Agent Tree vs Galileo API + MCP

Agent Tree 60

Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). No card or account (20). A person installs it with one command and no sign-up (20). 60 in all.

Galileo API + MCP 20

No x402 or other machine payment (0). Plan prices are public, Pro at $100 a month billed yearly for 50,000 traces, but overage only "scales based on number of traces" (10). The Free plan exists with 5,000 traces a month. The pricing page doesn't say whether a card is needed, so half (10). A person signs up in a browser at app.galileo.ai/sign-up (0).

Agent Tree 50

Framework reading, docs a model can follow, as superpowers was read. types/index.d.ts types the pane's state, and plugin.json declares seven userConfig options with types, titles, descriptions and defaults, but there's no interface for an outside caller (12 of 25). README in English and German, a nine-step GUIDE.md and PRIVACY.md, all Markdown in the repository; no llms.txt (10). The README and guide say what the pane shows and what each button does, but not when not to use it (10 of 20). Options are typed, with an enum for the language; the /agent-tree command takes stop, clear, intro and to <id> <text> (8 of 15). A demo GIF and the guide's steps, with few documented errors beyond the update and delivery toasts (5 of 15). Semver tags but no changelog or release notes read (5 of 15). 50 in all.

Galileo API + MCP 79

OpenAPI 3.1 at api.galileo.ai/public/v2/openapi.json. The copy pinned in the Python SDK on 13 July has 184 paths and 244 operations (25). llms.txt on docs.galileo.ai and on the Splunk docs site, with Markdown pages (10). 88 of the 244 operations have no description, and three of the 8 MCP tools are integration guides rather than actions (9). Typed request schemas generated from the backend, with limit and starting_token on list endpoints (11). The spec declares only 200 and 422 responses, but the Splunk docs carry an error catalogue of 111 entries, each with a code, HTTP status, cause, fix and a retriable flag. Cookbooks give examples (11). Versioned /v2 API and dated release notes, split between docs.galileo.ai (to 7 August) and the Splunk docs (15 September) (13).

Agent Tree 49

Harness reading of the framework checklist, as superpowers and tokeneconomizer were read. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own, and the only request is a daily GET of plugin.json from the main branch carrying nothing about the session. Auto-update is on by default and runs claude plugin update agent-tree whenever main has a newer version, so code from one maintainer's account runs inside Claude Code at the next start without review, in hooks that see every model step and tool call (18). Hooks act only after the person acts in the pane, per PRIVACY.md and the code. Stops, messages and model changes are explicit. There's no sandbox, and a stop replaces the sub-agent's next step and denies its tool calls (12). Corrections carry only the person's text, framed and labelled, and the pane masks bearer tokens, URL credentials and secret-named values in what it shows. No guidance on untrusted content in sub-agent output (9). Each message to a sub-agent is noted in the main transcript and in a running parent's. The event log stays in memory and isn't kept after the session (8). No SECURITY.md, no security.txt and no advisories found; GitHub's security page couldn't be read (2). 49 in all.

Galileo API + MCP 33

API key in a header (Splunk-AO-API-Key in the current spec, Galileo-API-Key in older docs), a JWT from /login/api_key that expires after 24 hours, or HTTP Basic with a username and password, which the docs list as an option. We found no key scopes, expiry or rotation docs (18). Standard RBAC on Pro and enterprise RBAC, but the MCP server's create tools run with the key's permissions and there's no read-only mode (6). Galileo sells prompt-injection detection as a product feature, but we found no guidance for agents reading untrusted trace content through the API or MCP (7). No audit log found (0). No security.txt, no trust page (trust.galileo.ai doesn't resolve, galileo.ai/security is a 404), no SECURITY.md in either SDK repository and no SOC 2, ISO or HIPAA claim on the homepage, pricing page or privacy policy (2).

Agent Tree 33

Local-package reading, as for superpowers and tokeneconomizer. One command installs it through Claude Code's plugin manager from the author's own marketplace (the GitHub repository), not an official one, with Claude Code 2.1.292 or later stated and 2.1.316 tested (15 of 20). No .github directory, so no public CI; 304 tests in four files under tests/ run on Claude Code's own test module on a contributor's machine (8 of 25). Issues couldn't be read, as github.com was unreachable from this session (5 of 25, unchecked). 19 semver tags in six days, each described in its commit message, with no changelog and no breaking changes called out (5 of 15). Version 0.5.4 (0). 33 in all.

Galileo API + MCP 18

No status page found. status.galileo.ai doesn't resolve and neither the homepage, the docs nor the Splunk docs link one (0). With no history to read, 5. No rate limits published for Galileo's own API. The pricing page lists custom rate limits on Enterprise only (0). The error catalogue marks each error retriable or not and the Python SDK raises a named RateLimitError on 429, but the 429 entries cover AI-provider limits, the OpenAPI spec declares no 429 and we found no Retry-After guidance (5). No SLA on any plan (0). The REST API is GA. The MCP server is labelled under construction until it reaches general availability (8).

Agent Tree 60

v0.5.4 tagged on 29 October 2026 and a commit on 31 October (30). 19 tags from v0.2.2 (24 October) to v0.5.4 (29 October), far more than three in 90 days (20). Issue and pull-request replies couldn't be read, as github.com was unreachable (5 of 25). Not in Claude's official plugin directory; claude.com/plugins/agent-tree answered 404 (0). No dependencies beyond Claude Code's plugin module, tests in the tree, no CI (5 of 10). 60 in all.

Galileo API + MCP 74

TypeScript SDK 2.3.2 on 2026-10-01 (30). TypeScript 2.3.0, 2.3.1 and 2.3.2 in September and Python 2.5.0, 2.5.1 and 2.6.0 in July (20). Dated release notes on two sites and Slack support on Pro, but the Python SDK has had no commit since 30 July and the product is mid-migration (8). Official Python and TypeScript SDKs, neither of which references the new Splunk SaaS hosts (10). CI tests, codecov and Dependabot. The Python CHANGELOG.md stops at v0.10.0 from May 2025 while releases have reached 2.6.0, and the TypeScript SDK shipped a breaking rename (logstream to logStreamName) in patch 2.1.2 (6).

Agent Tree 63

MIT, an OSI licence (30). PRIVACY.md is the manifest's privacy page and matches the code. Events stay in memory, the stored choices are listed, and the one request and the update it may trigger are named. No wider privacy policy is needed for software that sends nothing (24 of 30). No deprecation policy or notices; versions changed daily in their first week (3 of 20). No telemetry in the source. The update check is disclosed in the README and PRIVACY.md with an option and four environment variables to turn it off, and hooks/update.ts reads the same switches. It was added and documented on 28 October 2026, a minute apart (20). 77 in all.

Galileo API + MCP 55

Closed platform with terms from Galileo Technologies, Inc. Both SDKs are Apache-2.0 (15). The privacy policy was last updated on 1 November 2024, says data goes to servers in the US, allows de-identified customer data to be used for research and development and gives no retention periods. We found no DPA or subprocessor list (8). The rename to Splunk Agent Observability is dated 7 August 2026 in the release notes, but there's no timeline for api.galileo.ai, docs.galileo.ai or the SDKs (8). US data location stated, no subprocessors listed (5).