Memori vs Memory (MCP reference server)

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

Memory (MCP reference server) 75

Scored as a local stdio package. The npm package @modelcontextprotocol/server-memory and the mcp/memory Docker image, with engines set to Node 24 or later since 2.0.0 and the README stating the same (20). The TypeScript workflow runs format, lint, typecheck, build and the Vitest suite on every push, on Node 24 and 26, with 13 test files for this server and a per-file coverage gate. Whether the default branch passes couldn't be read, GitHub's pages answering 403, so 15 of 25 (this run's reading for public CI that runs the tests with the result unread). The issue list wasn't readable. The eleven September fixes, the race in #4555 among them, shipped in 1.0.0 with fixes for #4797, #4827 and #4887, and 2.0.1 fixed #5058 and the failed-migration case (15 of 25). Since 1.0.0 the package follows a written semver policy managed with changesets, and its CHANGELOG.md lists 2.0.0's breaking changes under Major Changes (15). Version 2.0.1, but the repository README and SECURITY.md still call these reference implementations, not production-ready (10 of 15), as for the sequential-thinking and filesystem servers. 20+15+15+15+10 = 75.

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Memory (MCP reference server) 75

Memory 2.0.1, released with the monorepo's v2.2.0 tag on 28 October 2026, 7 days before this check (30). Four releases of this package in the 90 days from 6 August, 2026.8.31 (31 August), 1.0.0 (tag v1.0.0, 10 October), 2.0.0 (tag v2.0.0, 19 October) and 2.0.1 (tag v2.2.0, 28 October), each with code changes; v2.1.0 (24 October) left it at 2.0.0 (package.json read at each tag). Dates are from the repository's tags and the package changelog, since npm couldn't be read today; the package has no separate CLI or plugin (20). Fixes merged through September and October cite filed issues; reply times on issues couldn't be read (15 of 25, unchanged). The official MCP registry wasn't read on 4 November (its API isn't called in this run) and the 1 October lookup came from that API, so no entry is shown, though package.json carries the mcpName io.github.modelcontextprotocol/server-memory (0). Current SDK (@modelcontextprotocol/server ^2.3.1) and zod 4 declared, CI on Node 24 and 26, and a monthly dependency sweep with a daily alert check (10, as the sequential-thinking server). 30+20+15+0+10 = 75.

Memori 52

Apache-2.0 per the LICENSE text, though GitHub reports it as NOASSERTION (30). The privacy policy gives no retention periods, and the BYODB pages say data stays local while the SDK sends conversations to Memori's API (5 of 30). Changelog entries but no deprecation policy or notices (5 of 20). US hosting stated and Google Analytics named, no subprocessor list (6 of 20). Total 46.

Memory (MCP reference server) 76

MIT for older contributions and Apache-2.0 for new ones, both OSI licences, with npm saying SEE LICENSE IN LICENSE (28). Local software with no network calls. The README says where the graph is stored, and since 1.0.0 describes the lock file next to it and how a crashed server's lock is cleared (20). RELEASING.md's semver policy says what makes a major, and 1.0.0's changelog said on 10 October that it was the last release on the 1.x SDK. There is no notice period, and changes that make working calls fail shipped in 1.0.0 and 2.0.1 with word only on release day (10 of 20). No telemetry in the code (20). 28+20+10+20 = 78.

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.

Memory (MCP reference server) 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.

Memory (MCP reference server) 39

No credentials, nothing to scope, so the middle band (20). No read-only mode. The three delete tools run without confirmation and annotations are the only signal a host gets. The file path is whatever MEMORY_FILE_PATH says (5). Everything stored comes back verbatim in later sessions, so an instruction an agent copied from a web page or document persists as memory. The README still has no guidance on this (2). No log of who changed what. Resource notifications say only that the graph changed (0). SECURITY.md was rewritten on 29 September 2026 and is on main since 1.0.0. It names this server in scope, takes private reports through GitHub, says fixes ship in the next release and publishes accepted advisories once a fixed release is out. modelcontextprotocol.io serves a security.txt with a contact and no Expires line. No bounty or certification. Graded as the sequential-thinking and filesystem servers and nanobot (12 of 20). OSV lists no advisory for the package on 4 November, and none of the GHSA-named branches merged in October touches this server. 20+5+2+0+12 = 39.