EverOS vs Graphicle

EverOS 47

Framework reading for software the owner runs. The local server has no authentication and no security scheme in the OpenAPI document, relying on a 127.0.0.1 bind by default (15 of 30). No read-only mode; the cloud purge is two-step (8 of 20). Memories are extracted from conversations and returned into prompts, and everos-mcp tells hosts to save facts unprompted, with no injection guidance found (4 of 15). Structured logs and lock metrics, no audit log (6 of 15). SECURITY.md with a reporting address, five-day acknowledgement, supported versions and a published-advisories section, plus a valid security.txt (14 of 20). Total 47.

Graphicle 67

Read with the API checklist for a server the owner runs, as for Cognee and Graphiti. Over HTTP each person or agent gets its own key with a role, optional expiry and optional project list, stored as a hash, revocable, and sent in a header with the docs saying never in the URL. The stdio server runs with the owner key, which can read every project, and its graph tools take repo to reach other projects (24 of 30). The MCP server has no delete or command tool, agent writes are drafts that a person approves, and --tools and per-key project revocation narrow access. No approval step is needed because nothing destructive is exposed (18 of 20). Recall returns documents, connector content and captured sessions, which can carry injected text. Server instructions say memory is evidence, not tool permission, drafts need verbatim quotes, and capture redacts credentials and drops <private> spans. No general prompt-injection guidance found (9 of 15). Workspace usage counters, workflow_status and hash-chained deletion receipts, while the team audit trail belongs to the commercial edition (6 of 15). SECURITY.md with private reporting through GitHub advisories, a security.txt at karlex.ai valid to 7 April 2027 (re-read on 1 November), a cargo-deny advisory check in CI that failed on 15 October, and ### Security sections in the 0.1.6 and 0.1.7 changelog entries. No bug bounty or certification, and the changelog names no advisory for the 0.1.7 fixes (10 of 20). 24+18+9+6+10 = 67.

EverOS 40

Self-hosted rule, with the price lines read for EverOS Cloud. No x402, MPP or L402 (0 of 40). No cloud price or plan found on evermind.ai, its FAQ, terms or docs (0). The open-source runtime is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 40.

Graphicle 60

No payment protocol (0). Read with the self-hosted rule. Free under Apache-2.0 with nothing to buy (20). No card or account (20). An agent can install it and run graphicle setup --yes with no signup, as the README suggests (20). The commercial team edition is still in private preview with no prices on karlex.ai on 1 November, so there is no paid option to score. 0+20+20+20 = 60.

EverOS 79

Local-software lines, as a library and server the owner runs. everos on PyPI with Python 3.12 or newer stated, plus a Windows guide (20). ci.yml runs on pushes and pull requests and the repository has a tests tree, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 43 open issues and pull requests against 82 commits in 90 days; several outside bug reports, including a silent capture failure in the DSH plugin, have no reply (14 of 25). Keep a Changelog with semantic versioning declared and a 1.0 migration guide (15). Version 1.5.1 (15). Total 79.

Graphicle 63

Read as local software. Installs from an official Homebrew tap, an install script that checks each archive's SHA-256, or release archives, with macOS and Linux (glibc) on arm64 and x86_64 stated, and since 0.1.5 a Windows preview build that isn't code-signed. No language package registry (20). A public CI workflow formats, lints and tests each of the three crates on macOS and Linux. On 15 October every test job passed on both pushes to main and the cargo-deny job for licences, advisories and sources failed; 0.1.7 (25 October) replaced a yanked crate that cargo-deny warned about, but GitHub's Actions pages weren't readable on 1 November, so the runs are per the 15 October check (18). Outside reports and fixes have been handled in releases (issue #8 on kubernetes speed, pull requests #9 and #10 in 0.1.6 and 0.1.7), but the open issue list couldn't be read on 1 November, so the record is still too thin to judge (15). A dated changelog with eleven releases, each with an "After upgrading" section that names the steps a release needs (re-sync, memories that go stale), but large additions and stored-data changes ship in 0.1.x patch bumps (10). Version 0.1.10, not declared stable (0). 20+18+15+10+0 = 63.

EverOS 78

Read for the API, with seven MCP tools on top. Searches take top_k and a method, and responses can be scoped by five ids (20 of 25). Filters nest with AND and OR, and /get pages results (18 of 20). Errors carry typed codes and say which are retryable (16 of 20). add is queued and returns 202, a busy session refuses deletion with nothing deleted, and the cloud purge needs a nonce confirmed within five minutes (12 of 20). A demo runs with no key and the minimal setup needs one OpenRouter key, with a Python library and the MCP server, one language (12 of 15). Total 78.

Graphicle 85

25 tools with memory proposals on, about 24,600 characters of definitions in the v0.1.10 fixture (15). --tools essentials serves five tools (recall_project, read_project_source, query_graph, get_node, get_neighbors, about 7,400 characters) and is what graphicle setup gives Claude Code; --tools graph or --tools memory serves one half, and leaving out --allow-learning leaves only read tools plus graph_link (10 added back, up from 7 on 15 October, for the essentials set). recall_project takes max_tokens or max_chars, include prefixes and skip_shown, query_graph takes token_budget and depth, and list_projects pages with offset and limit (20). Over-limit projects are refused with a message naming the limit and its setting, 409 marks a stale revision and 429 carries Retry-After, and since 0.1.7 the Python SDK keeps retry_after on its error. MCP error shapes are not documented (12 of 20). 21 tools carry readOnlyHint true and 4 false, all with idempotentHint true and destructiveHint false, there are no destructive tools, and propose_memory requires an idempotency_key that replays the same proposal (20). Only question is required on recall and graph queries. Python and TypeScript SDKs exist, at 0.1.10, but install only from source (8 of 15). 25+20+12+20+8 = 85.

EverOS 89

OpenAPI document in the repository with 40 operations, every one with a description (25). llms.txt and llms-full.txt on docs.evermind.ai (10). Operation descriptions state purpose; when-not-to-use guidance appears in the docs, such as flush after add, rather than per operation (15 of 20). Typed request models with filter operators eq, ne, gt, gte, lt, lte and in, and 422 on malformed ids (12 of 15). curl examples for add, flush and search, and typed error codes such as SESSION_BUSY and EXTERNAL_SERVICE_UNAVAILABLE (12 of 15). /api/v2 with /api/v1 kept as a legacy alias, a changelog and release notes (15). Total 89.

Graphicle 83

Every MCP tool has a JSON Schema input with additionalProperties: false and required fields marked, read from the tool list fixtures in the repository at v0.1.10 (25). No llms.txt. The docs are Markdown files in the repository that an agent can read raw (5 of 10). Server instructions say which tool to use for structure and which for what the project says, recall_project says when to leave the reranker off, and memory tools explain draft review, while graph tools such as query_graph carry one-line descriptions (14 of 20). Enums on mode, pack_order, memory kind and state, length and item limits, minimum values and closed nested objects (14 of 15). Examples throughout the docs. The OpenAPI file documents 400, 403, 409 and 429 for the HTTP API and limit errors name the setting to change, but MCP error results are not catalogued (10 of 15). A dated changelog, semver crate versions and /v1 paths (15). 25+5+14+14+10+15 = 83.