# Graphicle vs MemMachine (slim)

> Graphicle scores 70.6 (BB) to MemMachine's 58 (C) for memory search. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/graphicle-vs-memmachine.md (~4,900 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/graphicle-vs-memmachine.json · canonical https://www.anchorterminal.com/compare/graphicle-vs-memmachine
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Graphicle scores 70.6 (BB) on agent readiness against MemMachine's 58 (C), and leads in 6 of 7 scored categories. Both do memory search.

- Graphicle: BB 70.6, rank #193 of 1510 · https://www.anchorterminal.com/tools/graphicle.min.md
- MemMachine: C 58, rank #771 of 1510 · https://www.anchorterminal.com/tools/memmachine.min.md
- Graphicle, good for A developer who wants one local tool that gives Claude Code, Codex or Cursor both code structure and project memory with citations. Ahead on Reliability, 63 against 51; Agent ergonomics, 85 against 65; Security & auth, 67 against 41; Payments & pricing, 60 against 40; Transparency & trust, 71 against 57. Also Agent-ready, a grade of BB or better; Free to start without a card.
- MemMachine, good for Self-hosted memory for agent frameworks that want episodic and profile memory with many integrations. Also No key needed to call it.

| Category | Graphicle | MemMachine |
| --- | --- | --- |
| Reliability (16%) | 63 | 51 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 79 |
| Agent ergonomics (13%) | 85 | 65 |
| Security & auth (14%) | 67 | 41 |
| Payments & pricing (10%) | 60 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 83 | 83 |
| Transparency & trust (7%) | 71 | 57 |

| Fact (where they differ) | Graphicle | MemMachine |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | KarLex AI, Inc. | MemVerge, Inc. |
| Transports | stdio, Streamable HTTP | HTTP, stdio, Streamable HTTP |
| Auth | OAuth or key | None |
| Pricing | Free | Freemium |
| Tools exposed | 25 | 3 |
| llms.txt | no | yes |
| MCP registry | `io.github.Graphicle-AI/graphicle` | not listed |
| Last release | 2026-10-30 | 2026-10-08 |
| Terms last updated | 2025-03-14 | no date given |
| Privacy policy last updated | 2025-03-14 | 2026-05-20 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | not found in the text | yes |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 144 stars | 3.1k stars, 28 npm/wk, 581 PyPI/wk |
| Agent reviews | 3.8/5 (4) | none |

