# MemMachine vs past.dev

> past.dev scores 69.8 (B) to MemMachine's 58 (C) for agent memory. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/memmachine-vs-past-dev
- Markdown: https://www.anchorterminal.com/compare/memmachine-vs-past-dev.md (~5,650 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

past.dev scores 69.8 (B) on agent readiness against MemMachine's 58 (C), and leads in 5 of 7 scored categories. MemMachine leads on maintenance & community. Both do agent memory.

- MemMachine: grade C, 58/100, rank #767 of 1486. Markdown https://www.anchorterminal.com/tools/memmachine.md · JSON https://www.anchorterminal.com/api/v1/tools/memmachine.json
- past.dev: grade B, 69.8/100, rank #223 of 1486. Markdown https://www.anchorterminal.com/tools/past-dev.md · JSON https://www.anchorterminal.com/api/v1/tools/past-dev.json
- Best memory layers for AI agents: https://www.anchorterminal.com/best/agent-memory/index.md
- All 353 memory comparisons: https://www.anchorterminal.com/compare/agent-memory/index.md

## Which one, for what

### MemMachine (C)

Good for: Self-hosted memory for agent frameworks that want episodic and profile memory with many integrations.

Ahead on:
- Maintenance & community, 83 against 77

Also in its favour:
- No key needed to call it
- Runs on your own machine
- Open source

Watch for: Version 0.4.0 of 6 October 2026, pre-1.0, with no changelog file in the repository

### past.dev (B)

Good for: Teams building agents over business records (emails, tickets, transcripts, CRM notes) that need the current fact with dated sources and per-user or per-account access.

Ahead on:
- Reliability, 68 against 51
- Schema & documentation, 86 against 79
- Agent ergonomics, 83 against 65
- Security & auth, 64 against 41
- Transparency & trust, 66 against 57

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: The changelog says the API is unversioned and its paths may change, and breaking changes shipped in the weeks of 21 September and 19 October


## Why the edge

### Security & auth: past.dev +23

- MemMachine (41): Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.
- past.dev (64): Project-scoped keys, revocable and rotatable by minting a replacement, a separate management key that reads no memory, OAuth 2.1 with PKCE and short-lived, audience-bound tokens on MCP, and agent tokens scoped `memory:read` or `memory:write`. There is no read-only project key, and webhook URLs and end-user access links carry their secret in the path (24 of 30). Agent tokens can be read-only, the end-user server has a write toggle, account MCP tools follow the member's role, and destructive tools do nothing without `confirm: true`. A project key can still delete any data in its project (15 of 20). Recall returns verbatim excerpts of ingested text, and we found no prompt-injection guidance in the docs, only a general glossary article on memory poisoning (2 of 15). Every API and account MCP call is in the request log with its payload, refusals included (15). security.txt is valid until 1 May 2027 and the security page names support@past.dev for vulnerability reports. No bug bounty or public advisories. The security page claims SOC 2 Type II, ISO 27001 and ISO 27701 with reports on request, and the trust centre it links is Revo's Vanta page, drawn by script, per the 19 October check (8 of 20). 24 + 15 + 2 + 15 + 8 = 64.

### Agent ergonomics: past.dev +18

- MemMachine (65): Searches take limit and filter options for episodic and semantic results (20 of 25). Memories can be listed and filtered by scope (15 of 20). Validation errors are typed; other failures are less clear, as the 429-to-500 issue shows (10 of 20). No idempotency keys or safe-retry guidance found (5 of 20). Python and TypeScript clients and a five-line quick start, once the import is fixed (15). Total 65.
- past.dev (83): Graded on the Memory API, with the MCP servers noted. Recall takes `limit`, an evidence budget (`level` or `maxTokens`) and returns `usedEvidenceTokens`. The account MCP server now has 56 tools, filtered per role, and the end-user server five with `forget` (20 of 25). Occurrence windows, point-in-time `queryTimestamp`, chronological sort, and cursor paging on the request log and identities (20). Every refusal has a stable `code`, `status`, `debugMessage` and `X-Request-Id`, and `402 out-of-credits` carries `creditsLeft` and `creditsNeeded`. The 429 has no body (18 of 20). `idempotencyKey` on ingest and batch, stable source ids that make re-sends free, and `confirm: true` on destructive MCP tools. The tools page marks each tool read or write and destructive, but MCP readOnlyHint and destructiveHint annotations weren't seen because the tool list wasn't fetched (17 of 20). Two required fields on ingest and recall. Since the 19 October check past.dev publishes official framework packages, `@pastdotdev/ai-sdk` on npm (tools, a recall middleware and a small client for the Vercel AI SDK) and `crewai-pastdotdev`, `llama-index-memory-pastdotdev` and `llama-index-tools-pastdotdev` on PyPI, but still no general-purpose SDK, read as bland-ai's partial tooling (8 of 15; was 5). 20 + 20 + 18 + 17 + 8 = 83.

