Basic Memory vs Context Mode Engine

Basic Memory 91

v1.0.0 on 29 October 2026 (30). v0.24.0 and v0.24.1 on 22 October and v1.0.0, three releases in 90 days (20). Recent issues from outside users got maintainer replies within a few days (20 of 25). Verified namespace io.github.basicmachines-co/basic-memory in the official MCP registry, published by a workflow (15). uv.lock and CI, with an open report of an unmaintained dependency (6 of 10). Total 91.

Context Mode Engine 55

v2.1.0 tagged on 5 November 2026 by the release workflow, after v2.0.0, v2.0.1 and v2.0.2 on 4 November, and the README now names 2.0 as the npm latest (30). Four stable releases in the 90 days from 7 August. 2.0.1 only fixes release manifests, and 2.0.0, 2.0.2 and 2.1.0 change code (20). Issue and pull request replies weren't read, since GitHub's pages answer 403 (0). No official MCP registry entry read (0). CI on three systems and two Node lines, results unread (5 of 10). 30+20+0+0+5 = 55.

Basic Memory 82

AGPL-3.0, an OSI licence (30). The terms and privacy policy of 27 October 2026 agree on 30-day retention after cancellation, backups up to 90 days and no training on or sale of content, and name the infrastructure providers (26 of 30). The 1.0 release ships a migration guide mapping every removed tool and command, without a written deprecation period (14 of 20). Telemetry is disclosed in the README with what is and isn't sent and one opt-out, but it is on by default (16 of 20). Total 86.

Context Mode Engine 54

Elastic License 2.0, source available but not an OSI licence, with limits on offering it as a hosted service (15). The Engine privacy page says data stays in ~/.context-mode, gives retention (indexed items go after 30 days unread, 500 MB per project, idle projects after 14 days) and deletion by ctx_purge. The site privacy page is a summary for the Gateway that points to e-mail for the full policy (25 of 30). No deprecation policy or dated notices (0). The README and docs state zero telemetry and list each network call, with a source test that flags new call sites. We found no telemetry in the source (20). 15+25+0+20 = 60.

Basic Memory 61

Local stdio server with no credential, and cloud OAuth 2.1 through WorkOS with read-only or project-scoped keys on Pro (22 of 30). Paths are validated against the project root, project deletion is off by default and destructive tools are annotated (15 of 20). SECURITY.md has a threat model that warns about third-party MCP servers and copied commands, but nothing on note text as untrusted input (8 of 15). A local log file, and cloud audit logs only on Business (8 of 15). SECURITY.md gives an email and a 72-hour response aim but lists only 0.x.x as supported; no security.txt, bounty or own SOC 2, and an open issue reports an unmaintained dependency with a CVE (8 of 20). Total 61.

Context Mode Engine 35

Read with the framework lines for a local MCP server. No credential of its own; code runs as the user under the agent's own permission checks (10). On Claude Code the PreToolUse hook applies the user's deny rules first, and CONTEXT_MODE_REQUIRE_SECURITY=1 denies every call while a settings file is broken (15). ctx_index blocks private and link-local addresses when it fetches a URL, but no guidance on instructions inside fetched pages or tool output (0). Each project keeps a local session log of prompts, edits, commands and errors (10). No SECURITY.md, security.txt or disclosure route found, and no advisory names the package (0). 10+15+0+10+0 = 35.

Basic Memory 83

Local-software lines, as a stdio MCP server the owner runs. basic-memory on PyPI with Python 3.12 or newer stated, installed with uv (20). Test, SQLite lifecycle and Docker workflows run on the repository, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 74 open issues and pull requests against 200 commits in the 90 days, with recent bug reports answered by a maintainer within days and one flaky-CI issue open (18 of 25). The changelog calls out breaking changes in their own sections (15). v1.0.0 on 29 October 2026 (15). Total 83.

Context Mode Engine 60

Read with the local-package lines. Installs from npm as context-mode, with Node 24.15.0 or later stated in package.json and the README (20). A public CI workflow runs the test gate on macOS, Linux and Windows under Node 24.15.0 and 26 on every push, and the release workflow runs it before each publish. GitHub's pages answer 403 in this session, so run results couldn't be read (15 of 25). Open crash and regression issues weren't read (0). Versioned releases, with 2.0.0 a major for the rewrite and 2.0.0-next prereleases from 27 October, but no changelog file in the repository and the GitHub release notes unread (10 of 15). Version 2.1.0, past 1.0 (15). 20+15+0+10+15 = 60.

Basic Memory 89

Typed JSON Schema inputs on every tool from Pydantic annotations (25). llms.txt on the site and the docs, with Markdown versions of pages (10). Descriptions say what each tool does and point to the next tool, such as bm_search ending with "Read full notes with bm_read", and bm_man serves the manual, with less on when not to use a tool (16 of 20). Closed values for search mode, edit command and schema command, with aliases accepted for common argument names (13 of 15). Typed refusal codes are documented in the changelog and docs, with fewer worked examples per tool (11 of 15). Dated changelog and MCP registry versions, plus an unreleased breaking change after 1.0 (14 of 15). Total 89.

Context Mode Engine 67

No published contract. The tool input schemas sit in the source, and the docs show them as a table (0 of 25). llms.txt and Markdown copies of every page on contextmode.ai (10). Each tool description says what it does and when to use it, for example ctx_purge "Use it only when the user asks to forget or reset data" (20). The tools reference lists each tool's inputs with optional fields and allowed values (scope session, worktree or project; sort relevance or timeline; mode upgrade or uninstall), and every tool rejects an unknown field with UNKNOWN_FIELD (12 of 15). Setup, doctor and troubleshooting pages with examples and fix lines (15). Tagged releases, without a readable changelog (10 of 15). 0+10+20+12+15+10 = 67.

Basic Memory 50

Self-hosted rule, with the price lines read for the cloud. No x402, MPP or L402 (0 of 40). Cloud plans are public, and credits are $0.01 each, but what a credit buys isn't priced per unit (10). The open-source server is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 50.

Context Mode Engine 40

No machine payment protocol found (0). Scored on the hosted Gateway, the paid option. Extra requests cost $2.00 down to $1.00 per 1,000 by volume, published on the pricing page (20). A free plan of 1,000 requests every month, no card (20). A person signs in to the console with GitHub or Google (0). 0+20+20+0 = 40.