EverOS vs Hy Memory

EverOS 89

OpenAPI document in the repository with 40 operations, every one with a description (25). llms.txt and llms-full.txt on docs.evermind.ai (10). Operation descriptions state purpose; when-not-to-use guidance appears in the docs, such as flush after add, rather than per operation (15 of 20). Typed request models with filter operators eq, ne, gt, gte, lt, lte and in, and 422 on malformed ids (12 of 15). curl examples for add, flush and search, and typed error codes such as SESSION_BUSY and EXTERNAL_SERVICE_UNAVAILABLE (12 of 15). /api/v2 with /api/v1 kept as a legacy alias, a changelog and release notes (15). Total 89.

Hy Memory 55

Library reading. No OpenAPI or tool schema applies, and the SDK defines no agent tools. Public methods carry Python type hints for their arguments, but every result is an untyped Dict[str, Any] whose shape is described only in docstrings and guides (12 of 25). No llms.txt on memory.hunyuan.tencent.com per the 16 October check, not re-read on 4 November. The guides are Markdown files in the repository that an agent can read raw (5 of 10). Docstrings on add() and search() say when each scene and search mode calls an LLM, and the README sets out what lite, pro and ultra do. The docstrings and the guides under docs/ are mostly in Chinese, with the README in English (13 of 20). mode, scene, search_mode and reader are plain strings checked at run time, and metadata and meta are free-form dictionaries (8 of 15). Worked examples in the README and guides. Since 2.0.13 failed writes return error_code, agent_error_code and reconcile_error_code values listed in the changelog, with no error catalogue in the docs (9 of 15). CHANGELOG.md covers every SDK release from 2.0.1 to 2.0.13, while docs/usage.md still pins 2.0.4 for every install line (8 of 15).

EverOS 40

Self-hosted rule, with the price lines read for EverOS Cloud. No x402, MPP or L402 (0 of 40). No cloud price or plan found on evermind.ai, its FAQ, terms or docs (0). The open-source runtime is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 40.

Hy Memory 60

Apache-2.0 package the owner runs, with nothing to buy from Tencent, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account. No x402, MPP or L402 in the docs or source (0). Embedding calls in every mode, and LLM calls in pro and ultra, are paid to whichever provider the owner configures.

EverOS 79

Local-software lines, as a library and server the owner runs. everos on PyPI with Python 3.12 or newer stated, plus a Windows guide (20). ci.yml runs on pushes and pull requests and the repository has a tests tree, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 43 open issues and pull requests against 82 commits in 90 days; several outside bug reports, including a silent capture failure in the DSH plugin, have no reply (14 of 25). Keep a Changelog with semantic versioning declared and a 1.0 migration guide (15). Version 1.5.1 (15). Total 79.

Hy Memory 65

Local-software reading of the Python SDK. hy-memory installs from PyPI with Python 3.9 or later declared in pyproject.toml at 2.0.13 and extras for Qdrant, FAISS, Neo4j, MySQL and local rerank (20). A public CI workflow runs the whole pytest suite (133 test_*.py files at commit b58e95f) on Python 3.12 only, on pushes to main and on pull requests. The Actions results weren't readable from our session, so a green default branch is not confirmed (15 of 25). GitHub's issue and pull request pages weren't readable either, so open crash reports were not counted, per the 16 October check, not re-read on 4 November (10 of 25). CHANGELOG.md now has a dated entry for each SDK release from 2.0.1 to 2.0.13 and labels the 2.0.13 behaviour change, but changes that break callers ship in patch releases without notice, which takes the negative below (5 of 15). Version 2.0.13 (15).

EverOS 47

Framework reading for software the owner runs. The local server has no authentication and no security scheme in the OpenAPI document, relying on a 127.0.0.1 bind by default (15 of 30). No read-only mode; the cloud purge is two-step (8 of 20). Memories are extracted from conversations and returned into prompts, and everos-mcp tells hosts to save facts unprompted, with no injection guidance found (4 of 15). Structured logs and lock metrics, no audit log (6 of 15). SECURITY.md with a reporting address, five-day acknowledgement, supported versions and a published-advisories section, plus a valid security.txt (14 of 20). Total 47.

Hy Memory 37

Local-software reading, as for LangMem and Graphiti. The SDK holds no credential of its own and opens no port. LLM and embedder keys come from the environment or a .env file. Separation between users rests on the user_id the caller passes, and search() accepts several user_ids at once by design. The bundled python -m hy_memory.server, which the OpenClaw plugin starts, listens on 127.0.0.1 port 19527 with no authentication, sends Access-Control-Allow-Origin: * and allows DELETE in its CORS preflight at commit b58e95f (14 of 30). No read-only mode. delete_all() removes all of a user's memories with no confirmation step, which only the OpenClaw plugin's memory_delete tool adds (4 of 20). Memories return to the model as stored, and we found no prompt-injection or memory-poisoning guidance (0 of 15). On by default, history.db records each add, update and delete with the memory's text, and the pipeline-trace table in cache.db keeps extraction prompts and responses. Since 2.0.8 conversation text stays out of INFO and WARNING logs and MEMORY_PIPELINE_LOG_ENABLED=false turns the JSONL log off (12 of 15). SECURITY.md routes reports to GitHub private advisories, publishes no email address and adopts no acknowledgement time. No security.txt on memory.hunyuan.tencent.com or www.tencent.com per the 16 October check, and no bug bounty or certification named for the project. OSV lists no advisory for hy-memory on 4 November (7 of 20).

EverOS 71

Apache-2.0 with a NOTICE file (30). Local data stays in the owner's Markdown and indexes. For the cloud, the privacy policy gives no retention periods, the terms and privacy policy word the training exceptions differently, and the privacy contact link points to a miromind.ai address (12 of 30). The README marks /api/v1 as a legacy alias that may be removed in a future major release, and a 1.0 migration guide exists, with no notice period (14 of 20). No outbound telemetry was found in the source, and the docs don't address it (10 of 20). Total 66.

Hy Memory 63

Apache-2.0 in LICENSE and in pyproject.toml at 2.0.13. CHANGELOG.md says 2.0.1 kept the MIT licence metadata it was published with and 2.0.2 carries Apache-2.0, and the 1.x releases went out with MIT metadata per the 16 October check. The OpenClaw plugin source (1.1.10) says Apache-2.0, while the npm package openclaw-hy-memory 1.2.4 was marked MIT per the 16 October check, not re-read on 4 November (25 of 30). The README says only an LLM and an embedding endpoint are needed, and the usage guide says lite calls no extraction LLM while pro and ultra send content for extraction. Nothing says in one place what the SDK keeps on disk. Since 2.0.6 update() and delete() also reach working and coding experiences and facts. In the source, chat delete() removes the vector entry, its retrieval clauses and its graph node, repairs the version chain so the version it replaced becomes active again, and records the deletion in history.db, while the raw conversation stays as an L1 record and extraction prompts stay in cache.db. 2.0.10 trims assistant and tool turns in stored raw conversations (10 of 30). No deprecation policy. The 2.0.5 default change to coding search and the 2.0.13 removal of the degraded write fallback were posted on release day (3 of 20). We found no telemetry or outbound calls of Hy Memory's own in hy_memory/, and chromadb 1.5.9 in uv.lock pulls in no PostHog client. Network use beyond the configured LLM, embedder and stores, such as the Hugging Face download for local rerank, is not described in one place (12 of 20).

EverOS 78

Read for the API, with seven MCP tools on top. Searches take top_k and a method, and responses can be scoped by five ids (20 of 25). Filters nest with AND and OR, and /get pages results (18 of 20). Errors carry typed codes and say which are retryable (16 of 20). add is queued and returns 202, a busy session refuses deletion with nothing deleted, and the cloud purge needs a nonce confirmed within five minutes (12 of 20). A demo runs with no key and the minimal setup needs one OpenRouter key, with a Python library and the MCP server, one language (12 of 15). Total 78.

Hy Memory 72

Read as a library with the API lines. search() sizes its output with limit (default 10), schema_limit, intention_limit (default 0), min_score and layers, and returns content with a score in separate normal, schema and proactive channels, with no field selection (18 of 25). Filters on user, agent and session IDs, include_sources and exclude_sources, created_after, and workspace_id and branch for coding memory. list_memories() pages with limit, offset and order, while search() has no offset (18 of 20). Invalid arguments raise ValueError with a message, and since 2.0.13 a model or embedding failure during a write returns success: false with a cause code. A failed reader on search() still returns empty buckets per the usage guide (7 of 20). Since 2.0.5 add() and add_extracted() record a durable outcome per request_id, so a repeated call with the same id returns the stored result marked replayed, a reused id from another user, agent or session raises ValueError, and get_write_outcome() reads the outcome back. update() and delete() by ID are safe to repeat (20). One constructor works with only OPENAI_API_KEY set, defaulting to gpt-4.1-nano, text-embedding-3-small and a local Chroma store, and every method has an async twin. Python only (9 of 15).