Hy Memory vs Memori

Hy Memory 76

hy-memory 2.0.13 is dated 2 November 2026 in CHANGELOG.md, with the release commit 6c235ef the same day (30). Thirteen SDK releases in the 90 days from 6 August, 2.0.1 on 16 October to 2.0.13 on 2 November, each with a dated changelog entry (20). The 2.0.5 development previews of 21 October aren't counted. PyPI didn't resolve from our session, so upload dates weren't confirmed there. 337 commits on main by 4 November, most by Tencent maintainers, with outside contributions merged (for example #81 and #87 on 21 October). Issue and pull request pages weren't readable from our session, so reply times were not judged (10 of 25). One current official package, Python only. There is no MCP server, so the registry line does not apply (10 of 15). CI with pinned actions runs on every push to main, and a uv.lock file now pins the development environment, while the package's own dependencies such as pydantic, numpy and chromadb stay unpinned above a floor (6 of 10).

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Hy Memory 65

Local-software reading of the Python SDK. hy-memory installs from PyPI with Python 3.9 or later declared in pyproject.toml at 2.0.13 and extras for Qdrant, FAISS, Neo4j, MySQL and local rerank (20). A public CI workflow runs the whole pytest suite (133 test_*.py files at commit b58e95f) on Python 3.12 only, on pushes to main and on pull requests. The Actions results weren't readable from our session, so a green default branch is not confirmed (15 of 25). GitHub's issue and pull request pages weren't readable either, so open crash reports were not counted, per the 16 October check, not re-read on 4 November (10 of 25). CHANGELOG.md now has a dated entry for each SDK release from 2.0.1 to 2.0.13 and labels the 2.0.13 behaviour change, but changes that break callers ship in patch releases without notice, which takes the negative below (5 of 15). Version 2.0.13 (15).

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

Hy Memory 60

Apache-2.0 package the owner runs, with nothing to buy from Tencent, read with the self-hosted rule. 20 for pricing, 20 for a free start and 20 for use without an account. No x402, MPP or L402 in the docs or source (0). Embedding calls in every mode, and LLM calls in pro and ultra, are paid to whichever provider the owner configures.

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.

Hy Memory 55

Library reading. No OpenAPI or tool schema applies, and the SDK defines no agent tools. Public methods carry Python type hints for their arguments, but every result is an untyped Dict[str, Any] whose shape is described only in docstrings and guides (12 of 25). No llms.txt on memory.hunyuan.tencent.com per the 16 October check, not re-read on 4 November. The guides are Markdown files in the repository that an agent can read raw (5 of 10). Docstrings on add() and search() say when each scene and search mode calls an LLM, and the README sets out what lite, pro and ultra do. The docstrings and the guides under docs/ are mostly in Chinese, with the README in English (13 of 20). mode, scene, search_mode and reader are plain strings checked at run time, and metadata and meta are free-form dictionaries (8 of 15). Worked examples in the README and guides. Since 2.0.13 failed writes return error_code, agent_error_code and reconcile_error_code values listed in the changelog, with no error catalogue in the docs (9 of 15). CHANGELOG.md covers every SDK release from 2.0.1 to 2.0.13, while docs/usage.md still pins 2.0.4 for every install line (8 of 15).

Memori 68

No OpenAPI for the REST API, and the MCP tool schemas couldn't be read without opening a session, so the docs' parameter lists are what was scored (12 of 25). llms.txt with Markdown docs for both modes (10). Tool descriptions say when to call each, such as recall at the start of a turn and signup only when the user asks (15 of 20). Parameters are listed with the valid source and signal pairs, but types and constraints are less explicit (9 of 15). Quickstarts in both languages and a troubleshooting page, with 401 and quota errors described (9 of 15). Keep a Changelog with semantic versioning (13 of 15). Total 68.

Hy Memory 63

Apache-2.0 in LICENSE and in pyproject.toml at 2.0.13. CHANGELOG.md says 2.0.1 kept the MIT licence metadata it was published with and 2.0.2 carries Apache-2.0, and the 1.x releases went out with MIT metadata per the 16 October check. The OpenClaw plugin source (1.1.10) says Apache-2.0, while the npm package openclaw-hy-memory 1.2.4 was marked MIT per the 16 October check, not re-read on 4 November (25 of 30). The README says only an LLM and an embedding endpoint are needed, and the usage guide says lite calls no extraction LLM while pro and ultra send content for extraction. Nothing says in one place what the SDK keeps on disk. Since 2.0.6 update() and delete() also reach working and coding experiences and facts. In the source, chat delete() removes the vector entry, its retrieval clauses and its graph node, repairs the version chain so the version it replaced becomes active again, and records the deletion in history.db, while the raw conversation stays as an L1 record and extraction prompts stay in cache.db. 2.0.10 trims assistant and tool turns in stored raw conversations (10 of 30). No deprecation policy. The 2.0.5 default change to coding search and the 2.0.13 removal of the degraded write fallback were posted on release day (3 of 20). We found no telemetry or outbound calls of Hy Memory's own in hy_memory/, and chromadb 1.5.9 in uv.lock pulls in no PostHog client. Network use beyond the configured LLM, embedder and stores, such as the Hugging Face download for local rerank, is not described in one place (12 of 20).

Memori 52

Apache-2.0 per the LICENSE text, though GitHub reports it as NOASSERTION (30). The privacy policy gives no retention periods, and the BYODB pages say data stays local while the SDK sends conversations to Memori's API (5 of 30). Changelog entries but no deprecation policy or notices (5 of 20). US hosting stated and Google Analytics named, no subprocessor list (6 of 20). Total 46.

Hy Memory 37

Local-software reading, as for LangMem and Graphiti. The SDK holds no credential of its own and opens no port. LLM and embedder keys come from the environment or a .env file. Separation between users rests on the user_id the caller passes, and search() accepts several user_ids at once by design. The bundled python -m hy_memory.server, which the OpenClaw plugin starts, listens on 127.0.0.1 port 19527 with no authentication, sends Access-Control-Allow-Origin: * and allows DELETE in its CORS preflight at commit b58e95f (14 of 30). No read-only mode. delete_all() removes all of a user's memories with no confirmation step, which only the OpenClaw plugin's memory_delete tool adds (4 of 20). Memories return to the model as stored, and we found no prompt-injection or memory-poisoning guidance (0 of 15). On by default, history.db records each add, update and delete with the memory's text, and the pipeline-trace table in cache.db keeps extraction prompts and responses. Since 2.0.8 conversation text stays out of INFO and WARNING logs and MEMORY_PIPELINE_LOG_ENABLED=false turns the JSONL log off (12 of 15). SECURITY.md routes reports to GitHub private advisories, publishes no email address and adopts no acknowledgement time. No security.txt on memory.hunyuan.tencent.com or www.tencent.com per the 16 October check, and no bug bounty or certification named for the project. OSV lists no advisory for hy-memory on 4 November (7 of 20).

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.