Capability Index — Agent Memory Atlas

The comparative report says what each system does. This page answers the other question — which systems actually have X — for the seven mechanisms whose absence causes a failure the system cannot detect.

Marks come from each report's frontmatter, so this table cannot drift from the reviews. A tick means the mechanism was found in code at that report's pinned commit; a dash means it was not found, which is different from impossible, planned, or badly built. The definitions, the evidence threshold, and why these seven rather than others are on the atlas rubric.

Read the of 7 column as a shape, not a score. Three quarters of the systems here carry none or one, so a low number is the ordinary case rather than a poor one, and most of these columns are outside what most of these systems set out to do. A local coding agent that never claimed to arbitrate truth is not failing by carrying one mark. The column is worth sorting on only when you already know which mechanism you need.

Filters combine with and — "tombstone and scope enforced" is the question worth asking, and it is the one a per-column view cannot answer.

Has

System	Tombstone	Trust state	Bi-temporal	Scope	Audit	Review	Neg. evals	of 7
A-MEM	—	—	—	—	—	—	—	0
Acontext	—	—	—	✓	—	✓	—	2
Google ADK	—	—	—	✓	—	—	—	1
agent-afk	—	—	—	—	—	—	✓	1
Microsoft Agent Framework	—	—	—	✓	—	—	—	1
Agent Memory on Supabase	—	—	✓	✓	—	—	—	2
agentmemory	—	—	—	✓	—	—	—	1
AgentRecall-X	—	✓	—	✓	—	—	—	2
AgentSwarms	—	—	—	✓	—	✓	—	2
Agno	—	—	—	✓	—	✓	✓	3
ai-memory	—	—	—	✓	—	—	—	1
Atomic Agent	—	—	✓	—	—	—	—	1
Aukora Kernel	—	—	—	✓	✓	—	✓	3
Aura	—	✓	—	—	✓	—	—	2
AutoGen	—	—	—	—	—	—	—	0
Basic Memory	—	—	—	✓	—	—	—	1
Buzz	—	—	—	✓	—	—	—	1
ByteRover	—	—	—	—	—	—	—	0
CAMEL	—	—	—	—	—	—	—	0
Claude-Mem	—	—	—	✓	—	—	—	1
CLIO	—	✓	—	—	—	✓	—	2
Cognee	—	—	—	✓	—	—	—	1
Core Memory	—	✓	✓	✓	—	✓	—	4
Cortex	—	—	—	✓	—	✓	—	2
Cosmonapse	—	—	—	—	—	—	—	0
CowAgent	—	—	—	✓	—	—	—	1
CrewAI	—	—	—	✓	—	—	✓	2
CSM	—	—	—	✓	✓	—	✓	3
ctx	—	—	—	✓	✓	—	—	2
Daimon	✓	✓	—	✓	✓	✓	✓	6
Dexto	—	—	—	—	—	✓	—	1
ECC	—	—	—	✓	—	—	—	1
Elastic Atlas	—	—	—	✓	—	—	—	1
Empryo	—	—	—	✓	—	✓	—	2
Engram	—	—	—	✓	—	✓	—	2
EverOS	—	—	—	✓	—	—	✓	2
Generative Agents	—	—	—	—	—	—	—	0
GenericAgent	—	—	—	—	—	—	—	0
Gini Agent	—	✓	✓	✓	—	—	—	3
GitLord	—	—	—	—	—	—	—	0
Gobii	—	—	—	✓	—	—	—	1
GoodAI LTM	—	—	—	—	—	—	—	0
Graphify	—	✓	—	—	—	—	✓	2
Graphiti	—	—	✓	✓	—	—	—	2
Helm	—	—	—	—	—	—	✓	1
Hermes Agent	—	—	—	—	—	✓	—	1
Hindsight	—	—	—	✓	—	—	—	1
HippoRAG	—	—	—	—	—	—	—	0
Holographic	—	—	—	—	—	—	—	0
Honcho	—	—	—	✓	—	—	—	1
Juggler	—	—	—	—	—	✓	—	1
LangMem	—	—	—	✓	—	—	—	1
Lethe	—	—	—	—	✓	—	✓	2
Letta	—	—	—	✓	—	—	—	1
LivingFeed	—	—	—	✓	—	—	—	1