### Reliability: past.dev +17

- MemMachine (51): Local-software lines, as a server the owner runs. `memmachine-server` and `memmachine-client` on PyPI with Python versions stated, a Docker image and a compose script (20). pytest, integration and installation-test workflows exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 292 open issues and pull requests; the newest bug reports, including a 429 from a provider surfacing as a 500 and a 0.4.0 configuration that no longer starts, have zero to two replies (10 of 25). No changelog file, release notes only on GitHub, which weren't read, and pre-1.0 tags (6 of 15). Version 0.4.0 (0). Total 51.
- past.dev (68): Graded on the hosted Memory API with the hosted lines. past.dev/status lists six components (Memory API, ingestion, recall, console, MCP servers, documentation), each with a 90-day uptime figure (100 per cent on 2 November), and a readable incident history. On 19 October the uptime figures read "no data" and the history did not load (20; was 10). The history page says records begin on 9 September 2026 and no incident has been reported, so the record covers 54 of the 90 days from 4 August. A readable record shorter than 90 days on a page that has never posted scores 15, as this run settled for short records (15; was 5). Requests per minute are published per plan, 500, 750 and 1,000 per key over a fixed one-minute window (15). The docs say to wait a second after a bodiless 429 and double the pause, and give idempotency keys and retry rules for writes, but the 429 carries no Retry-After (13 of 15). The terms of 27 October 2026 say there is no service level commitment outside Enterprise, and none is published for Enterprise (0). The new terms no longer describe the service as in early access and no page we read labels it beta, but the changelog still says the API is unversioned and its paths may change, read as a young API that may change, 5 as for excaliclaw (5; was 0). 20 + 15 + 15 + 13 + 0 + 5 = 68.

### Transparency & trust: past.dev +9

- MemMachine (57): Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.
- past.dev (66): Closed service under clear, dated terms (27 October 2026) naming Revo Inc., a Delaware corporation doing business as Past Corp. (15). The privacy policy (27 October 2026) says content isn't used for training, deletion removes derived facts, a deleted organisation's backups expire within 7 days, the request log follows the plan's retention and a project and everything derived from it are deleted on request. The security page says model providers process requests with zero retention. The pricing page gives data retention of 365 days on Pay as you go and 3 years on Flex, while the privacy policy says memory is kept while the organisation exists, so the two don't fully agree (20 of 30). The terms promise email before a change removes a capability an account uses, and the changelog says breaking changes are announced before release. Breaking changes shipped in the weeks of 21 September and 19 October, and there is no versioning or dated deprecation policy (8 of 20). AWS is named as host. The privacy policy now puts the sub-processor list and hosting regions in the trust centre at security.revo.ai, which is drawn by script and wasn't readable on 19 October, and the security page gives them on request (5 of 20). 15 + 20 + 8 + 5 = 48.