Why the edge:
- Security & auth, Graphicle +26: Graphicle 67 (Read with the API checklist for a server the owner runs, as for Cognee and Graphiti. Over HTTP each person or agent gets its own key with a role, optional expiry and optional project list, stored as a hash, revocable, and sent in a header with the docs saying never in the URL. The stdio server runs with the owner key, which can read every project, and its graph tools take `repo` to reach other projects (24 of 30). The MCP server has no delete or command tool, agent writes are drafts that a person approves, and `--tools` and per-key project revocation narrow access. No approval step is needed because nothing destructive is exposed (18 of 20). Recall returns documents, connector content and captured sessions, which can carry injected text. Server instructions say memory is evidence, not tool permission, drafts need verbatim quotes, and capture redacts credentials and drops `<private>` spans. No general prompt-injection guidance found (9 of 15). Workspace usage counters, `workflow_status` and hash-chained deletion receipts, while the team audit trail belongs to the commercial edition (6 of 15). SECURITY.md with private reporting through GitHub advisories, a security.txt at karlex.ai valid to 7 April 2027 (re-read on 1 November), a cargo-deny advisory check in CI that failed on 15 October, and `### Security` sections in the 0.1.6 and 0.1.7 changelog entries. No bug bounty or certification, and the changelog names no advisory for the 0.1.7 fixes (10 of 20). 24+18+9+6+10 = 67.); MemMachine 41 (Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.)
- Agent ergonomics, Graphicle +20: Graphicle 85 (25 tools with memory proposals on, about 24,600 characters of definitions in the v0.1.10 fixture (15). `--tools essentials` serves five tools (`recall_project`, `read_project_source`, `query_graph`, `get_node`, `get_neighbors`, about 7,400 characters) and is what `graphicle setup` gives Claude Code; `--tools graph` or `--tools memory` serves one half, and leaving out `--allow-learning` leaves only read tools plus `graph_link` (10 added back, up from 7 on 15 October, for the essentials set). `recall_project` takes `max_tokens` or `max_chars`, `include` prefixes and `skip_shown`, `query_graph` takes `token_budget` and `depth`, and `list_projects` pages with `offset` and `limit` (20). Over-limit projects are refused with a message naming the limit and its setting, 409 marks a stale revision and 429 carries Retry-After, and since 0.1.7 the Python SDK keeps `retry_after` on its error. MCP error shapes are not documented (12 of 20). 21 tools carry readOnlyHint true and 4 false, all with idempotentHint true and destructiveHint false, there are no destructive tools, and `propose_memory` requires an `idempotency_key` that replays the same proposal (20). Only `question` is required on recall and graph queries. Python and TypeScript SDKs exist, at 0.1.10, but install only from source (8 of 15). 25+20+12+20+8 = 85.); MemMachine 65 (Searches take limit and filter options for episodic and semantic results (20 of 25). Memories can be listed and filtered by scope (15 of 20). Validation errors are typed; other failures are less clear, as the 429-to-500 issue shows (10 of 20). No idempotency keys or safe-retry guidance found (5 of 20). Python and TypeScript clients and a five-line quick start, once the import is fixed (15). Total 65.)
- Payments & pricing, Graphicle +20: Graphicle 60 (No payment protocol (0). Read with the self-hosted rule. Free under Apache-2.0 with nothing to buy (20). No card or account (20). An agent can install it and run `graphicle setup --yes` with no signup, as the README suggests (20). The commercial team edition is still in private preview with no prices on karlex.ai on 1 November, so there is no paid option to score. 0+20+20+20 = 60.); MemMachine 40 (Self-hosted rule, with the price lines read for the hosted platform. No x402, MPP or L402 (0 of 40). No hosted prices found on the site or docs (0). Free to self-host with no card (20). An agent can install it from PyPI with no account (20). Total 40.)
- Transparency & trust, Graphicle +14: Graphicle 71 (Apache-2.0 with NOTICE files that credit Graphify and every adapted project (30). The README privacy section and the FAQ list every case in which the program uses the network, say there is no telemetry or account, and keep data in one SQLite store with deletion receipts. A grep of the source for outbound hosts found only model providers, connectors and GitHub, which agrees. The karlex.ai privacy policy of 14 March 2025 covers the website, not the software (20 of 30). SECURITY.md lists supported versions. No deprecation policy (3 of 20). No telemetry to opt out of, and the network cases are disclosed, with `freshness off` and `--code-only` to limit them (18 of 20). 30+20+3+18 = 71.); MemMachine 57 (Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.)
- Reliability, Graphicle +12: Graphicle 63 (Read as local software. Installs from an official Homebrew tap, an install script that checks each archive's SHA-256, or release archives, with macOS and Linux (glibc) on arm64 and x86_64 stated, and since 0.1.5 a Windows preview build that isn't code-signed. No language package registry (20). A public CI workflow formats, lints and tests each of the three crates on macOS and Linux. On 15 October every test job passed on both pushes to main and the cargo-deny job for licences, advisories and sources failed; 0.1.7 (25 October) replaced a yanked crate that cargo-deny warned about, but GitHub's Actions pages weren't readable on 1 November, so the runs are per the 15 October check (18). Outside reports and fixes have been handled in releases (issue #8 on kubernetes speed, pull requests #9 and #10 in 0.1.6 and 0.1.7), but the open issue list couldn't be read on 1 November, so the record is still too thin to judge (15). A dated changelog with eleven releases, each with an "After upgrading" section that names the steps a release needs (re-sync, memories that go stale), but large additions and stored-data changes ship in 0.1.x patch bumps (10). Version 0.1.10, not declared stable (0). 20+18+15+10+0 = 63.); MemMachine 51 (Local-software lines, as a server the owner runs. `memmachine-server` and `memmachine-client` on PyPI with Python versions stated, a Docker image and a compose script (20). pytest, integration and installation-test workflows exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 292 open issues and pull requests; the newest bug reports, including a 429 from a provider surfacing as a 500 and a 0.4.0 configuration that no longer starts, have zero to two replies (10 of 25). No changelog file, release notes only on GitHub, which weren't read, and pre-1.0 tags (6 of 15). Version 0.4.0 (0). Total 51.)