Memori vs Zep

Memori 33

SDK 3.3.6 on 27 May 2026, 163 days before the check (10). No release in the 90 days to 6 November (0). Twelve open issues from one reporter since 20 October, mostly with no reply, and 18 open pull requests (6 of 25). Python and TypeScript SDKs, last released in May 2026 (12 of 15). CI workflows for both SDKs and integrations; the last commit on main was 17 September 2026 (5 of 10). Total 33.

Zep 80

SDKs 4.0.1 for Python, TypeScript and Go on 2026-10-20, adding task filters, after 4.0.0 on 14 October, the release that made v4 generally available (30). Seven stable TypeScript SDK releases in the 90 days from 3 August, 3.26.0 to 3.30.0 and 4.0.0 per npm on 17 October and 4.0.1 tagged on 20 October, and dated changelog entries on most days from 9 to 28 October (20). Closed service, scored on the 15-point scale. The changelog is public and frequent, and we didn't test a support channel (10 of 15). Current official SDKs for Python, TypeScript and Go at 4.0.1 (15). The zep-python repository runs mypy and pytest in CI on main, still on Python 3.9, and now carries v4.0.0 and v4.0.1 tags, but we couldn't read CI results or PyPI (5 of 10). Zep's own servers aren't in the official MCP registry.

Memori 28

Hosted lines, since both modes call Memori's API. No status page found; status.memorilabs.ai did not answer and none is linked (0). No readable incident history (5). Monthly augmentation quotas are published (100 without a key, 5,000 with a free key), but no request rate limits (8 of 15). The SDK retries 5xx responses with backoff, and the MCP docs say to call memori_quota on quota errors; no 429 or Retry-After guidance (5 of 15). SLA only as a custom Enterprise term (0). No beta label on the cloud or MCP endpoint (10). Total 28.

Zep 70

Atlassian Statuspage at status.getzep.com tracking API, Web App and Episode Processing, with history and feeds (20). The 90 days from 3 August to 1 November hold six incidents. Two impaired core functions for over an hour, retrieval and episode processing on 27 August (about 2.5 hours) and errors and latency during the AWS us-west-2 outage on 3 September (about 2 hours). Two were search latency on 10 and 15 September (2.5 and 3.5 hours). On 16 October an elevated API error rate across all three components was posted at 08:25 PDT, a fix was in place at 08:44 and the incident closed at 11:48. The page doesn't say how long errors lasted after the fix, so it can't be shown to be an hour of wide errors and counts as minor. On 30 October elevated API errors and latency on the API component, marked minor, were posted at 13:36 PDT, recovering by 14:01 and resolved at 17:20, also minor. We count two majors as 5, between the rubric's 10 for one and 0 for several. Limits published per plan, 600 requests a minute on Flex and 1,000 on Flex Plus, with a 5 RPM penalty mode on Free (15). 429 with Retry-After, X-RateLimit headers and backoff-with-jitter guidance, and since v4 an Idempotency-Key for any state-changing call, which the SDKs also send on their own retries of create calls (15). Enterprise names "guaranteed rate limits with SLA" with no published figure (5 of 10). The v4 API is generally available since 14 October (10).

Memori 45

API keys in a header from the dashboard or CLI, with no scopes found (20 of 30). No read-only mode or per-tool restrictions (4 of 20). Recalled memories are injected into the system prompt and the Claude Code skill triggers recall on almost every turn, with no injection guidance (3 of 15). A dashboard shows memories, retrieval and usage (8 of 15). SECURITY.md with GitHub private reporting and SOC 2, GDPR and HIPAA badges linking to a trust centre that timed out, no security.txt. Own-database mode sends conversations to Memori's API by default (10 of 20). Total 45.