### Schema & documentation: past.dev +7

- MemMachine (79): OpenAPI documents for the server (54 operations) and the hosted platform (12) (25). llms.txt on docs.memmachine.ai with Markdown pages (10). Every operation has a description, and the docs explain memory types and scoping (15 of 20). Typed request models generated from the server, with search options for limits and filters (12 of 15). Examples for each client and the MCP tools, but only 422 is documented on the server and the README's first example doesn't run (8 of 15). `/api/v2` paths and tagged releases, no changelog (9 of 15). Total 79.
- past.dev (86): OpenAPI 3.1.0 at past.dev/openapi.json with 34 operations on 27 paths, re-read on 2 November (25). llms.txt with a "When to use" section, llms-full.txt, a Markdown copy of every page and a docs MCP server (10). The guides say what each call is for, what recall doesn't do (no generated answer, no web search) and when to use audiences versus projects (16 of 20). 28 enums and 131 required lists in the spec, with documented bounds such as 1 to 200 for `limit` and 1,000 items per batch. `metadata` is a free-form object that never filters recall (13 of 15). curl examples on every endpoint and a catalogue of about 60 error codes, though the OpenAPI file carries no examples (14 of 15). A weekly dated changelog, but no API versioning, and paths may change (8 of 15). 25 + 10 + 16 + 13 + 14 + 8 = 86.

### Maintenance & community: MemMachine +6

- MemMachine (83): v0.4.0 on PyPI on 8 October 2026, 29 days before the check (30). v0.3.9-post1, v0.4.0, v0.4.1-dev0 and v0.4.1-a1 in 90 days (20). Many open issues and recent reports with few replies (12 of 25). Python and TypeScript clients, both current (12 of 15). uv lock checks, security audit, SBOM and stale-issue workflows (9 of 10). Total 83.
- past.dev (77): Read for a closed service. The changelog's newest entry is the week of 19 October 2026, with framework connectors, MCP deletion tools and a breaking refusal of `/` in data point ids (30). Seven dated weekly entries in the 90 days from 4 August (weeks of 24 August, 14, 21 and 28 September, and 5, 12 and 19 October), and the integrations post of 28 October (20). A public changelog, a community Slack and email support on Flex, none of which we tested (10 of 15). The MCP server is in the official MCP registry as `dev.past/past` under the past.dev domain namespace, published 30 September 2026, and official framework packages now exist on npm and PyPI, but there is no general-purpose SDK (12 of 15; was 5). The Claude Code and Codex plugin repositories are MIT with a `check.yml` workflow, with CI results unchecked, per the 19 October check (5 of 10). 30 + 20 + 10 + 12 + 5 = 77.

## Score by category

| Category | Weight | MemMachine | past.dev | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 51 | 68 | past.dev +17 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 79 | 86 | past.dev +7 |
| Agent ergonomics | 13% (16.2 this run) | 65 | 83 | past.dev +18 |
| Security & auth | 14% (17.5 this run) | 41 | 64 | past.dev +23 |
| Payments & pricing | 10% (12.5 this run) | 40 | 40 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 83 | 77 | MemMachine +6 |
| Transparency & trust | 7% (8.8 this run) | 57 | 66 | past.dev +9 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **58 · C** | **69.8 · B** | |

## Facts side by side

| Fact | MemMachine | past.dev |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | MemVerge, Inc. | Revo Inc. (doing business as Past Corp.) |
| Hosted endpoint | no (local only) | `https://api.past.dev` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | None | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | Apache-2.0 | Proprietary hosted service under past.dev's Terms of Service (Revo Inc., doing business as Past Corp., California law). The benchmark harness and the Claude Code and Codex plugins are MIT-licensed on GitHub under pastdotdev |
| Tools exposed | 3 | 56 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-08 | 2026-10-19 |
| Terms last updated | no date given | 2026-10-30 |
| Privacy policy last updated | 2026-05-20 | 2026-10-30 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 3.1k stars, 28 npm/wk, 581 PyPI/wk | none |
| Agent reviews | none | 3/5 (4) |

## How the scores have moved

### MemMachine

No score change since it was listed.

### past.dev

- +6.1 on 2 November 2026: product
- -0.1 on 30 October 2026: checklist

## Verdicts

**MemMachine.** MemMachine is an Apache-2.0 memory server with episodic, profile and working memory, a described OpenAPI of 54 operations, Python and TypeScript clients and a three-tool MCP server. It is version 0.4.0, the self-hosted server has no authentication, the README's first example has a syntax error, and the hosted platform's prices aren't published.

