LocalGhost vs Memori

LocalGhost 79

wisp 0.0.6 tagged on 10 October 2026 (30). Six releases, v0.0.1 to v0.0.6, from 2 to 10 October, each with dated notes (20). shields.io shows 0 open and 1 closed issue and no open pull requests. Pull request #1 (July) is merged and #3 (28 July, a macOS test fix) isn't in main, and the 0.0.4 notes say most of that release answers two outside reviews of 0.0.3. GitHub's issue and pull-request pages refused us, so we couldn't see written replies or their timing (12 of 25). Not an MCP server and no SDK, read as current official builds as the Open WebUI dossier read this line. Each tag ships a signed server bundle, a signed APK and a source archive on GitHub and the mirror, with no package-manager channel, fewer channels than the PyPI, GHCR and desktop builds Open WebUI was credited 13 for (11 of 15). Go 1.27.1 since 0.0.4 and three direct Go dependencies, with golang.org/x/crypto at v0.31.0 from December 2024, no Dependabot, and the Go suite passing at v0.0.6 and on main in our run of 10 October (6 of 10).

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

LocalGhost 67

Read with the local-software lines, as the Goose, Aider, Khoj, Screenpipe and Open WebUI dossiers do, and graded on wisp 0.0.6 (tag v0.0.6, commit 2c4786d, 10 October 2026), which main pins at c706f92. Each release carries a reproducible linux-amd64 server bundle with install.sh, a signed APK, a source archive and SHA256SUMS signed by the site key, on GitHub and the mirror, and the setup page states Debian 13 on x86-64, TPM 2.0, an optional NVIDIA card and Android 15 or later. The v0.0.6 signature verified for us on 10 October. There's no .deb or package-manager install (18 of 20). The CI workflow runs build, vet and the Go tests against Postgres on every push to main. We ran the Go suite at v0.0.6 and at c706f92 on 10 October and every package passed, TestFetchListAndSpools included, which failed at v0.0.5. The Postgres tests skip without a database, and neither the CI badge nor the Actions page showed us a result (20 of 25). shields.io showed 0 open and 1 closed issue on 6 October. The release notes name their own regressions and fix them in the release: 0.0.6 ships the fix for the Wikipedia import that stopped at an invalid byte and for /v1/wiki answering every phone with an empty body, while the CRYPTO50 index fault seen on 3 October is still unexplained (20 of 25). 0.0.x tags with dated notes per release that say what changed and how a phone on the previous release moves over, but no breaking-change section, and the v0.0.4 tag sits on a commit (1062b7f) that main doesn't contain (9 of 15). 0.0.6, pre-1.0 (0).

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

LocalGhost 39

Graded on the device API, as Schema is. /v1/news takes since and limit, the rate routes take hours or days and the Wikipedia route takes n, while /v1/home and /v1/rates return whole screens and nothing selects fields (12 of 25). /v1/days pages with before and limit, and /v1/wiki searches with q (12 of 20). edge.go folds every 400, 401, 403, 404 and 5xx a verified phone could get into the same 503 page, and the nginx path does the same with error_page, so the handlers' messages never reach the client and it can't tell a bad request from a locked box. Only a few statuses such as 409 pass through (2 of 20). Voice uploads are idempotent by id, /v1/lock is safe to repeat and trail deletion has a dry run, with no idempotency keys or retry guidance (10 of 20). The project's own Kotlin app is the only client, with no SDK and no documented way to enrol another (3 of 15).

Memori 65

Seven MCP tools with short parameter lists (22 of 25). Recall filters by project, session, date range and source (14 of 20). 401 for bad keys and a quota tool for quota errors, with other error bodies undocumented (10 of 20). No idempotency guidance or tool annotations documented (4 of 20). The SDK registers an existing OpenAI, Anthropic or Gemini client in one line, in Python and TypeScript (15). Total 65.

LocalGhost 78

MIT for the server and the app, with the bundled licences in NOTICE.txt and TERMS files, and the terms page names LocalGhostDao as the copyright holder, as LICENSE does (30). The privacy page (updated 10 October 2026), llms.txt and the about page give the same list of outbound requests, and the hosts in the server and app code at v0.0.6 match it. The README's What leaves the box section still describes the weather pull as the three thousand larger places once a day, where 0.0.6 pulls about six thousand places a hundred every two minutes, as the privacy page and llms.txt say. Data on the box stays until the owner deletes it. The website and mirror say they keep no access logs, which we couldn't check on the live server, and the egress package's code comment still says the box fetches only when the phone can't. The earlier disagreement between the notes and the app is counted once, under negative events (25 of 30). No deprecation policy. Dated changelog and privacy entries say which older app versions keep the old lookups until updated, and the release notes say what was removed (10 of 20). No telemetry, analytics or crash reporting in the server or the app, stated in the README and the privacy page and consistent with the code. We found no switch for the exchange, ECB and Open-Meteo fetches or for the phone's daily read of the mirror manifest, where Open WebUI's 18 came with an offline switch (16 of 20).

Memori 52

Apache-2.0 per the LICENSE text, though GitHub reports it as NOASSERTION (30). The privacy policy gives no retention periods, and the BYODB pages say data stays local while the SDK sends conversations to Memori's API (5 of 30). Changelog entries but no deprecation policy or notices (5 of 20). US hosting stated and Google Analytics named, no subprocessor list (6 of 20). Total 46.

LocalGhost 49

Graded on the HTTPS API that ghost.secd serves to enrolled phones under /v1, the only programmatic interface, as the Khoj and Open WebUI dossiers graded their HTTP APIs. There's no public API or MCP server, and the README and llms.txt say the box answers every other caller, an agent included, as if it were down. ghost.secd builds an OpenAPI 3.0 document from a route table and serves it at /v1/openapi.json only to enrolled devices. At v0.0.6 the table holds 49 paths while server.go registers 109 by hand (46 and 105 at v0.0.5), although the code comment says no route can exist outside the spec (8 of 25). llms.txt on www.localghost.ai and Markdown docs throughout the repository (10). Route summaries say what each call does and some say when to use it, and there's no API reference beyond them (8 of 20). Request and response shapes come from Go structs by reflection, but several shapes are marked loose with additionalProperties, request bodies among them, and query formats sit in summaries and handlers rather than in the spec (6 of 15). No API examples, and error statuses are folded into one 503 page by design, so no error responses are documented (3 of 15). /v1 prefixes, dated notes per release in server/releases/ and a dated changelog page (14 of 15).

Memori 68

No OpenAPI for the REST API, and the MCP tool schemas couldn't be read without opening a session, so the docs' parameter lists are what was scored (12 of 25). llms.txt with Markdown docs for both modes (10). Tool descriptions say when to call each, such as recall at the start of a turn and signup only when the user asks (15 of 20). Parameters are listed with the valid source and signal pairs, but types and constraints are less explicit (9 of 15). Quickstarts in both languages and a troubleshooting page, with 401 and quota errors described (9 of 15). Keep a Changelog with semantic versioning (13 of 15). Total 68.

LocalGhost 60

Read with the self-hosted rule, as the Khoj dossier did. Nothing is on sale. Pre-built boxes are planned at the cost of parts plus a 30 per cent margin with no price set, and the README's Ethereum donation address isn't a payment protocol on the tool's endpoints (0). Free under MIT with no account and no card, so 20, 20 and 20 on the last three lines.

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.