LlamaIndex	—	—	—	—	—	—	—	0
llm-wiki-memory	—	—	—	✓	—	✓	—	2
Logseq	—	—	—	—	—	—	—	0
LoongFlow	—	—	—	—	—	—	—	0
LoreKit	—	—	—	✓	✓	✓	—	3
Magic Context	—	✓	—	✓	✓	—	—	3
Mastra Observational Memory	—	—	—	✓	—	—	—	1
MateClaw	—	—	—	✓	—	—	—	1
Mem0	—	—	—	✓	✓	—	—	2
Mem0Sharp	—	—	—	✓	✓	—	—	2
Memanto	—	—	—	✓	—	✓	—	2
Memary	—	—	—	—	—	—	—	0
Membase	—	—	—	✓	—	—	—	1
Memento	—	—	—	✓	—	—	—	1
MeMex Zero-RAG	—	—	—	—	—	—	—	0
MemLedger	—	✓	—	—	✓	—	—	2
MemMachine	—	—	—	✓	—	—	—	1
Memobase	—	—	—	✓	—	—	—	1
Memora	—	—	—	—	✓	✓	—	2
Memori	—	—	—	✓	—	—	—	1
Memory Engine	—	—	✓	✓	—	—	—	2
MemoryOS	—	—	—	—	—	—	—	0
MemOS	—	—	—	✓	—	—	—	1
MemPalace	—	—	—	✓	—	—	—	1
memU	—	—	—	—	—	—	—	0
Memvid	—	—	✓	—	✓	—	—	2
Mercury Agent	—	—	—	—	—	✓	—	1
MetaClaw	—	—	—	✓	—	—	—	1
MineContext	—	—	—	—	—	—	—	0
MIRIX	—	—	—	✓	—	—	✓	2
Mnemopi	—	—	—	—	—	—	✓	1
Moltis	—	—	—	—	—	—	—	0
nanobot	—	—	—	—	—	—	—	0
Project N.E.K.O.	—	—	—	✓	✓	—	✓	3
NemoClaw	—	—	—	—	—	—	—	0
Neo4j Agent Memory	—	—	✓	✓	—	—	—	2
NOOA Memory	—	—	—	✓	—	—	—	1
npcpy	—	✓	—	—	—	✓	—	2
open-cowork	—	—	—	—	—	—	✓	1
OpenClaw	—	—	—	✓	—	—	—	1
OpenCode	—	—	—	—	—	—	—	0
OpenHuman	—	—	—	✓	—	—	—	1
OpenViking	—	—	—	✓	—	—	—	1
OpenWorker	—	—	—	✓	—	—	—	1
OpenYak	—	—	—	✓	—	✓	—	2
OptMem	—	—	—	—	✓	—	—	1
Palazzo	—	—	—	—	✓	—	—	1
Pi	—	—	—	—	—	—	—	0
PowerMem	—	—	—	✓	—	—	—	1
Project Golem	—	—	—	—	—	—	—	0
Pydantic AI Harness	—	—	—	✓	—	—	✓	2
Qwen Code	—	—	—	✓	—	✓	—	2
RainBox	✓	✓	—	✓	—	✓	—	4
Redis Agent Memory Server	—	—	—	✓	—	—	—	1
ReMe	—	—	—	—	—	—	—	0
RisuAI	—	—	—	—	—	✓	—	1
Second Me	—	—	—	—	—	✓	—	1
SillyTavern	—	—	—	—	—	—	—	0
SimpleMem	—	—	—	✓	✓	—	—	2
Skales	—	—	—	—	—	—	—	0
Soul of Waifu	—	—	—	—	✓	—	—	1
Supermemory	—	—	—	✓	—	—	—	1
Swafra	—	—	—	—	—	—	—	0
TencentDB Agent Memory	—	—	—	—	—	—	—	0
TERSE Memory	—	✓	—	—	—	—	—	1
TigrimOSR	—	✓	—	✓	—	✓	—	3
TokenMizer	—	✓	—	—	✓	—	—	2
Universal Memory Engine	✓	✓	—	✓	✓	✓	✓	6
Verel	✓	✓	✓	✓	✓	✓	✓	7
VirtualWife	—	—	—	—	—	—	—	0
Voyager	—	—	—	—	—	—	—	0
Waku Agent	—	—	—	—	—	—	—	0
Z-Waif	—	—	—	—	—	—	—	0
ZeroStack	—	—	—	—	—	—	—	0

Reading the counts

A system with six ticks is not better than one with two. It is differently shaped. Memory Engine governs access more thoroughly than anything else here and knows nothing about whether a memory is true; OptMem carries one mark and is among the most carefully reasoned designs in the corpus. Several systems carry a dash on a capability their design deliberately does not need.

Three things the counts show that the reports individually do not:

Read-path scoping is common; correction is not. Over half the atlas applies a scope key when retrieving. Three systems carry a value-level tombstone. That gap is the atlas's central finding, and it is visible here in one column pair.

