Comparison
Agent NAS is not meant to replace these approaches. Most neighbouring work is good at what it does and can become a part of it. We try to be honest about what is borrowed and what is genuinely new.
The landscape
| Category | Examples | What it already does | Where it stops |
|---|---|---|---|
| NAS vendors’ management agents | QNAP QuAgent, Synology DSM Agent, TrueNAS MCP | Manage the box in natural language; reuse user permissions; confirm dangerous operations twice; logs. | Aimed at “managing”, not at “working in the data”; no run-level leases, branches or memory contract. |
| Agent file systems and Git | Turso AgentFS, Letta Context Repositories, Cloudflare Artifacts, Redis Agent Filesystem | Put files, state and tool-call audit into portable storage; Git-versioned memory; Git for agents. | Each is tied to one runtime or platform; authorization, approval, taint and forgetting mostly sit outside. |
| Forkable object storage and data version control | Tigris Agent Kit, lakeFS | Copy-on-write forks, checkpoints, protected branches, scoped credentials, pre-merge hooks. | Aimed at data lakes and cloud object storage; no memory or lease semantics, and no human approval experience. |
| Memory frameworks | Letta, Mem0, Zep/Graphiti, OpenClaw memory architecture | Retrieval, consolidation, temporal graphs; OpenClaw already has provenance labels and quarantine. | Mostly bound to one framework; the index and the truth are not separated; migration and deletion are hard. |
| Sandboxes and runtimes | E2B, Daytona, Vercel Sandbox | Isolated compute and snapshots. | Storage is not the focus; state disappears with the sandbox. |
| General-purpose storage | S3 and S3 Files, NFS, SMB, Git | Durable, mature, with a complete ecosystem. | Does not know “run”, “lease” or “taint”. |
The gap. Every part has been built by someone. What we do not see is a self-hosted, open, testable contract that combines them, with the run as the unit, binding branches, leases, approval, records, memory and forgetting together, and with conformance tests attached. We do not claim that nobody has done any one of these things; that is exactly why we borrow so much.
How it relates to neighbouring approaches
| Approach | Good at | Relation to Agent NAS |
|---|---|---|
| QNAP QuAgent, Synology DSM Agent, TrueNAS MCP | Managing a NAS in natural language | Complementary; their boxes can be the foundation of an Overlay. |
| Turso AgentFS, Redis Agent Filesystem, LayerFS | Agent file systems | Can serve as Store engines; Agent NAS adds the contract on top. |
| Letta Context Repositories | Git-backed memory | Agent Home borrows its layout ideas; Letta can be a runtime for Agent Memory. |
| Cloudflare Artifacts, Tigris, lakeFS | Forkable, versioned storage | Can be used directly as Store engines. |
| Mem0, Zep/Graphiti | Memory retrieval and consolidation | Can be indexers, that is, producers of derivatives. |
| OpenClaw memory architecture | Provenance labels and quarantine | A forerunner; we put the same ideas in the shared storage layer. |
| S3, S3 Files, NFS, SMB | General-purpose storage | Can serve as the Store; they do not know runs, leases or taint. |
| E2B, Daytona, Vercel Sandbox | Isolated compute | Complementary; they should be used together. |
What we borrowed
- From Git and lakeFS: branches, protected branches, pre-merge hooks.
- From Letta and Cursor: files are the interface agents know best, and context should be disclosed progressively.
- From OpenClaw and memory-security research: provenance cannot be forged, and untrusted memory is quarantined.
- From Meta’s Rule of Two, CaMeL and Fides: limit consequences outside the model.
- From OAuth (RFC 8693, RFC 9396), Biscuit and UCAN: token exchange and attenuating authorization.
- From OpenTelemetry and Certificate Transparency: exportable traces and discoverable tampering.
- From Anthropic’s auto-mode research: keep approvals few, and put them on plans and merges.
What is genuinely new
We try to be honest about it. The list is short:
- Using the run as the unit, binding branch, lease, budget and record together.
- The read manifest and session taint: enforcing the Rule of Two at the storage boundary.
- Memory writes that carry provenance and taint, and the trust boundary of “autoload only when reviewed”.
- Retention classes: making “recoverable” versus “forgettable” an explicit choice.
- A conformance ladder with executable acceptance tests.
A judgement that still has to be proven
Everything else, including branches, tokens, logs and retrieval, is a combination of existing techniques. We believe that combining them into an open, testable contract has value of its own, but that is a judgement that still has to be proven, not an established fact.
Cite this page
Stable addresses and a suggested citation for people, search engines and agents.
- Canonical URL
- https://agentnas.com/compare/
- Markdown version
- https://agentnas.com/compare/index.md
- Suggested citation
- Agent NAS project. “Comparison.” agentnas.com, 2026-11-11. https://agentnas.com/compare/