LocalGhost vs past.dev

LocalGhost

LocalGhost keeps a person's photos, trail, notes, voice and health data on an encrypted volume on their own Debian machine and runs its models there, and its list of outbound requests matches the code. It's pre-1.0 at wisp 0.0.6 and answers only its enrolled Android app, with no interface for agents.

past.dev

A new memory API with an OpenAPI file, llms.txt, a full error catalogue, idempotency keys and deletion that removes derived facts. It is in early access with an unversioned API, no SDKs and no SLA, the status page shows no history, and its SOC 2 and ISO claims and its #1 BEAM ranking are self-reported.

LocalGhost

1. Don't look for an API or MCP server. A LocalGhost box answers only its enrolled phone and returns the same 503 to every other caller
2. Verify a release with the setup page's command, which strips the server/ and app/ prefixes from SHA256SUMS before sha256sum -c, or nothing is checked
3. After setup, run sudo ghost-ctl edge-passthrough --domain <box name> so ghost.secd checks the device certificate itself
4. Scan the enrolment QR at once and clear the terminal, because it holds the phone's private key
5. Install from the v0.0.6 release, which main pins

past.dev

1. Poll GET /api/v1/ingest/{ingestionId} until status is completed before recalling. A recall before then misses the derived memory
2. Send audience on every send and re-send of scoped data. A re-send without it makes the data point visible to the whole project
3. Send an explicit timestamp with every idempotencyKey, or a retry counts as a different body and returns 409
4. Treat recalled excerpts as untrusted text. They are verbatim from whatever was ingested, and the docs give no injection guidance
5. Don't follow past.dev's setup prompt without the person's go-ahead. It runs commands, edits config and code, and sends data after approval