Zep 84

Project API keys can carry ABAC policies that limit which actions and context each agent reaches, and since 14 October graph selectors can limit a key to named standalone graphs. The MCP server uses OAuth 2.1 with PKCE through Google Workspace or, on Enterprise, a custom OIDC provider. We found no key expiry or rotation documentation (27 of 30). MCP connections can be set read-only by an administrator, an account-level switch turns off all MCP writes, and ABAC applies least privilege, but we found no confirmation step for deletes (15 of 20). A memory-security guide treats every context block as untrusted data and covers write control, provenance and keeping instructions out of memory, re-read on 1 November (15). Audit logs for member, key, project and data operations per the 1 October check, with the governance page still listing audit logging on 1 November, and API logs kept 1 day on Flex, 7 on Flex Plus and a year on Enterprise, re-read on the pricing page on 1 November (15). SOC 2 Type II, HIPAA BAA on Enterprise and BYOK, but no security.txt (404 on 1 November), disclosure policy or bug bounty found (12 of 20).

Memori 68

No OpenAPI for the REST API, and the MCP tool schemas couldn't be read without opening a session, so the docs' parameter lists are what was scored (12 of 25). llms.txt with Markdown docs for both modes (10). Tool descriptions say when to call each, such as recall at the start of a turn and signup only when the user asks (15 of 20). Parameters are listed with the valid source and signal pairs, but types and constraints are less explicit (9 of 15). Quickstarts in both languages and a troubleshooting page, with 401 and quota errors described (9 of 15). Keep a Changelog with semantic versioning (13 of 15). Total 68.

Zep 93

OpenAPI 3.1 for v4 (147 paths, server api.getzep.com/api/v4) at help.getzep.com/openapi/sdk-reference.json, reached from the index at help.getzep.com/openapi.json that llms.txt names. The v3 link the listing carried returned 404 on 17 October (25). llms.txt per version, a Markdown copy of every page at .md, and a docs MCP server (10). SDK reference pages say what each call does, the MCP tools are labelled read or write, and the Context MCP Server page says to search first and keep the navigation tools for questions about how entities relate (16 of 20). Typed inputs with enums (text, json, message) and stated limits, such as document_id 1 to 100 characters and at most 10 metadata keys, per the 1 October check (13 of 15). Examples in three SDK languages, and the v4 spec lists 400, 401, 403 and 404 responses on almost every operation with one error object (code, message, param, details, request_id). We found no complete list of codes (14 of 15). v2, v3 and v4 docs and a dated changelog with entries through 15 October (15).

Memori 65

Seven MCP tools with short parameter lists (22 of 25). Recall filters by project, session, date range and source (14 of 20). 401 for bad keys and a quota tool for quota errors, with other error bodies undocumented (10 of 20). No idempotency guidance or tool annotations documented (4 of 20). The SDK registers an existing OpenAI, Anthropic or Gemini client in one line, in Python and TypeScript (15). Total 65.

Zep 87

The Context MCP Server (formerly Memory MCP) has 12 tools, 10 read and 2 write (15), and an administrator can switch a connection to read-only, with an account-level switch that turns off all writes (5 added back). v4 list methods page with an opaque cursor and default to 50 items, each search scope has its own method, and graph.get_subgraph reports truncated and the limit that stopped it (20). Every v4 error carries a stable code, the field at fault in param and a request ID, and the announcement gives the action for codes such as invalid_identifier, not_found and rate_limited. We didn't see the MCP server's error shape or a full code list (18 of 20). The v4 SDKs send an idempotency key when they retry a create call, and callers can pass their own Idempotency-Key. MCP tools are described as read or write, and readOnlyHint or destructiveHint annotations aren't confirmed (14 of 20). SDKs in Python, TypeScript and Go, and an episode add needs only data (15).

Memori 45

No x402, MPP or L402 (0 of 40). Plan prices are public but sales-led, from $60,000 a year (10). A free key with 5,000 augmentations a month, with no card mentioned (20). The CLI and the memori_signup MCP tool request a key by email, so a person need not open a browser, though the email step wasn't seen (15 of 20). Total 45.

Zep 30

No x402, MPP or L402 (0). Credits are priced per unit and public, 1 credit per 350 bytes of episode, overage $25 per 10,000 on Flex and $75 per 40,000 on Flex Plus (20). Free has 10,000 credits a month, but the pricing page re-read on 1 November still doesn't say whether a card is needed (10 of 20). A person signs up in the browser and creates a project key, and the MCP server needs a human identity-provider sign-in (0).