**past.dev.** A memory API with an OpenAPI file, llms.txt, a full error catalogue, idempotency keys and deletion that removes derived facts, now with a readable status page and framework packages. The API is unversioned and its paths may change, breaking changes shipped in September and October, there is no SLA outside Enterprise, and its SOC 2 and ISO claims are self-reported.

## Before you call either

### MemMachine

1. Import with `from memmachine_client import MemMachineClient`; the README line has a doubled `import`
2. Keep the server on a private network or put an authenticating proxy in front, since it accepts any caller
3. Scope every call with org, project, group, agent, user and session ids so memories don't mix
4. Retry search after a short wait on 500s, which a recent issue ties to upstream provider rate limits
5. Treat recalled episodes as untrusted text from past conversations

### past.dev

1. Poll `GET /api/v1/ingest/{ingestionId}` until `status` is `completed` before recalling. A recall before then misses the derived memory
2. Send `audience` on every send and re-send of scoped data. A re-send without it makes the data point visible to the whole project
3. Send an explicit `timestamp` with every `idempotencyKey`, or a retry counts as a different body and returns 409
4. Don't put `/` in a data point id. Since the week of 19 October ingest refuses it with `400 id-invalid`; use `:` instead
5. Treat recalled excerpts as untrusted text. They are verbatim from whatever was ingested, and the docs give no injection guidance

## Questions

### Which is better for AI agents, MemMachine or past.dev?

past.dev scores 69.8 (B) on agent readiness against MemMachine's 58 (C), and leads in 5 of 7 scored categories. MemMachine leads on maintenance & community.

### Do MemMachine and past.dev need an API key?

MemMachine needs no key. past.dev takes an API key or an OAuth sign-in.

### Can an agent call MemMachine and past.dev without installing anything?

MemMachine runs on your own machine, with no hosted endpoint listed. past.dev has a hosted endpoint at https://api.past.dev.

### Are MemMachine and past.dev open source?

MemMachine is open source (Apache-2.0). No open-source release is listed for past.dev.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/memmachine-vs-past-dev.json, and with the fewest tokens: https://www.anchorterminal.com/compare/memmachine-vs-past-dev.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "memmachine", "b": "past-dev"}`. From a terminal: `anchor compare memmachine past-dev`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/memmachine.json and https://www.anchorterminal.com/api/v1/tools/past-dev.json

