Graphiti vs Memori

Graphiti 65

graphiti-core v0.31.2 tagged on 20 October 2026. The release workflow publishes to PyPI on each v tag, and pypi.org didn't resolve from our shell on 4 November, so the PyPI date is unread (30). Core tags since 6 August are v0.30.0 (1 September), v0.30.2 (8 September), v0.31.0 (14 October), v0.31.1 (15 October) and v0.31.2 (20 October), with MCP server tags mcp-v1.1.0 to mcp-v1.1.3 (20). Responsiveness per the 1 October check, not re-read on 4 November (10 of 25). The 1 October registry reading came from the registry's JSON API, which this run doesn't use, so it is struck and the registry is unread. It earned 0 either way (0). Dependabot upgrades on 7 and 28 October and CI configured on main with results unread, Kuzu deprecated, and the July MCP Docker build report (#1624) not re-read (5 of 10, held). 30 + 20 + 10 + 0 + 5 = 65.

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Graphiti 50

Scored on the local-package checklist. graphiti-core installs from PyPI with Python 3.10 to below 4 stated in pyproject.toml (20). unit_tests.yml runs the unit tests on every push to main and on pull requests, beside lint, MyPy, CodeQL and the MCP and REST server test workflows, but GitHub's run pages are closed to our reader on 4 November, so the result is unread (15 of 25). Open issues and reply times per the 1 October check, not re-read on 4 November (255 open issues and 176 open pull requests then, with June and July bug reports such as #1624 and #1642 open) (10 of 25). Every release is tagged in the repository (v0.30.0, v0.30.2, v0.31.0, v0.31.1 and v0.31.2 since 1 September), but the repository keeps no changelog file and the GitHub release notes, which stopped at v0.29.2 on 1 October, couldn't be read on 4 November (5 of 15). Version 0.31.2, below 1.0 (0). 20 + 15 + 10 + 5 + 0 = 50.

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

Graphiti 73

Apache-2.0 (30). Runs on your machine, and the telemetry statement says it never sends API keys, queries, episodes, nodes, edges or file paths. Your data goes to the LLM provider you configure (20 of 30). Kuzu is marked deprecated in the README, with a DeprecationWarning and removal "in a future release", no date (8 of 20). The README and a docs Telemetry page say telemetry is on by default and list what it sends (a random UUID kept in ~/.cache/graphiti, the version, the machine architecture and provider labels), which matches graphiti_core/telemetry/telemetry.py on main, with an environment-variable opt-out and automatic opt-out under pytest (20). 30 + 20 + 8 + 20 = 78.

Memori 52

Apache-2.0 per the LICENSE text, though GitHub reports it as NOASSERTION (30). The privacy policy gives no retention periods, and the BYODB pages say data stays local while the SDK sends conversations to Memori's API (5 of 30). Changelog entries but no deprecation policy or notices (5 of 20). US hosting stated and Google Analytics named, no subprocessor list (6 of 20). Total 46.

Graphiti 27

Scored for a framework you run yourself. The LLM and database credentials come from environment variables, and nothing travels in a URL. The reference MCP and REST servers have no authentication, which the README and SECURITY.md (19 October) now state, and since MCP server 1.1.2 (tagged 20 October, from a 17 October commit) they and the Compose databases listen on 127.0.0.1 by default (15 of 30, held). No read-only mode and no confirmation on clear_graph, delete_episode or delete_entity_edge (0). SECURITY.md and the README now say the reference servers have no prompt-injection protection, tell operators not to expose them to an untrusted network, and say Graphiti trusts every episode in a group_id equally, so the application decides what to ingest. Guidance with no mitigations (5 of 15, was 0). No audit log of tool calls found (0). SECURITY.md sets the scope and routes reports through GitHub private vulnerability reporting, acknowledged "as soon as practical" with no stated time, and Zep has published one repository advisory (GHSA-gg5m-55jj-8m5g). No bug bounty or security.txt. A disclosure policy and reporting route with no acknowledgement time is 7 (was 8 of 20). Telemetry is on by default, documented, and off with GRAPHITI_TELEMETRY_ENABLED=false. 15 + 0 + 5 + 0 + 7 = 27.

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.

Graphiti 60

Free Apache-2.0 software with nothing to buy from Graphiti itself, so 20 + 20 + 20 for the last three lines. No payment protocol (0). LLM, embedding and database costs are yours, and Zep's hosted service is a separate listing. 0 + 20 + 20 + 20 = 60.

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.

Graphiti 51

13 MCP tools (15), with no toolsets or read-only subset. Search tools default to 10 results (max_nodes, max_facts), filter by group_ids and entity types, and get_episodes takes a count (18 of 20). Error shapes aren't documented and we didn't test them (8 of 20). None of the 13 tools in graphiti_mcp_server.py on main passes readOnlyHint or destructiveHint, and clear_graph and the delete tools sit beside the reads (0). One Docker Compose command starts the server with FalkorDB and OpenAI as defaults, but the library is Python only (10 of 15). 15 + 18 + 8 + 0 + 10 = 51.

Memori 65

Seven MCP tools with short parameter lists (22 of 25). Recall filters by project, session, date range and source (14 of 20). 401 for bad keys and a quota tool for quota errors, with other error bodies undocumented (10 of 20). No idempotency guidance or tool annotations documented (4 of 20). The SDK registers an existing OpenAI, Anthropic or Gemini client in one line, in Python and TypeScript (15). Total 65.