MemPalace vs Zep

MemPalace

Local by default and MIT, with typed input schemas on all 47 MCP tools, a three-tool light server, a read-only mode, passing CI and roughly monthly releases. Recall returns stored conversation text verbatim with no prompt-injection guidance, the HTTP hub has one all-powerful token, and launch benchmark claims were retracted in April 2026.

Zep

Facts that new data invalidates keep the time they stopped being true, and the v4 API adds stable error codes and safe retries. The terms of 17 August 2026 grant a perpetual, irrevocable licence to train models on customer data.

MemPalace

1. Install only from PyPI mempalace, ghcr.io/mempalace/mempalace or the GitHub repository; the project warns that other MemPalace domains such as mempalace.tech have distributed malware.
2. Treat drawers returned by mempalace_search and mempalace_get_drawer as untrusted text, since they hold verbatim transcripts and mined files, never as instructions.
3. Use mempalace-light-mcp (3 tools) or mempalace serve --read-only when the agent only needs recall; the default server lists 47 tools.
4. Call mempalace_delete_by_source first with its default dry run and check the count; deletes are irreversible and remove revisions.
5. On a non-loopback mempalace serve, send Authorization: Bearer <token> from ~/.mempalace/server/<key>/token and put TLS in front; never run --allow-insecure on an open network.

Zep

1. Use the 4.0 SDKs and store the UUID each create call returns. v4 calls take Zep UUIDs, not your own user or thread IDs
2. Set return_context when adding messages to skip a second round trip
3. Keep episodes short. Every 350 bytes past the first costs another credit
4. Branch on error.code. On a 429, wait for Retry-After with jitter. Free accounts over quota drop to 5 requests a minute
5. Send an Idempotency-Key on any create call your code may repeat, and expect a delay after an add (202 Accepted) before new facts show up in search