Agent Platform Memory Bank vs Graphiti

Agent Platform Memory Bank 72

OAuth 2.0 with IAM and service accounts (30), less 10, as for the other Google API listings, because the v1 discovery document lists access_token, oauth_token and key as query parameters (20 of 30). IAM Conditions can restrict access by memory scope; purge and delete have no confirmation (15 of 20). Memories are written by an LLM from conversation content and returned to agents, with no injection guidance found (5 of 15). Access Transparency and Access Approval are listed; Cloud Audit Logs coverage for Memory Bank wasn't read (12 of 15). Google's valid security.txt, vulnerability reward programme and certifications, with HIPAA listed for Memory Bank (20). Total 72.

Graphiti 27

Scored for a framework you run yourself. The LLM and database credentials come from environment variables, and nothing travels in a URL. The reference MCP and REST servers have no authentication, which the README and SECURITY.md (19 October) now state, and since MCP server 1.1.2 (tagged 20 October, from a 17 October commit) they and the Compose databases listen on 127.0.0.1 by default (15 of 30, held). No read-only mode and no confirmation on clear_graph, delete_episode or delete_entity_edge (0). SECURITY.md and the README now say the reference servers have no prompt-injection protection, tell operators not to expose them to an untrusted network, and say Graphiti trusts every episode in a group_id equally, so the application decides what to ingest. Guidance with no mitigations (5 of 15, was 0). No audit log of tool calls found (0). SECURITY.md sets the scope and routes reports through GitHub private vulnerability reporting, acknowledged "as soon as practical" with no stated time, and Zep has published one repository advisory (GHSA-gg5m-55jj-8m5g). No bug bounty or security.txt. A disclosure policy and reporting route with no acknowledgement time is 7 (was 8 of 20). Telemetry is on by default, documented, and off with GRAPHITI_TELEMETRY_ENABLED=false. 15 + 0 + 5 + 0 + 7 = 27.

Agent Platform Memory Bank 20

No x402, MPP or L402 (0). Storage, read and write prices are published without a login (20). No Memory Bank free tier found (0). A person creates the project, enables billing and sets up IAM in the console (0). Total 20.

Graphiti 60

Free Apache-2.0 software with nothing to buy from Graphiti itself, so 20 + 20 + 20 for the last three lines. No payment protocol (0). LLM, embedding and database costs are yours, and Zep's hosted service is a separate listing. 0 + 20 + 20 + 20 = 60.

Agent Platform Memory Bank 75

Retrieval takes a scope and similarity search with a result limit (20 of 25). List methods page with page tokens and filters (16 of 20). Google's standard error model with status codes (15 of 20). Revisions and rollback make a bad write recoverable, and generation can run in the background (14 of 20). Python SDK and ADK integration, with REST for other languages (10 of 15). Total 75.

Graphiti 51

13 MCP tools (15), with no toolsets or read-only subset. Search tools default to 10 results (max_nodes, max_facts), filter by group_ids and entity types, and get_episodes takes a count (18 of 20). Error shapes aren't documented and we didn't test them (8 of 20). None of the 13 tools in graphiti_mcp_server.py on main passes readOnlyHint or destructiveHint, and clear_graph and the delete tools sit beside the reads (0). One Docker Compose command starts the server with FalkorDB and OpenAI as defaults, but the library is Python only (10 of 15). 15 + 18 + 8 + 0 + 10 = 51.

Agent Platform Memory Bank 68

Hosted lines. Google Cloud status dashboard with per-product history (20). Its incident feed, read on 6 November 2026, holds four incidents since 8 August (20 August, 27 products; 1 September, us-central1-b; 8 October, Cloud Storage; 20 October, europe-west2, 38 products), and none names Agent Platform, Vertex or Memory Bank (30). No Memory Bank quotas or rate limits were found; the platform quotas path guessed returned 404 (0, unchecked). Generation is a long-running operation with wait and cancel methods, and Google's retry guidance wasn't re-read for this API (8 of 15). No SLA for Memory Bank was found in the pages read (0, unchecked). Memory profiles, IngestEvents and multi-regional endpoints are GA (10). Total 68.

Graphiti 50

Scored on the local-package checklist. graphiti-core installs from PyPI with Python 3.10 to below 4 stated in pyproject.toml (20). unit_tests.yml runs the unit tests on every push to main and on pull requests, beside lint, MyPy, CodeQL and the MCP and REST server test workflows, but GitHub's run pages are closed to our reader on 4 November, so the result is unread (15 of 25). Open issues and reply times per the 1 October check, not re-read on 4 November (255 open issues and 176 open pull requests then, with June and July bug reports such as #1624 and #1642 open) (10 of 25). Every release is tagged in the repository (v0.30.0, v0.30.2, v0.31.0, v0.31.1 and v0.31.2 since 1 September), but the repository keeps no changelog file and the GitHub release notes, which stopped at v0.29.2 on 1 October, couldn't be read on 4 November (5 of 15). Version 0.31.2, below 1.0 (0). 20 + 15 + 10 + 5 + 0 = 50.

Agent Platform Memory Bank 81

Closed service under the Google Cloud terms (15). Data residency at rest, CMEK and the Cloud Data Processing Addendum apply; no Memory Bank retention period or time-to-live was read (20 of 30). The rename was announced in the release notes with old and new names listed, and Google's deprecation policy covers GA services (14 of 20). Google Cloud's subprocessor list and regional endpoints are published (16 of 20). Total 65.

Graphiti 73

Apache-2.0 (30). Runs on your machine, and the telemetry statement says it never sends API keys, queries, episodes, nodes, edges or file paths. Your data goes to the LLM provider you configure (20 of 30). Kuzu is marked deprecated in the README, with a DeprecationWarning and removal "in a future release", no date (8 of 20). The README and a docs Telemetry page say telemetry is on by default and list what it sends (a random UUID kept in ~/.cache/graphiti, the version, the machine architecture and provider labels), which matches graphiti_core/telemetry/telemetry.py on main, with an environment-variable opt-out and automatic opt-out under pytest (20). 30 + 20 + 8 + 20 = 78.