Honcho vs MemMachine

Honcho 80

x402 and Tempo MPP on 16 endpoints at agentcash.honcho.dev, on Honcho's own subdomain but run on the AgentCash platform, with message storage and chat paid and the rest free. api.honcho.dev itself takes only keys (30 of 40). Ingestion at $2 per million tokens and chat at $0.001 to $0.50 a call are published (20). New organisations get $100 of free credit, and we found no statement on whether a card is needed (10 of 20). An agent can pay per call over x402 with no account (20).

MemMachine 40

Self-hosted rule, with the price lines read for the hosted platform. No x402, MPP or L402 (0 of 40). No hosted prices found on the site or docs (0). Free to self-host with no card (20). An agent can install it from PyPI with no account (20). Total 40.

Honcho 69

The server is AGPL-3.0, the same code Honcho hosts, and the TypeScript SDK is Apache-2.0 (30). The terms keep data for 90 days after termination and then delete it, and a deleting-data page says what survives each kind of delete. We didn't re-read the privacy policy this run (18 of 30). Docs for v1, v2 and v3 sit side by side with a compatibility guide, but no dated notices or written policy (8 of 20). No subprocessor list or data-location statement found (0).

MemMachine 57

Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.

Honcho 52

Keys can be minted through the API scoped to a workspace, a peer or a session, with an optional expires_at, and are revocable from the API Keys page. The MCP takes a Bearer key or OAuth (30). Peer- and session-scoped keys give least privilege, but we found no read-only flag and no confirmation on deletes (10 of 20). Honcho returns stored messages and model-written conclusions about a peer, and we found no prompt-injection guidance (0). No audit log or per-call log found (0). SECURITY.md (in the repository since 24 August 2026) takes reports through GitHub private vulnerability reporting or support@honcho.dev, and the site carried a SOC 2 Type I badge per the 1 October check. No security.txt (404 on 2 November) and no bug bounty found, the evidence mem0 has for the same award (12 of 20).

MemMachine 41

Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.

Honcho 71

The API's context call returns a ready block for the next prompt (15 of 25). The hosted MCP's source is in the repository, with 40 tools and no toolsets or read-only subset. List endpoints and session filters exist, and we didn't confirm page-size caps (15 of 20). 422 responses name the failing field (12 of 20). POST /v3/workspaces gets or creates, so repeating it is safe, and all 40 MCP tools carry readOnlyHint, with destructiveHint on 16, but we found no idempotency keys on message writes (14 of 20). Python and TypeScript SDKs and few required fields (15).

MemMachine 65

Searches take limit and filter options for episodic and semantic results (20 of 25). Memories can be listed and filtered by scope (15 of 20). Validation errors are typed; other failures are less clear, as the 429-to-500 issue shows (10 of 20). No idempotency keys or safe-retry guidance found (5 of 20). Python and TypeScript clients and a five-line quick start, once the import is fixed (15). Total 65.

Honcho 84

OpenAPI specs for v1, v2 and v3 linked from llms.txt, at honcho.dev/docs/v3/openapi.json for the current version (25). llms.txt (10). Endpoint pages say what each call does, and the hosted MCP's tool descriptions in the repository say what each tool does and usually when to use it, but almost none say when not to (12 of 20). Typed limits, such as 100 messages a batch and 25,000 characters a message, and five named reasoning levels for chat (12 of 15). Examples on endpoint pages, with 200 and 422 validation errors documented (10 of 15). Versioned docs, a compatibility guide and a CHANGELOG.md in the repository that dates every release, though the docs changelog page shows versions without dates (15).

MemMachine 79

OpenAPI documents for the server (54 operations) and the hosted platform (12) (25). llms.txt on docs.memmachine.ai with Markdown pages (10). Every operation has a description, and the docs explain memory types and scoping (15 of 20). Typed request models generated from the server, with search options for limits and filters (12 of 15). Examples for each client and the MCP tools, but only 422 is documented on the server and the README's first example doesn't run (8 of 15). /api/v2 paths and tagged releases, no changelog (9 of 15). Total 79.