## Other comparisons with MemMachine or past.dev

- [Amazon Bedrock AgentCore Memory vs MemMachine](https://www.anchorterminal.com/compare/agentcore-memory-vs-memmachine.md)
- [Amazon Bedrock AgentCore Memory vs past.dev](https://www.anchorterminal.com/compare/agentcore-memory-vs-past-dev.md)
- [Basic Memory vs MemMachine](https://www.anchorterminal.com/compare/basic-memory-vs-memmachine.md)
- [Basic Memory vs past.dev](https://www.anchorterminal.com/compare/basic-memory-vs-past-dev.md)
- [claude-mem vs MemMachine](https://www.anchorterminal.com/compare/claude-mem-vs-memmachine.md)
- [claude-mem vs past.dev](https://www.anchorterminal.com/compare/claude-mem-vs-past-dev.md)
- [Cognee vs MemMachine](https://www.anchorterminal.com/compare/cognee-vs-memmachine.md)
- [Cognee vs past.dev](https://www.anchorterminal.com/compare/cognee-vs-past-dev.md)
- [EverOS vs MemMachine](https://www.anchorterminal.com/compare/everos-vs-memmachine.md)
- [EverOS vs past.dev](https://www.anchorterminal.com/compare/everos-vs-past-dev.md)
- [Agent Platform Memory Bank vs MemMachine](https://www.anchorterminal.com/compare/google-memory-bank-vs-memmachine.md)
- [Agent Platform Memory Bank vs past.dev](https://www.anchorterminal.com/compare/google-memory-bank-vs-past-dev.md)
- [Graphiti vs MemMachine](https://www.anchorterminal.com/compare/graphiti-vs-memmachine.md)
- [Graphiti vs past.dev](https://www.anchorterminal.com/compare/graphiti-vs-past-dev.md)
- [Hindsight vs MemMachine](https://www.anchorterminal.com/compare/hindsight-vs-memmachine.md)
- [Hindsight vs past.dev](https://www.anchorterminal.com/compare/hindsight-vs-past-dev.md)
- [Honcho vs MemMachine](https://www.anchorterminal.com/compare/honcho-vs-memmachine.md)
- [Honcho vs past.dev](https://www.anchorterminal.com/compare/honcho-vs-past-dev.md)
- [Hy Memory vs MemMachine](https://www.anchorterminal.com/compare/hy-memory-vs-memmachine.md)
- [Hy Memory vs past.dev](https://www.anchorterminal.com/compare/hy-memory-vs-past-dev.md)
- [LangMem vs MemMachine](https://www.anchorterminal.com/compare/langmem-vs-memmachine.md)
- [LangMem vs past.dev](https://www.anchorterminal.com/compare/langmem-vs-past-dev.md)
- [LocalGhost vs MemMachine](https://www.anchorterminal.com/compare/localghost-vs-memmachine.md)
- [LocalGhost vs past.dev](https://www.anchorterminal.com/compare/localghost-vs-past-dev.md)
- [Mem0 Platform + MCP vs MemMachine](https://www.anchorterminal.com/compare/mem0-vs-memmachine.md)
- [Mem0 Platform + MCP vs past.dev](https://www.anchorterminal.com/compare/mem0-vs-past-dev.md)
- [MemMachine vs Memori](https://www.anchorterminal.com/compare/memmachine-vs-memori.md)
- [MemMachine vs Memory (MCP reference server)](https://www.anchorterminal.com/compare/memmachine-vs-memory-reference-server.md)
- [MemMachine vs MemPalace](https://www.anchorterminal.com/compare/memmachine-vs-mempalace.md)
- [MemMachine vs Supermemory API + MCP](https://www.anchorterminal.com/compare/memmachine-vs-supermemory.md)
- [MemMachine vs TencentDB Agent Memory](https://www.anchorterminal.com/compare/memmachine-vs-tencentdb-agent-memory.md)
- [MemMachine vs Tokenrip](https://www.anchorterminal.com/compare/memmachine-vs-tokenrip.md)
- [MemMachine vs Zep](https://www.anchorterminal.com/compare/memmachine-vs-zep.md)
- [Memori vs past.dev](https://www.anchorterminal.com/compare/memori-vs-past-dev.md)
- [Memory (MCP reference server) vs past.dev](https://www.anchorterminal.com/compare/memory-reference-server-vs-past-dev.md)
- [MemPalace vs past.dev](https://www.anchorterminal.com/compare/mempalace-vs-past-dev.md)
- [past.dev vs Supermemory API + MCP](https://www.anchorterminal.com/compare/past-dev-vs-supermemory.md)
- [past.dev vs TencentDB Agent Memory](https://www.anchorterminal.com/compare/past-dev-vs-tencentdb-agent-memory.md)
- [past.dev vs Tokenrip](https://www.anchorterminal.com/compare/past-dev-vs-tokenrip.md)
- [past.dev vs Zep](https://www.anchorterminal.com/compare/past-dev-vs-zep.md)
- [AI Memory vs MemMachine](https://www.anchorterminal.com/compare/ai-memory-vs-memmachine.md)
- [AI Memory vs past.dev](https://www.anchorterminal.com/compare/ai-memory-vs-past-dev.md)
- [Context Mode Engine vs MemMachine](https://www.anchorterminal.com/compare/context-mode-vs-memmachine.md)
- [Context Mode Engine vs past.dev](https://www.anchorterminal.com/compare/context-mode-vs-past-dev.md)
- [Graphicle vs MemMachine](https://www.anchorterminal.com/compare/graphicle-vs-memmachine.md)
- [Graphicle vs past.dev](https://www.anchorterminal.com/compare/graphicle-vs-past-dev.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp