Graphicle vs Memori

Graphicle 83

v0.1.10 on 30 October 2026 (30). Eleven releases, v0.1.0 (14 October) to v0.1.10 (30 October), all inside the last 90 days (20). Outside pull requests #9 and #10 shipped in 0.1.6 and 0.1.7 and issue #8's kubernetes timings drove 0.1.5, per the changelog, with Discussions and a Discord linked, but reply times and open issues weren't readable on 1 November (12 of 25). In the official MCP registry as io.github.Graphicle-AI/graphicle, a GitHub-verified namespace, with 0.1.10 published on 30 October and marked latest (15). The SDKs are still not on PyPI or npm. Pinned GitHub Actions, dependency-graph updates and passing tests, but the licence and advisory job failed on main on 15 October and its later runs weren't readable (6 of 10). 30+20+12+15+6 = 83.

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Graphicle 63

Read as local software. Installs from an official Homebrew tap, an install script that checks each archive's SHA-256, or release archives, with macOS and Linux (glibc) on arm64 and x86_64 stated, and since 0.1.5 a Windows preview build that isn't code-signed. No language package registry (20). A public CI workflow formats, lints and tests each of the three crates on macOS and Linux. On 15 October every test job passed on both pushes to main and the cargo-deny job for licences, advisories and sources failed; 0.1.7 (25 October) replaced a yanked crate that cargo-deny warned about, but GitHub's Actions pages weren't readable on 1 November, so the runs are per the 15 October check (18). Outside reports and fixes have been handled in releases (issue #8 on kubernetes speed, pull requests #9 and #10 in 0.1.6 and 0.1.7), but the open issue list couldn't be read on 1 November, so the record is still too thin to judge (15). A dated changelog with eleven releases, each with an "After upgrading" section that names the steps a release needs (re-sync, memories that go stale), but large additions and stored-data changes ship in 0.1.x patch bumps (10). Version 0.1.10, not declared stable (0). 20+18+15+10+0 = 63.

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

Graphicle 67

Read with the API checklist for a server the owner runs, as for Cognee and Graphiti. Over HTTP each person or agent gets its own key with a role, optional expiry and optional project list, stored as a hash, revocable, and sent in a header with the docs saying never in the URL. The stdio server runs with the owner key, which can read every project, and its graph tools take repo to reach other projects (24 of 30). The MCP server has no delete or command tool, agent writes are drafts that a person approves, and --tools and per-key project revocation narrow access. No approval step is needed because nothing destructive is exposed (18 of 20). Recall returns documents, connector content and captured sessions, which can carry injected text. Server instructions say memory is evidence, not tool permission, drafts need verbatim quotes, and capture redacts credentials and drops <private> spans. No general prompt-injection guidance found (9 of 15). Workspace usage counters, workflow_status and hash-chained deletion receipts, while the team audit trail belongs to the commercial edition (6 of 15). SECURITY.md with private reporting through GitHub advisories, a security.txt at karlex.ai valid to 7 April 2027 (re-read on 1 November), a cargo-deny advisory check in CI that failed on 15 October, and ### Security sections in the 0.1.6 and 0.1.7 changelog entries. No bug bounty or certification, and the changelog names no advisory for the 0.1.7 fixes (10 of 20). 24+18+9+6+10 = 67.

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.

Graphicle 85

25 tools with memory proposals on, about 24,600 characters of definitions in the v0.1.10 fixture (15). --tools essentials serves five tools (recall_project, read_project_source, query_graph, get_node, get_neighbors, about 7,400 characters) and is what graphicle setup gives Claude Code; --tools graph or --tools memory serves one half, and leaving out --allow-learning leaves only read tools plus graph_link (10 added back, up from 7 on 15 October, for the essentials set). recall_project takes max_tokens or max_chars, include prefixes and skip_shown, query_graph takes token_budget and depth, and list_projects pages with offset and limit (20). Over-limit projects are refused with a message naming the limit and its setting, 409 marks a stale revision and 429 carries Retry-After, and since 0.1.7 the Python SDK keeps retry_after on its error. MCP error shapes are not documented (12 of 20). 21 tools carry readOnlyHint true and 4 false, all with idempotentHint true and destructiveHint false, there are no destructive tools, and propose_memory requires an idempotency_key that replays the same proposal (20). Only question is required on recall and graph queries. Python and TypeScript SDKs exist, at 0.1.10, but install only from source (8 of 15). 25+20+12+20+8 = 85.

Memori 65

Seven MCP tools with short parameter lists (22 of 25). Recall filters by project, session, date range and source (14 of 20). 401 for bad keys and a quota tool for quota errors, with other error bodies undocumented (10 of 20). No idempotency guidance or tool annotations documented (4 of 20). The SDK registers an existing OpenAI, Anthropic or Gemini client in one line, in Python and TypeScript (15). Total 65.

Graphicle 71

Apache-2.0 with NOTICE files that credit Graphify and every adapted project (30). The README privacy section and the FAQ list every case in which the program uses the network, say there is no telemetry or account, and keep data in one SQLite store with deletion receipts. A grep of the source for outbound hosts found only model providers, connectors and GitHub, which agrees. The karlex.ai privacy policy of 14 March 2025 covers the website, not the software (20 of 30). SECURITY.md lists supported versions. No deprecation policy (3 of 20). No telemetry to opt out of, and the network cases are disclosed, with freshness off and --code-only to limit them (18 of 20). 30+20+3+18 = 71.

Memori 52

Apache-2.0 per the LICENSE text, though GitHub reports it as NOASSERTION (30). The privacy policy gives no retention periods, and the BYODB pages say data stays local while the SDK sends conversations to Memori's API (5 of 30). Changelog entries but no deprecation policy or notices (5 of 20). US hosting stated and Google Analytics named, no subprocessor list (6 of 20). Total 46.

Graphicle 83

Every MCP tool has a JSON Schema input with additionalProperties: false and required fields marked, read from the tool list fixtures in the repository at v0.1.10 (25). No llms.txt. The docs are Markdown files in the repository that an agent can read raw (5 of 10). Server instructions say which tool to use for structure and which for what the project says, recall_project says when to leave the reranker off, and memory tools explain draft review, while graph tools such as query_graph carry one-line descriptions (14 of 20). Enums on mode, pack_order, memory kind and state, length and item limits, minimum values and closed nested objects (14 of 15). Examples throughout the docs. The OpenAPI file documents 400, 403, 409 and 429 for the HTTP API and limit errors name the setting to change, but MCP error results are not catalogued (10 of 15). A dated changelog, semver crate versions and /v1 paths (15). 25+5+14+14+10+15 = 83.

Memori 68

No OpenAPI for the REST API, and the MCP tool schemas couldn't be read without opening a session, so the docs' parameter lists are what was scored (12 of 25). llms.txt with Markdown docs for both modes (10). Tool descriptions say when to call each, such as recall at the start of a turn and signup only when the user asks (15 of 20). Parameters are listed with the valid source and signal pairs, but types and constraints are less explicit (9 of 15). Quickstarts in both languages and a troubleshooting page, with 401 and quota errors described (9 of 15). Keep a Changelog with semantic versioning (13 of 15). Total 68.