Basic Memory vs Honcho

Basic Memory 83

Local-software lines, as a stdio MCP server the owner runs. basic-memory on PyPI with Python 3.12 or newer stated, installed with uv (20). Test, SQLite lifecycle and Docker workflows run on the repository, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 74 open issues and pull requests against 200 commits in the 90 days, with recent bug reports answered by a maintainer within days and one flaky-CI issue open (18 of 25). The changelog calls out breaking changes in their own sections (15). v1.0.0 on 29 October 2026 (15). Total 83.

Honcho 50

Rootly status page at status.honcho.dev with Honcho API and Web Dashboard components and history (20). Per the 1 October check, the window holds slow provisioning of new instances on 17 August (about 7 hours, existing instances unaffected) and 36 minutes of migration downtime on 17 September, minor only (20). status.honcho.dev answered a Cloudflare bot check on 2 November, so 2 October to 2 November is unread and isn't credited. No published rate limits found; a Gmail import guide mentions Honcho's rate limits without numbers (0). No 429 or retry guidance found (0). No SLA found (0). The v3 API is generally available (10).

Basic Memory 50

Self-hosted rule, with the price lines read for the cloud. No x402, MPP or L402 (0 of 40). Cloud plans are public, and credits are $0.01 each, but what a credit buys isn't priced per unit (10). The open-source server is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 50.

Honcho 80

x402 and Tempo MPP on 16 endpoints at agentcash.honcho.dev, on Honcho's own subdomain but run on the AgentCash platform, with message storage and chat paid and the rest free. api.honcho.dev itself takes only keys (30 of 40). Ingestion at $2 per million tokens and chat at $0.001 to $0.50 a call are published (20). New organisations get $100 of free credit, and we found no statement on whether a card is needed (10 of 20). An agent can pay per call over x402 with no account (20).

Basic Memory 85

13 tools, one hidden unless enabled, so the 11 to 30 band (15), with 6 back for the manual tool and the progressive-discovery tags (21 of 25). Search narrows by mode, filters, note types, items, since, path and line context (18 of 20). Refusals are tool errors with typed codes an agent can act on (17 of 20). Every tool has readOnly, destructive and idempotent hints, and edits take an expected checksum that refuses a stale write (19 of 20). Most arguments are optional and the server starts with one command, but there is one language and no SDK beyond the CLI (10 of 15). Total 85.

Honcho 71

The API's context call returns a ready block for the next prompt (15 of 25). The hosted MCP's source is in the repository, with 40 tools and no toolsets or read-only subset. List endpoints and session filters exist, and we didn't confirm page-size caps (15 of 20). 422 responses name the failing field (12 of 20). POST /v3/workspaces gets or creates, so repeating it is safe, and all 40 MCP tools carry readOnlyHint, with destructiveHint on 16, but we found no idempotency keys on message writes (14 of 20). Python and TypeScript SDKs and few required fields (15).

Basic Memory 82

AGPL-3.0, an OSI licence (30). The terms and privacy policy of 27 October 2026 agree on 30-day retention after cancellation, backups up to 90 days and no training on or sale of content, and name the infrastructure providers (26 of 30). The 1.0 release ships a migration guide mapping every removed tool and command, without a written deprecation period (14 of 20). Telemetry is disclosed in the README with what is and isn't sent and one opt-out, but it is on by default (16 of 20). Total 86.

Honcho 69

The server is AGPL-3.0, the same code Honcho hosts, and the TypeScript SDK is Apache-2.0 (30). The terms keep data for 90 days after termination and then delete it, and a deleting-data page says what survives each kind of delete. We didn't re-read the privacy policy this run (18 of 30). Docs for v1, v2 and v3 sit side by side with a compatibility guide, but no dated notices or written policy (8 of 20). No subprocessor list or data-location statement found (0).

Basic Memory 61

Local stdio server with no credential, and cloud OAuth 2.1 through WorkOS with read-only or project-scoped keys on Pro (22 of 30). Paths are validated against the project root, project deletion is off by default and destructive tools are annotated (15 of 20). SECURITY.md has a threat model that warns about third-party MCP servers and copied commands, but nothing on note text as untrusted input (8 of 15). A local log file, and cloud audit logs only on Business (8 of 15). SECURITY.md gives an email and a 72-hour response aim but lists only 0.x.x as supported; no security.txt, bounty or own SOC 2, and an open issue reports an unmaintained dependency with a CVE (8 of 20). Total 61.

Honcho 52

Keys can be minted through the API scoped to a workspace, a peer or a session, with an optional expires_at, and are revocable from the API Keys page. The MCP takes a Bearer key or OAuth (30). Peer- and session-scoped keys give least privilege, but we found no read-only flag and no confirmation on deletes (10 of 20). Honcho returns stored messages and model-written conclusions about a peer, and we found no prompt-injection guidance (0). No audit log or per-call log found (0). SECURITY.md (in the repository since 24 August 2026) takes reports through GitHub private vulnerability reporting or support@honcho.dev, and the site carried a SOC 2 Type I badge per the 1 October check. No security.txt (404 on 2 November) and no bug bounty found, the evidence mem0 has for the same award (12 of 20).

Basic Memory 91

v1.0.0 on 29 October 2026 (30). v0.24.0 and v0.24.1 on 22 October and v1.0.0, three releases in 90 days (20). Recent issues from outside users got maintainer replies within a few days (20 of 25). Verified namespace io.github.basicmachines-co/basic-memory in the official MCP registry, published by a workflow (15). uv.lock and CI, with an open report of an unmaintained dependency (6 of 10). Total 91.

Honcho 83

Server v3.5.0 and both SDKs at 2.8.0 on 29 October 2026 (30). The repository's tags and dated CHANGELOG.md show 11 server releases from v3.0.12 (10 August) to v3.5.0, and SDK releases 2.3.0 to 2.8.0 (20). A maintainer answered the May outage report (#753) and moved updates to Discord, per the 1 October check; GitHub's pages answered 403 on 2 November (10 of 25). The hosted MCP is in the official registry as io.github.plastic-labs/honcho, and the SDKs are current (15). The TypeScript SDK's only runtime dependency is zod; CI workflows are in the repository but their run state wasn't read (8 of 10).