Trust is usually a number, not a state. Most systems collapse "how sure am I" into "how findable is this" — see decay and reinforcement.

Negative evidence is almost never tested. Sixteen repositories of one hundred and twenty-nine assert that particular material must not be retrieved — the assertion every scope, deletion and correction claim in this atlas ultimately rests on. Read together rather than one at a time, they split cleanly in two, and the split says more than the count.

Four assert a boundary: that a principal cannot retrieve another principal's material. MIRIX's test_filter_tags_db.py creates a memory under one scope, searches under another, and asserts the id is absent. Aukora Kernel does it better — an unrelated principal reads ok: false, a subject whose delegation manifest was revoked reads ok: false, and the owner reads "the secret" in the same block, so the denial is proved targeted rather than a blanket failure. EverOS does it at the endpoint: two owners, the same query string, assert c_ids.isdisjoint(m_ids) plus a positive control on each side, repeated for two agent owners sharing a keyword. CrewAI does it over a path hierarchy: three records under /other/scope, /crew/crew-a/inner and /crew/crew-b/inner, a Memory opened with root_scope="/crew/crew-a", and an assertion that recall returns exactly one result and it is the rooted one.

All four of those systems also hold scope_enforced. Their negative suites are therefore tests of a capability the same system already claims — which is worth having, and is not evidence about deletion or correction.

Nine assert about content: that particular material must not surface to anyone entitled to search, regardless of who is asking. open-cowork's forbiddenHits is an eval-harness field naming what a query must not return, scored as a penalty. Verel's tests/test_memory_negative_eval.py asserts a REJECTED fact is invisible to every recall path — a suite built from the red-team finding that produced its tombstone. Project N.E.K.O.'s test_hard_filter_drops_negative_score asserts that an entry the user disputed is dropped before the rerank, the docstring giving the reason: "Stage-2 would either reinforce the dispute or, worse, cancel it." Helm is the fourth and the weakest of them: its supersede case asserts recall returns exactly one active row and fails with "recall returned old value" if the replaced one appears. The value is still in the table and still readable through history, so this is a genuine read-path exclusion — but it covers replacement only. Helm's other two exits, forget and the confidence-floor prune, are hard deletes with nothing asserted about them, which is the case where a re-derivation would actually reinstate the value. Agno is the same shape against a judged verdict — a retired fact absent from live_facts() while both rows remain in the record. The Pydantic AI Harness is the sixth and asserts it about the prompt rather than the store: test_delete_existing_is_content_free requires a deleted body to be absent from the tool result, a search test requires all('secret' not in repr(match)) under a character budget, and two injection tests require a superseded line and a stale fact not to appear in the captured model context.

Only these nine probe the question the atlas is actually asking. A boundary test proves the filter works; a content test proves a value that was rejected, disputed or forbidden stays gone. Eleven of one hundred and twenty-nine is the real figure for the second kind, and the two newest raise a distinction the others do not: a test that a superseded value stays hidden is cheap, because the row is still there to be filtered on. The expensive assertion is that a value the system destroyed does not come back — which requires something durable to check against, and is why the tombstone column and this one keep appearing together.

Two further things the joint reading shows. The positive control — asserting that the denial is targeted rather than an empty result — appears in Aukora and EverOS and is absent from the rest, and a negative test without one passes just as well when retrieval is broken. And the assertion shape is reachable from ordinary engineering practice: three of the six arrived from access-control work rather than from memory research, and one, N.E.K.O., from a companion app where re-raising something the user asked you to drop is a product failure rather than a data-quality one.

Near-misses

Strictness is what makes the counts mean anything, and it hides the interesting cases. The ones worth knowing:

claude-mem has "tombstones" that synchronize row deletion across stores — not a rejected-value tombstone.
Mercury grades confidence three ways and has no discrete state.
Of the four trust-state systems, only Verel, RainBox and Gini carry an explicitly rejected state; Magic Context qualifies on stale and flagged.
RainBox's RetrievalEvent and Atomic Agent's vote_events are append-only logs of use and feedback, not of mutation.
ai-memory, nanobot and Basic Memory get an audit trail from git, which is a real mechanism and a different one.
Memanto resolves conflicts with a human and then deletes without a tombstone — the most carefully reasoned correction in the atlas, and the next extraction pass may undo it.
Daimon is the weakest of the three tombstones, and the flag is granted on mechanism rather than on hardening: it suppresses on the read path rather than refusing the write, and its key is a hash of the item's exact text, so a paraphrase defeats it where Verel's normalized key would not. It is also the only holder with no test that re-asserts a forgotten value.