Agent Tree vs Overmind

Agent Tree 50

Framework reading, docs a model can follow, as superpowers was read. types/index.d.ts types the pane's state, and plugin.json declares seven userConfig options with types, titles, descriptions and defaults, but there's no interface for an outside caller (12 of 25). README in English and German, a nine-step GUIDE.md and PRIVACY.md, all Markdown in the repository; no llms.txt (10). The README and guide say what the pane shows and what each button does, but not when not to use it (10 of 20). Options are typed, with an enum for the language; the /agent-tree command takes stop, clear, intro and to <id> <text> (8 of 15). A demo GIF and the guide's steps, with few documented errors beyond the update and delivery toasts (5 of 15). Semver tags but no changelog or release notes read (5 of 15). 50 in all.

Overmind 81

The docs say each deployment serves its OpenAPI schema at /api/schema/, and the repository holds a generated client of 451 files under frontend/src/openapi. api.overmindlab.ai's robots.txt allows only /.well-known/, so the schema itself wasn't read. Every MCP tool takes a Pydantic input model with extra="forbid", compiled to JSON Schema in overbae/services/mcp/catalog.py, read in the source at main on 31 October 2026 (25). llms.txt with 42 pages, llms-full.txt and Markdown for every page on Mintlify (10). Tool descriptions say what each does and what it doesn't ("Does not activate application routing", "no execution", "Passive: never starts provider work"), and the MCP reference warns that an inspection-style name doesn't mean zero cost. Some workbench descriptions are clipped to the point of being hard to parse (16). Typed inputs with Literal enums, length and range bounds, UUID formats and required fields (13). The docs have worked examples for the CLI, SDK, OTLP and inference, and document status classes (401, 402, 403, 404, 409) and structured MCP errors with code, message, retryability and field details, without a full error-code list (10). The MCP server exposes a contract version and a catalogue fingerprint at overmind://interface/current. The SDK changelog has one undated Unreleased section and no product changelog was found (7). 25+10+16+13+10+7 = 81.

Agent Tree 60

Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). No card or account (20). A person installs it with one command and no sign-up (20). 60 in all.

Overmind 30

No x402 or other machine payment. Paid work spends prepaid credits, and 402 is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and create_api_key needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.

Agent Tree 49

Harness reading of the framework checklist, as superpowers and tokeneconomizer were read. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials of its own, and the only request is a daily GET of plugin.json from the main branch carrying nothing about the session. Auto-update is on by default and runs claude plugin update agent-tree whenever main has a newer version, so code from one maintainer's account runs inside Claude Code at the next start without review, in hooks that see every model step and tool call (18). Hooks act only after the person acts in the pane, per PRIVACY.md and the code. Stops, messages and model changes are explicit. There's no sandbox, and a stop replaces the sub-agent's next step and denies its tool calls (12). Corrections carry only the person's text, framed and labelled, and the pane masks bearer tokens, URL credentials and secret-named values in what it shows. No guidance on untrusted content in sub-agent output (9). Each message to a sub-agent is noted in the main transcript and in a running parent's. The event log stays in memory and isn't kept after the session (8). No SECURITY.md, no security.txt and no advisories found; GitHub's security page couldn't be read (2). 49 in all.

Overmind 70

API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes overmind:read and overmind:write, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and overmind://activity returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.

Agent Tree 60

v0.5.4 tagged on 29 October 2026 and a commit on 31 October (30). 19 tags from v0.2.2 (24 October) to v0.5.4 (29 October), far more than three in 90 days (20). Issue and pull-request replies couldn't be read, as github.com was unreachable (5 of 25). Not in Claude's official plugin directory; claude.com/plugins/agent-tree answered 404 (0). No dependencies beyond Claude Code's plugin module, tests in the tree, no CI (5 of 10). 60 in all.

Overmind 76

overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.

Agent Tree 33

Local-package reading, as for superpowers and tokeneconomizer. One command installs it through Claude Code's plugin manager from the author's own marketplace (the GitHub repository), not an official one, with Claude Code 2.1.292 or later stated and 2.1.316 tested (15 of 20). No .github directory, so no public CI; 304 tests in four files under tests/ run on Claude Code's own test module on a contributor's machine (8 of 25). Issues couldn't be read, as github.com was unreachable from this session (5 of 25, unchecked). 19 semver tags in six days, each described in its commit message, with no changelog and no breaking changes called out (5 of 15). Version 0.5.4 (0). 33 in all.

Overmind 23

No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, JEV_REQUESTS_PER_MINUTE and JEV_TOKENS_PER_SECOND, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable request_key, identical retries return the existing receipt, changed payloads conflict, and run_evaluation is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.

Agent Tree 67

Framework reading, how much a coding agent has to carry. The plugin adds no tools, skills or prompt text to the model's context. Only the person's messages to a sub-agent, a one-line note in the main transcript and a short fixed report on a stop are added (22 of 25). Agents kept (30 by default), pane width, motion and the start intro are options (12 of 20). Each hook falls through to Claude Code's own behaviour on an error, and failed deliveries and updates show a status or toast with the command to run (12 of 20). Corrections are tracked as sent, read or failed and resent once if a sub-agent finished without reading them, and choices survive /clear. A stop can't be undone (13 of 20). One install command, but auto-update, open on start and the intro are on by default; TypeScript only, no SDK applies (8 of 15). 67 in all.

Overmind 76

About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, preview_rows bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and evidence_resource links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable request_key on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass project_id on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.