Basic Memory vs MemMachine

Basic Memory 83

Local-software lines, as a stdio MCP server the owner runs. basic-memory on PyPI with Python 3.12 or newer stated, installed with uv (20). Test, SQLite lifecycle and Docker workflows run on the repository, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 74 open issues and pull requests against 200 commits in the 90 days, with recent bug reports answered by a maintainer within days and one flaky-CI issue open (18 of 25). The changelog calls out breaking changes in their own sections (15). v1.0.0 on 29 October 2026 (15). Total 83.

MemMachine 51

Local-software lines, as a server the owner runs. memmachine-server and memmachine-client on PyPI with Python versions stated, a Docker image and a compose script (20). pytest, integration and installation-test workflows exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 292 open issues and pull requests; the newest bug reports, including a 429 from a provider surfacing as a 500 and a 0.4.0 configuration that no longer starts, have zero to two replies (10 of 25). No changelog file, release notes only on GitHub, which weren't read, and pre-1.0 tags (6 of 15). Version 0.4.0 (0). Total 51.

Basic Memory 82

AGPL-3.0, an OSI licence (30). The terms and privacy policy of 27 October 2026 agree on 30-day retention after cancellation, backups up to 90 days and no training on or sale of content, and name the infrastructure providers (26 of 30). The 1.0 release ships a migration guide mapping every removed tool and command, without a written deprecation period (14 of 20). Telemetry is disclosed in the README with what is and isn't sent and one opt-out, but it is on by default (16 of 20). Total 86.

MemMachine 57

Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.

Basic Memory 85

13 tools, one hidden unless enabled, so the 11 to 30 band (15), with 6 back for the manual tool and the progressive-discovery tags (21 of 25). Search narrows by mode, filters, note types, items, since, path and line context (18 of 20). Refusals are tool errors with typed codes an agent can act on (17 of 20). Every tool has readOnly, destructive and idempotent hints, and edits take an expected checksum that refuses a stale write (19 of 20). Most arguments are optional and the server starts with one command, but there is one language and no SDK beyond the CLI (10 of 15). Total 85.

MemMachine 65

Searches take limit and filter options for episodic and semantic results (20 of 25). Memories can be listed and filtered by scope (15 of 20). Validation errors are typed; other failures are less clear, as the 429-to-500 issue shows (10 of 20). No idempotency keys or safe-retry guidance found (5 of 20). Python and TypeScript clients and a five-line quick start, once the import is fixed (15). Total 65.

Basic Memory 61

Local stdio server with no credential, and cloud OAuth 2.1 through WorkOS with read-only or project-scoped keys on Pro (22 of 30). Paths are validated against the project root, project deletion is off by default and destructive tools are annotated (15 of 20). SECURITY.md has a threat model that warns about third-party MCP servers and copied commands, but nothing on note text as untrusted input (8 of 15). A local log file, and cloud audit logs only on Business (8 of 15). SECURITY.md gives an email and a 72-hour response aim but lists only 0.x.x as supported; no security.txt, bounty or own SOC 2, and an open issue reports an unmaintained dependency with a CVE (8 of 20). Total 61.

MemMachine 41

Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.

Basic Memory 89

Typed JSON Schema inputs on every tool from Pydantic annotations (25). llms.txt on the site and the docs, with Markdown versions of pages (10). Descriptions say what each tool does and point to the next tool, such as bm_search ending with "Read full notes with bm_read", and bm_man serves the manual, with less on when not to use a tool (16 of 20). Closed values for search mode, edit command and schema command, with aliases accepted for common argument names (13 of 15). Typed refusal codes are documented in the changelog and docs, with fewer worked examples per tool (11 of 15). Dated changelog and MCP registry versions, plus an unreleased breaking change after 1.0 (14 of 15). Total 89.

MemMachine 79

OpenAPI documents for the server (54 operations) and the hosted platform (12) (25). llms.txt on docs.memmachine.ai with Markdown pages (10). Every operation has a description, and the docs explain memory types and scoping (15 of 20). Typed request models generated from the server, with search options for limits and filters (12 of 15). Examples for each client and the MCP tools, but only 422 is documented on the server and the README's first example doesn't run (8 of 15). /api/v2 paths and tagged releases, no changelog (9 of 15). Total 79.

Basic Memory 50

Self-hosted rule, with the price lines read for the cloud. No x402, MPP or L402 (0 of 40). Cloud plans are public, and credits are $0.01 each, but what a credit buys isn't priced per unit (10). The open-source server is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 50.

MemMachine 40

Self-hosted rule, with the price lines read for the hosted platform. No x402, MPP or L402 (0 of 40). No hosted prices found on the site or docs (0). Free to self-host with no card (20). An agent can install it from PyPI with no account (20). Total 40.