EverOS vs Hindsight

EverOS 79

Local-software lines, as a library and server the owner runs. everos on PyPI with Python 3.12 or newer stated, plus a Windows guide (20). ci.yml runs on pushes and pull requests and the repository has a tests tree, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 43 open issues and pull requests against 82 commits in 90 days; several outside bug reports, including a silent capture failure in the DSH plugin, have no reply (14 of 25). Keep a Changelog with semantic versioning declared and a 1.0 migration guide (15). Version 1.5.1 (15). Total 79.

Hindsight 27

Vectorize's footer now links a status page at status.hindsight.vectorize.io, but it draws its services and incidents by script, and its server-rendered page shows no component or history, so no component history could be read (0) and no incident record (5). No rate limits found in the docs, per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page) (0). The Hindsight Cloud 0.10.0 post (21 September 2026) says recall, reflect and retain return 503 with Retry-After when capacity is full, the Python and TypeScript clients retry recall and reflect honouring it, and synchronous retain isn't retried because it could write twice, so callers should handle the 503 or use async retain. Overload handling with safe-retry guidance and no idempotency keys (12). The pricing page lists a 99.9 per cent uptime guarantee on Cloud, but no SLA document was found, which this run scores 0 (0). Hindsight Cloud is sold as a generally available service (10).

EverOS 78

Read for the API, with seven MCP tools on top. Searches take top_k and a method, and responses can be scoped by five ids (20 of 25). Filters nest with AND and OR, and /get pages results (18 of 20). Errors carry typed codes and say which are retryable (16 of 20). add is queued and returns 202, a busy session refuses deletion with nothing deleted, and the cloud purge needs a nonce confirmed within five minutes (12 of 20). A demo runs with no key and the minimal setup needs one OpenRouter key, with a Python library and the MCP server, one language (12 of 15). Total 78.

Hindsight 57

27 MCP tools on a bank-scoped URL and 30 at the root (15), with no documented way to load a subset or a read-only set. List and recall calls exist with bank scoping, and we didn't confirm page-size or token-budget limits (12 of 20). 402 tells an agent it's out of credit and 403 that the key can't reach the bank (12 of 20). No idempotency keys and no readOnlyHint or destructiveHint on the MCP tools, though retain can run asynchronously (3 of 20). Clients for Python, TypeScript and Go, and one URL per bank keeps calls simple (15). MCP and key docs per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page).

EverOS 71

Apache-2.0 with a NOTICE file (30). Local data stays in the owner's Markdown and indexes. For the cloud, the privacy policy gives no retention periods, the terms and privacy policy word the training exceptions differently, and the privacy contact link points to a miromind.ai address (12 of 30). The README marks /api/v1 as a legacy alias that may be removed in a future major release, and a 1.0 migration guide exists, with no notice period (14 of 20). No outbound telemetry was found in the source, and the docs don't address it (10 of 20). Total 66.

Hindsight 50

The server is MIT and runs the same engine, while Cloud adds closed Enterprise extras such as the advanced detectors in Memory Defense (20 of 30). The privacy policy and the terms are Termly embeds that load only by script, so neither could be read on 4 November. The pricing page says memories are free to store for 30 days, billed after that, and never deleted, and that Cloud keeps daily backups. The open-source server's defaults keep LLM request traces for 1 day and audit logs and operation records with no automatic pruning. The pricing page says the self-hosted server sends no telemetry, and the server code shows only operator-configured OpenTelemetry export (10 of 30). No deprecation policy found. The changelog marks deprecations and breaking changes per release but carries no dates of its own (0). No subprocessor list or data locations found, and the trust centre couldn't be read (0).

EverOS 47

Framework reading for software the owner runs. The local server has no authentication and no security scheme in the OpenAPI document, relying on a 127.0.0.1 bind by default (15 of 30). No read-only mode; the cloud purge is two-step (8 of 20). Memories are extracted from conversations and returned into prompts, and everos-mcp tells hosts to save facts unprompted, with no injection guidance found (4 of 15). Structured logs and lock metrics, no audit log (6 of 15). SECURITY.md with a reporting address, five-day acknowledgement, supported versions and a published-advisories section, plus a valid security.txt (14 of 20). Total 47.

Hindsight 65

Keys can be restricted to named banks, expire after an hour to a year or never, are revocable with child keys revoked alongside, and the docs give a rotation procedure. The hosted MCP uses OAuth with PKCE under RFC 9728, or a Bearer key (30). Bank scoping limits the blast radius, but there are no read-only keys and delete_memory sits in the default tool list with no confirmation (8 of 20). Memory Defense screens every retain before storage. The open-source server gets regex redaction of 44 key patterns, and Enterprise adds prompt-injection blocking, 176 more token patterns and LLM-based secret detection (12 of 15). Security audit trails and SIEM webhooks are Enterprise only (5 of 15). These four lines per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page). SECURITY.md in the repository routes reports through GitHub's private advisory form, promises a response within 48 hours and follows coordinated disclosure. No security.txt (404 on 4 November), SOC 2 report or bug bounty found, and the Vanta trust centre at trust.vectorize.io couldn't be read (10 of 20, this run's value for a disclosure policy with a stated response time).

EverOS 89

OpenAPI document in the repository with 40 operations, every one with a description (25). llms.txt and llms-full.txt on docs.evermind.ai (10). Operation descriptions state purpose; when-not-to-use guidance appears in the docs, such as flush after add, rather than per operation (15 of 20). Typed request models with filter operators eq, ne, gt, gte, lt, lte and in, and 422 on malformed ids (12 of 15). curl examples for add, flush and search, and typed error codes such as SESSION_BUSY and EXTERNAL_SERVICE_UNAVAILABLE (12 of 15). /api/v2 with /api/v1 kept as a legacy alias, a changelog and release notes (15). Total 89.

Hindsight 78

OpenAPI spec at hindsight.vectorize.io/openapi.json, linked from the open-source docs' llms.txt (25). llms.txt and llms-full.txt on hindsight.vectorize.io, with links to the quick start, SDKs, API reference, OpenAPI file and MCP page (10). Tool names follow the three verbs (retain, recall, reflect) and the docs explain each, but with 27 tools the when-not-to-use guidance is thin (12 of 20). Typed inputs, with an async flag on retain, and we didn't audit enums across the spec (10 of 15). 402 and 403 are documented with their causes, and examples sit in the guides (9 of 15). A changelog at hindsight.vectorize.io/changelog with Breaking Changes sections per release, and versioned /v1 paths (12 of 15). Cloud docs per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page).

EverOS 40

Self-hosted rule, with the price lines read for EverOS Cloud. No x402, MPP or L402 (0 of 40). No cloud price or plan found on evermind.ai, its FAQ, terms or docs (0). The open-source runtime is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 40.

Hindsight 30

No x402, MPP or L402. Calls on an empty balance return 402 with no payment payload (0). Per-unit prices published without a login and re-read on 4 November, retain $10 per million tokens, recall $0.75 per million, reflect $0.05 a call, Iris Extract $7.50 per million, mental model retrieval $0.25 per million and refresh $0.05 a call, storage $0.25 per million tokens a month after the first 30 days (20). The pricing page says new accounts start with $5 of free credit; whether a card is needed isn't stated (10 of 20). A person signs up in the browser to get a key (0).