Agent Platform Memory Bank vs LocalGhost

Agent Platform Memory Bank 20

No x402, MPP or L402 (0). Storage, read and write prices are published without a login (20). No Memory Bank free tier found (0). A person creates the project, enables billing and sets up IAM in the console (0). Total 20.

LocalGhost 60

Read with the self-hosted rule, as the Khoj dossier did. Nothing is on sale. Pre-built boxes are planned at the cost of parts plus a 30 per cent margin with no price set, and the README's Ethereum donation address isn't a payment protocol on the tool's endpoints (0). Free under MIT with no account and no card, so 20, 20 and 20 on the last three lines.

Agent Platform Memory Bank 75

Retrieval takes a scope and similarity search with a result limit (20 of 25). List methods page with page tokens and filters (16 of 20). Google's standard error model with status codes (15 of 20). Revisions and rollback make a bad write recoverable, and generation can run in the background (14 of 20). Python SDK and ADK integration, with REST for other languages (10 of 15). Total 75.

LocalGhost 39

Graded on the device API, as Schema is. /v1/news takes since and limit, the rate routes take hours or days and the Wikipedia route takes n, while /v1/home and /v1/rates return whole screens and nothing selects fields (12 of 25). /v1/days pages with before and limit, and /v1/wiki searches with q (12 of 20). edge.go folds every 400, 401, 403, 404 and 5xx a verified phone could get into the same 503 page, and the nginx path does the same with error_page, so the handlers' messages never reach the client and it can't tell a bad request from a locked box. Only a few statuses such as 409 pass through (2 of 20). Voice uploads are idempotent by id, /v1/lock is safe to repeat and trail deletion has a dry run, with no idempotency keys or retry guidance (10 of 20). The project's own Kotlin app is the only client, with no SDK and no documented way to enrol another (3 of 15).

Agent Platform Memory Bank 75

Google's discovery document is a machine-readable contract for every memory method (25). No llms.txt or Markdown docs found (0). Method descriptions are 13 to 39 characters, one-line summaries, while the guides explain when to generate from sessions or from direct facts (12 of 20). Typed schemas with required fields in the discovery document (12 of 15). Python examples, a troubleshooting page and a documented 404 for deleted memories (11 of 15). v1 and v1beta1 and dated release notes (15). Total 75.

LocalGhost 49

Graded on the HTTPS API that ghost.secd serves to enrolled phones under /v1, the only programmatic interface, as the Khoj and Open WebUI dossiers graded their HTTP APIs. There's no public API or MCP server, and the README and llms.txt say the box answers every other caller, an agent included, as if it were down. ghost.secd builds an OpenAPI 3.0 document from a route table and serves it at /v1/openapi.json only to enrolled devices. At v0.0.6 the table holds 49 paths while server.go registers 109 by hand (46 and 105 at v0.0.5), although the code comment says no route can exist outside the spec (8 of 25). llms.txt on www.localghost.ai and Markdown docs throughout the repository (10). Route summaries say what each call does and some say when to use it, and there's no API reference beyond them (8 of 20). Request and response shapes come from Go structs by reflection, but several shapes are marked loose with additionalProperties, request bodies among them, and query formats sit in summaries and handlers rather than in the spec (6 of 15). No API examples, and error statuses are folded into one 503 page by design, so no error responses are documented (3 of 15). /v1 prefixes, dated notes per release in server/releases/ and a dated changelog page (14 of 15).

Agent Platform Memory Bank 72

OAuth 2.0 with IAM and service accounts (30), less 10, as for the other Google API listings, because the v1 discovery document lists access_token, oauth_token and key as query parameters (20 of 30). IAM Conditions can restrict access by memory scope; purge and delete have no confirmation (15 of 20). Memories are written by an LLM from conversation content and returned to agents, with no injection guidance found (5 of 15). Access Transparency and Access Approval are listed; Cloud Audit Logs coverage for Memory Bank wasn't read (12 of 15). Google's valid security.txt, vulnerability reward programme and certifications, with HIPAA listed for Memory Bank (20). Total 72.

LocalGhost 50

Graded with the tool lines on how the phone reaches the box. Each phone holds a client certificate from the box's own CA (ECDSA P-256, no scopes) and a session token of at most 48 hours from a PIN unlock, sent in a header. Since 0.0.6 a certificate is good for two weeks and the phone renews it once a day while it talks to the box, re-signing the same key, and the QR's own certificate is good for an hour. One phone can be retired by its key since 0.0.2, and after the first unlock the phone swaps the QR's key for one it makes in the Android Keystore and the box retires the QR's certificate. That's 20 for revocable credentials with rotation and no scopes. The localghost://enroll link carries the device's certificate and private key in its query string, and we didn't take the 10 off. The Screenpipe dossier took it for a key documented as a token parameter on HTTP requests, and the Khoj dossier didn't for a key in a query string that wasn't a documented way to authenticate, so the line covers secrets in request URLs that pass through servers, proxies and logs. This link is drawn only as a QR on an interactive terminal and never printed as text (internal/pair/command.go), the app has no intent filter for the scheme and reads the QR with its own scanner, and the link never becomes a network request (20 of 30). Every enrolled phone has full owner rights, with no read-only device. Since 0.0.6 DEPLOY, ROLL BACK and LOCK BOX NOW ask for confirmation first and deleting a model, a notification, a connector or a chat takes a second tap, trail deletion has a dry run and a deploy runs on trial with automatic rollback, while the API's deletes run without a confirmation step (8 of 20). The box and phone pass news feeds, web search results, coin websites and Wikipedia text to the model, and we found no injection guidance. The daemons own the control flow, the model calls no tools, and some writers drop text carrying names or numbers not in their facts (6 of 15). Requests are logged at debug level only, and ghost-cli ghost.secd devices and Box Status show the enrolled phones and the daemons, with no per-call audit trail (5 of 15). security.txt valid to 1 October 2027, SECURITY.md with a 72-hour acknowledgement, a 14-day response, 90-day disclosure, a commitment not to take legal action and a promise to publish advisories after fixes, and a PGP key that also signs the releases. No bounty, no certification and no advisories published (11 of 20). On a fresh box ghost.secd trusts an X-Client-Cert header any local process can forge until the operator runs ghost-ctl edge-passthrough. The 0.0.5 and 0.0.6 notes list it as a known gap, since 0.0.6 secd checks a certificate's dates and retirement itself on every request, and the PIN is still needed, so it's weighed in the credential line rather than as an incident.

Agent Platform Memory Bank 62

The newest Memory Bank release notes are of 20 August 2026 (IngestEvents GA, metadata, Gemini Embedding 2), 78 days before the check, and billing started on 1 September (20). Three Memory Bank entries in the 90 days, all on 20 August (10 of 20). Public release notes and Cloud Customer Care (12 of 15). google-cloud-agentplatform 2.7.0 on 28 October 2026, twelve releases in 90 days per its PyPI release feed, plus ADK (15). SDK test status not checked (5 of 10). Total 62.

LocalGhost 79

wisp 0.0.6 tagged on 10 October 2026 (30). Six releases, v0.0.1 to v0.0.6, from 2 to 10 October, each with dated notes (20). shields.io shows 0 open and 1 closed issue and no open pull requests. Pull request #1 (July) is merged and #3 (28 July, a macOS test fix) isn't in main, and the 0.0.4 notes say most of that release answers two outside reviews of 0.0.3. GitHub's issue and pull-request pages refused us, so we couldn't see written replies or their timing (12 of 25). Not an MCP server and no SDK, read as current official builds as the Open WebUI dossier read this line. Each tag ships a signed server bundle, a signed APK and a source archive on GitHub and the mirror, with no package-manager channel, fewer channels than the PyPI, GHCR and desktop builds Open WebUI was credited 13 for (11 of 15). Go 1.27.1 since 0.0.4 and three direct Go dependencies, with golang.org/x/crypto at v0.31.0 from December 2024, no Dependabot, and the Go suite passing at v0.0.6 and on main in our run of 10 October (6 of 10).