls out breaking changes in their own sections (15). v1.0.0 on 29 October 2026 (15). Total 83.

claude-mem 75

Scored as local software. Official npm package claude-mem installed through npx claude-mem install, with Node ^20.19.0 or 22.12 and later and Bun 1.1.31 or later stated in package.json (20). ci.yml runs on pushes to main and runs the test lanes (fast and integration), the OpenClaw, My Work, Cowork and Hermes suites, beside Windows, media-runtime and ods-native workflows. The 29 October push runs passed per the 30 October reading of GitHub's API, which answers 403 in this session, so today's result is unread (15 of 25). The 30 October reading counted 129 open issues and pull requests combined, and the changelog records a July 2026 worker restart loop fixed in 13.12.1; reply times weren't re-read (10 of 25). Majors carry breaking changes with migration notes, such as 15.0.0 removing mem_search and flash_search, and 15.7.0 to 15.9.0 list none (15). Version 15.9.0 (15).