MemMachine vs Supermemory API + MCP

MemMachine 41

Framework reading for software the owner runs. The server has no authentication and no security scheme in its OpenAPI document (15 of 30). No read-only mode or confirmation for deletes (5 of 20). No guidance on recalled memories as untrusted text (4 of 15). No audit log on the self-hosted server; the hosted console shows usage (5 of 15). SECURITY.md with GitHub private reporting and a two-business-day acknowledgement, with security-audit and SBOM workflows; no security.txt or certification (12 of 20). Total 41.

Supermemory API + MCP 64

Org keys have full access, but scoped keys can be limited to one or more namespaces (container tags), set to expire in 1 to 365 days and revoked (401 after). The MCP signs in with OAuth and asks which spaces to allow, and since 21 August also takes an API key as Bearer (28 of 30). Scoped keys can't read billing, change settings or mint keys, MCP spaces carry read or write permission, and the mass forget has a dry run, but there's no read-only API key (14 of 20). Supermemory ingests URLs, PDFs and web pages and returns them to the model, and we found no prompt-injection guidance (0). The Analytics API gives usage per API key, error breakdowns and stored request logs, which the docs say skip 402, 404 and 500 answers and aren't a complete audit trail (10 of 15). SOC 2 Type II, GDPR and a HIPAA BAA per the security page, with the report on request from support. No security.txt (404 on 2 November), disclosure policy, SECURITY.md or bug bounty found (12 of 20). 28 + 14 + 0 + 10 + 12 = 64.

MemMachine 65

Searches take limit and filter options for episodic and semantic results (20 of 25). Memories can be listed and filtered by scope (15 of 20). Validation errors are typed; other failures are less clear, as the 429-to-500 issue shows (10 of 20). No idempotency keys or safe-retry guidance found (5 of 20). Python and TypeScript clients and a five-line quick start, once the import is fixed (15). Total 65.

Supermemory API + MCP 76

The hosted MCP registers 17 tools, four of them app-only (hidden from the model through MCP Apps visibility), so 13 reach the model, plus five deprecated pre-snake_case aliases kept until clients move. 11 to 30 tools (15). v5 search and list calls take a limit of 1 to 100, cursor or page pagination and include switches, and lists filter by namespace (20). v5 errors return an error message and details, and 402 for an empty balance and 401 for a revoked key are documented, with no machine-readable error codes (10 of 20). Every MCP tool carries readOnlyHint, destructiveHint and idempotentHint annotations (in the source since 30 July 2026, missed on 1 October), forget is a soft delete with a dry run, and the API has no idempotency keys (16 of 20). TypeScript and Python SDKs, and an add needs only content (15). 15 + 20 + 10 + 16 + 15 = 76.

MemMachine 40

Self-hosted rule, with the price lines read for the hosted platform. No x402, MPP or L402 (0 of 40). No hosted prices found on the site or docs (0). Free to self-host with no card (20). An agent can install it from PyPI with no account (20). Total 40.

Supermemory API + MCP 30

No x402, MPP or L402. An empty balance returns 402 with no payment payload (0). Per-unit prices without a login, re-read on 2 November, $5 per million SM tokens for plain-text memory, $10 for rich content, $5 per million searches, $100 per million operations (20). Free has $5 of credit renewed monthly, and the pricing page doesn't say whether a card is needed (10 of 20). A person signs up in the console, and the MCP signs in through a browser (0). 0 + 20 + 10 + 0 = 30.

MemMachine 79

OpenAPI documents for the server (54 operations) and the hosted platform (12) (25). llms.txt on docs.memmachine.ai with Markdown pages (10). Every operation has a description, and the docs explain memory types and scoping (15 of 20). Typed request models generated from the server, with search options for limits and filters (12 of 15). Examples for each client and the MCP tools, but only 422 is documented on the server and the README's first example doesn't run (8 of 15). /api/v2 paths and tagged releases, no changelog (9 of 15). Total 79.

Supermemory API + MCP 88

OpenAPI 3.1 for v5 at api.supermemory.ai/v5/openapi (33 operations, read on 2 November), with v4 and /openapi.json still served (25). llms.txt with a one-line purpose per page and endpoint (10). Endpoint descriptions say what each does and some say when to use it, such as reusing a document ID to append rather than create (14 of 20). Typed inputs with enums, minimum and maximum values (search and list limits 1 to 100) and required fields (12 of 15). Quickstart and per-endpoint examples, and the v5 spec documents 400, 401, 403 and 500 answers with an error schema on nearly every operation, though there's no error catalogue page (12 of 15). v3, v4 and v5 paths and a dated API changelog (15). 25 + 10 + 14 + 12 + 12 + 15 = 88.

MemMachine 57

Apache-2.0 (30). The terms say hosted customer data is destroyed on termination, with no period, and use usage data only in aggregate; the privacy policy wasn't read (12 of 30). No deprecation policy or notices found (3 of 20). No telemetry calls found in the server or client source, and the docs don't address it (10 of 20). Total 55.

Supermemory API + MCP 52

The SDKs, the hosted MCP and the tools in the public repository are MIT, but since 3 October the docs say the self-hosted server binary is built from a separate, non-public codebase and is free within a lite licence limit, so the hosted service and the engine are closed with clear terms. The 1 October reading of an MIT engine is corrected (15 of 30). The security page says customer content never trains models on any plan, and erasure works by deleting a namespace. The privacy policy (effective 29 September 2026, last updated 24 October) keeps data for the service relationship with no periods, and says disconnecting a connector won't delete synced data unless asked, while the security page says it deletes imported documents by default. The terms (2 June 2025) and privacy policy name no company (15 of 30). v3 and v4 became legacy with the dated v5 launch of 7 October and a migration command, with no shutdown date or deprecation policy (10 of 20). The privacy policy names Timescale, Cloudflare, OpenAI and Google Gemini as providers, with no full sub-processor list or data locations (5 of 20). 15 + 15 + 10 + 5 = 45.