EverOS vs TencentDB Agent Memory

EverOS 79

Local-software lines, as a library and server the owner runs. everos on PyPI with Python 3.12 or newer stated, plus a Windows guide (20). ci.yml runs on pushes and pull requests and the repository has a tests tree, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 43 open issues and pull requests against 82 commits in 90 days; several outside bug reports, including a silent capture failure in the DSH plugin, have no reply (14 of 25). Keep a Changelog with semantic versioning declared and a 1.0 migration guide (15). Version 1.5.1 (15). Total 79.

TencentDB Agent Memory 51

Local-software reading, as software the owner runs. Official multi-architecture images (amd64 and arm64) on Docker Hub's agentmemory account, named in the changelog, with Node 22.16 or later stated for the plugin and Python 3.9 or later for the SDK. Setup still needs a git clone for the start scripts, which pull :latest (18 of 20). Vitest suites are declared in the package files. The one CI workflow, pr-ci.yml, runs on pull requests to the main branch (the OpenClaw plugin) and installs, packs and checks the manifest, package size and skill-queue isolation without running the test suites, and nothing runs on the default branch, now feat/server_team. GitHub's Actions pages weren't readable, so no result was read (8 of 25). GitHub issues weren't readable, so open crash reports weren't counted. The changelogs list fixes for empty recall, lost memories, duplicated history and a Knowledge service that failed to start on OpenTelemetry drift, and outside pull requests (#31, #59, #79, #85) were merged into the plugin (8 of 25). Keep a Changelog with SemVer declared and upgrade notes, such as backend switches not migrating data and a v2 to v3 migration tool, but three version streams disagree (image tags 1.0.x for releases 2.0.x, the npm plugin at 1.0.3 while main's changelog stops at 0.3.6) and ROADMAP.md still says 2.0.1-beta.1 is current on 4 November (9 of 15). Release 2.0.3, but the README heads the Hub 'Team Memory Beta' and the SDKs are beta-only (8 of 15).

EverOS 89

OpenAPI document in the repository with 40 operations, every one with a description (25). llms.txt and llms-full.txt on docs.evermind.ai (10). Operation descriptions state purpose; when-not-to-use guidance appears in the docs, such as flush after add, rather than per operation (15 of 20). Typed request models with filter operators eq, ne, gt, gte, lt, lte and in, and 422 on malformed ids (12 of 15). curl examples for add, flush and search, and typed error codes such as SESSION_BUSY and EXTERNAL_SERVICE_UNAVAILABLE (12 of 15). /api/v2 with /api/v1 kept as a legacy alias, a changelog and release notes (15). Total 89.

TencentDB Agent Memory 61

API reading for a self-hosted HTTP service. The Knowledge service has an OpenAPI 3.0.3 file of 28 paths with no security scheme. Memory Core's 109 endpoints and the proxy's routes are described only in Markdown references, and the proxy's main LLM paths are outside them (10 of 25). No website and no llms.txt. The docs are Markdown in the repository and readable raw (5 of 10). Each Core endpoint states what it does, its limits and caveats, such as which deletes skip user checks, and Knowledge's tool list marks its tools read-only. The API references and the changelog are in Chinese; the README and install guide are in English (11 of 20). Zod-checked inputs with bounds (1 to 100 messages, 8,192 characters per message, limit up to 100) and enums for atom types, but the reference records that version comes back as a string from atomic/update and a number from query (10 of 15). Worked request and response examples per endpoint and error tables per module, with the three different error-message formats set out (12 of 15). /v3 paths with v1 and v2 routes listed as deprecated, and a dated public changelog for every release since 0.1.0 (13 of 15).

EverOS 40

Self-hosted rule, with the price lines read for EverOS Cloud. No x402, MPP or L402 (0 of 40). No cloud price or plan found on evermind.ai, its FAQ, terms or docs (0). The open-source runtime is free with no card (20). An agent can install it from PyPI and run it with no account (20). Total 40.

TencentDB Agent Memory 60

Read with the self-hosted rule. MIT software with nothing to buy from Tencent, so 20 for pricing, 20 for a free start and 20 for use without an account. No x402, MPP or L402 (0). Memory extraction, wiki and code-graph building and the proxied model are paid to whichever LLM provider the owner configures.

EverOS 47

Framework reading for software the owner runs. The local server has no authentication and no security scheme in the OpenAPI document, relying on a 127.0.0.1 bind by default (15 of 30). No read-only mode; the cloud purge is two-step (8 of 20). Memories are extracted from conversations and returned into prompts, and everos-mcp tells hosts to save facts unprompted, with no injection guidance found (4 of 15). Structured logs and lock metrics, no audit log (6 of 15). SECURITY.md with a reporting address, five-day acknowledgement, supported versions and a published-advisories section, plus a valid security.txt (14 of 20). Total 47.

TencentDB Agent Memory 35

Read as self-hosted software with a network API. Per-user sk-mem- keys, several per user and revocable, and OAuth2 for panel login. Against that, Memory Core's bearer gate is off by default and the .env template says setting it breaks the proxy's auth and session setup, the data plane takes team, agent and user IDs from the caller and needs only x-tdai-service-id, the proxy's rate-limit and session admin routes have no authentication, /v3/instance/destroy rests on the same unset bearer, the deploy README's defaults include an admin key, and the start scripts publish every port on all interfaces (8 of 30). Private-by-default assets with team, restricted and agent visibility, ACLs by user, role and agent, and read-only Knowledge tools. Data-plane deletes and chat-memory/clear make no user-level check and nothing asks for confirmation. Asset reads were scoped to the caller only in 2.0.2, and Agent and Task reads only in an unreleased commit of 28 October (8 of 20). The proxy injects stored memory, skills, imported documents and code into the system prompt, and we found no guidance on prompt injection or memory poisoning. Personal skills are private until shared after review (3 of 15). Participation logs, memory-generation logs and the raw L0 record let the operator trace what was written, and per-call analytics to ClickHouse is available but off by default (9 of 15). CONTRIBUTING.md asks for vulnerability reports by email to agentmemory@tencent.com rather than public issues, with no acknowledgement time, so a disclosure route without a stated time (7). No SECURITY.md on any branch, no security.txt on www.tencent.com, and no bounty or audit named. The npm plugin's postinstall runs a bash script that rewrites OpenClaw's installed files, with output sent to /dev/null. Two access-control fixes in 2026 are under the negative events.

EverOS 78

Read for the API, with seven MCP tools on top. Searches take top_k and a method, and responses can be scoped by five ids (20 of 25). Filters nest with AND and OR, and /get pages results (18 of 20). Errors carry typed codes and say which are retryable (16 of 20). add is queued and returns 202, a busy session refuses deletion with nothing deleted, and the cloud purge needs a nonce confirmed within five minutes (12 of 20). A demo runs with no key and the minimal setup needs one OpenRouter key, with a Python library and the MCP server, one language (12 of 15). Total 78.

TencentDB Agent Memory 68

Read with the API lines. limit defaults of 5 or 20 up to 100, recall.maxResults 5, and character budgets and a token ratio for what the proxy injects, but no field selection, and the proxy adds memory to every request's system prompt whether or not the agent asks (16 of 25). limit and offset on list and query routes, {items, total} on meta lists, filters by session, time range, atom type and team, agent, user and task IDs (18 of 20). HTTP codes with documented meanings (400, 401, 403, 404, 409, 422, 429, 503), but three message formats by module, /v3/meta/auth/verify answering 200 with valid: false for a bad key, and tools/call failing as HTTP 500 inside a code: 0 envelope (12 of 20). Wiki and code-graph creation and knowledge upserts are idempotent by name or repository, while /v3/session/add is documented as not idempotent and conversation/add takes no idempotency key (10 of 20). Zero-configuration defaults and an interactive start script, official TypeScript and Python SDKs in beta, and agents join by changing a base URL. Header preselection for Hermes and OpenClaw needs a task ID made in the panel first (12 of 15).

EverOS 80

v1.5.1 on 22 October 2026 (30). Five tagged releases in 90 days and 12 PyPI uploads (20). Maintainer replies on some issues, others from outside users unanswered for weeks (12 of 25). Python library and the everos-mcp package, not in the official MCP registry (10 of 15). uv.lock, CI, docs and release workflows (8 of 10). Total 80.

TencentDB Agent Memory 70

Release 2.0.3 on 26 October 2026 by the changelog and its tag, 9 days before this check (30). Six changelog releases in the 90 days from 6 August, 2.0.1-beta.1 (13 August), 2.0.1 (25 August), 2.0.2-beta.1 (7 September), 2.0.2 (9 October), 2.0.3-beta.1 (13 October) and 2.0.3, with image tags v1.0.2 (8 September) and v1.0.3 (22 September) between. The three stable releases 2.0.1, 2.0.2 and 2.0.3 meet the line without the pre-releases, which this run doesn't count (20). GitHub issues and pull requests weren't readable, so reply times weren't judged. The plugin changelog credits fixes to numbered issues and outside pull requests, and the README says issues get a reply within 24 hours, which we couldn't check. A workflow added on 28 October posts an automatic acknowledgement on new external pull requests, which isn't a maintainer reply (10 of 25). Official TypeScript and Python SDKs exist but only as betas, the TypeScript one last published on 14 August 2026, and the Python package name differs between the changelog and its pyproject. No MCP server, so the registry line doesn't apply (6 of 15). npm packages carry registry signatures but no provenance attestations, the deploy pulls :latest images, the one CI workflow skips the tests and doesn't run on the default branch, and 2.0.3 fixed a Knowledge service broken by OpenTelemetry dependency drift (4 of 10).