Hindsight vs Memori

Hindsight 80

Tag v1.2.0 on 3 November 2026, the day before the check (30). Ten core releases since 6 August, v0.9.0 (7 August), v0.9.1 (14 August), v0.9.2 (25 August), v0.10.0 to v0.10.3 (14 September to 8 October), v1.0.0 (13 October), v1.1.0 (21 October) and v1.2.0 (20). We didn't check issue reply times on GitHub (10 of 25). Current clients for Python, TypeScript and Go, though the hosted MCP isn't in the official registry (15). Python 3.11 or later, and a test workflow in the repository whose result we couldn't read (5 of 10).

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Hindsight 65

Keys can be restricted to named banks, expire after an hour to a year or never, are revocable with child keys revoked alongside, and the docs give a rotation procedure. The hosted MCP uses OAuth with PKCE under RFC 9728, or a Bearer key (30). Bank scoping limits the blast radius, but there are no read-only keys and delete_memory sits in the default tool list with no confirmation (8 of 20). Memory Defense screens every retain before storage. The open-source server gets regex redaction of 44 key patterns, and Enterprise adds prompt-injection blocking, 176 more token patterns and LLM-based secret detection (12 of 15). Security audit trails and SIEM webhooks are Enterprise only (5 of 15). These four lines per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page). SECURITY.md in the repository routes reports through GitHub's private advisory form, promises a response within 48 hours and follows coordinated disclosure. No security.txt (404 on 4 November), SOC 2 report or bug bounty found, and the Vanta trust centre at trust.vectorize.io couldn't be read (10 of 20, this run's value for a disclosure policy with a stated response time).

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.

Hindsight 30

No x402, MPP or L402. Calls on an empty balance return 402 with no payment payload (0). Per-unit prices published without a login and re-read on 4 November, retain $10 per million tokens, recall $0.75 per million, reflect $0.05 a call, Iris Extract $7.50 per million, mental model retrieval $0.25 per million and refresh $0.05 a call, storage $0.25 per million tokens a month after the first 30 days (20). The pricing page says new accounts start with $5 of free credit; whether a card is needed isn't stated (10 of 20). A person signs up in the browser to get a key (0).

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.

Hindsight 78

OpenAPI spec at hindsight.vectorize.io/openapi.json, linked from the open-source docs' llms.txt (25). llms.txt and llms-full.txt on hindsight.vectorize.io, with links to the quick start, SDKs, API reference, OpenAPI file and MCP page (10). Tool names follow the three verbs (retain, recall, reflect) and the docs explain each, but with 27 tools the when-not-to-use guidance is thin (12 of 20). Typed inputs, with an async flag on retain, and we didn't audit enums across the spec (10 of 15). 402 and 403 are documented with their causes, and examples sit in the guides (9 of 15). A changelog at hindsight.vectorize.io/changelog with Breaking Changes sections per release, and versioned /v1 paths (12 of 15). Cloud docs per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page).

Memori 68

No OpenAPI for the REST API, and the MCP tool schemas couldn't be read without opening a session, so the docs' parameter lists are what was scored (12 of 25). llms.txt with Markdown docs for both modes (10). Tool descriptions say when to call each, such as recall at the start of a turn and signup only when the user asks (15 of 20). Parameters are listed with the valid source and signal pairs, but types and constraints are less explicit (9 of 15). Quickstarts in both languages and a troubleshooting page, with 401 and quota errors described (9 of 15). Keep a Changelog with semantic versioning (13 of 15). Total 68.

Hindsight 57

27 MCP tools on a bank-scoped URL and 30 at the root (15), with no documented way to load a subset or a read-only set. List and recall calls exist with bank scoping, and we didn't confirm page-size or token-budget limits (12 of 20). 402 tells an agent it's out of credit and 403 that the key can't reach the bank (12 of 20). No idempotency keys and no readOnlyHint or destructiveHint on the MCP tools, though retain can run asynchronously (3 of 20). Clients for Python, TypeScript and Go, and one URL per bank keeps calls simple (15). MCP and key docs per the 1 October check, not re-read on 4 November (docs.hindsight.vectorize.io answers robots.txt with its app page).

Memori 65

Seven MCP tools with short parameter lists (22 of 25). Recall filters by project, session, date range and source (14 of 20). 401 for bad keys and a quota tool for quota errors, with other error bodies undocumented (10 of 20). No idempotency guidance or tool annotations documented (4 of 20). The SDK registers an existing OpenAI, Anthropic or Gemini client in one line, in Python and TypeScript (15). Total 65.