agents-tree vs Braintrust API + MCP

agents-tree 63

1.2.0 on PyPI on 8 October 2026, 24 days before the check, and a commit on main on 11 October (30). Five PyPI releases between 7 and 8 October 2026 (20). Issue and pull-request replies couldn't be read, as github.com was unreachable. The bare clone shows two Dependabot branches of 28 October unmerged (5 of 25). Not an MCP server and in no official directory; herdr's plugin marketplace couldn't be read (0). No runtime dependencies, a lock file, CI on five Python versions and Dependabot for the workflow actions, with its two updates unmerged (8 of 10). 63 in all.

Braintrust API + MCP 85

TypeScript SDK braintrust 3.36.0 and Python SDK 0.44.0, both on 2026-10-01 (30). 15 TypeScript and 19 Python releases since 16 July (20). The product changelog lists dozens of September entries and both SDK repositories take outside contributions credited in the changelog. We didn't load issue reply times (12). Official SDKs in six languages, current (15). Public CI (checks.yaml), integration tests, Dependabot and a weekly dependency job. We didn't confirm the pass state (8).

agents-tree 64

Framework reading, docs a model can follow, as agent-tree was read. --json writes one document with schema_version 1 and a fixed set of session, agent and detail fields, and model.py types them as dataclasses, but no JSON Schema or field reference is published (14 of 25). README, AGENTS.md and docs/demo are Markdown in the repository; no llms.txt (10). The README says what it shows and reads, has a caveats section per provider (context window inference, internal formats, how running sessions are found), and the command's help says not to run it inside an agent (15 of 20). argparse with choices for --provider and --color, positive-number checks for --window and --interval, and --json refused with --watch (10 of 15). Usage examples for every flag, key and column tables, and errors as messages on stderr with exit code 1, with few error outputs documented (10 of 15). Semver tags and a schema version, no changelog (5 of 15). 64 in all.

Braintrust API + MCP 85

OpenAPI 3.0.3 with 75 paths and 234 operations at /docs/openapi.json, pinned and refreshed weekly in the Python SDK repo (25). llms.txt with about 500 entries, every page served as Markdown (10). The MCP docs give a one-line purpose for each of the 42 tools and mark the test_* tools as dry runs, but say little about when not to use a tool. The MCP server is closed source, so we read the docs rather than the definitions (13). Typed OpenAPI schemas with pagination parameters and enums, though sql_query takes free-form SQL and event payloads are free-form by nature (11). 400, 401, 403, 429 and 500 responses are declared on most operations, but only 4 of 234 operations carry an inline example. The cookbook fills some of the gap (11). Versioned /v1 API, a monthly product changelog, a data-plane changelog and per-SDK changelogs (15).

agents-tree 60

Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). No card or account (20). A person installs it from PyPI with one command and no sign-up (20). 60 in all.

Braintrust API + MCP 40

No x402 or other machine payment (0). Usage prices published without login, $4 a GB and $2.50 per 1,000 scores on Starter, $3 and $1.50 on Pro (20). Starter is free with no card (20). A person signs up in a browser to create a key. The MCP OAuth flow also needs a browser sign-in (0).

agents-tree 66

Harness reading of the framework checklist, as agent-tree and superpowers were read. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials, no network code and no runtime dependencies; PyPI releases are built by trusted publishing with no stored token and wait for a maintainer to approve the pypi environment. It reads every transcript of four agent CLIs, prompts included, and the herdr plugin runs the repository's bundled source rather than a PyPI release (26). Read-only by design. SQLite files are opened with mode=ro, nothing is written to an agent's files, and the only writes are a pane mark (directory 0700, file 0600, O_NOFOLLOW) and herdr's config block with a backup and check. It can't act on an agent (17). Control characters and escape sequences are stripped from every transcript field before a view, and the help warns that output run inside an agent lands in its context, but --json passes prompts and last messages unredacted with no note that they are untrusted (10). It keeps no state or log of its own. The detail view names each transcript's path, and herdr's config keeps a backup (8). No SECURITY.md, no security.txt and no advisories found; GitHub's security page couldn't be read. CI pins third-party actions to commit SHAs with Dependabot on them (5). 66 in all.

Braintrust API + MCP 58

User API keys and service tokens as Bearer tokens. Service tokens attach to permission groups that can be scoped to single projects on any plan, keys can be deleted through /v1/api_key and /v1/service_token, and the MCP server also takes OAuth 2.0 with dynamic client registration (25). Viewer groups exist, but the MCP server gained write tools in August with no server-side read-only mode, and the docs leave confirmation to the client (12). Traces hold whatever the application logged, and we found no prompt-injection guidance for agents reading them (3). The October changelog mentions audit logging, and a knowledge-base page says org-wide API key auditing is in the UI only (8). SOC 2 Type II is claimed on the pricing page. The Vanta trust centre at trust.braintrust.dev rendered nothing readable to us, there's no security.txt and no SECURITY.md in either SDK repository, and the two credential-capture fixes below were explained in knowledge-base pages rather than advisories (10).

agents-tree 73

Framework reading, how much an agent has to carry. agents-tree adds nothing to any agent's context, since it reads transcripts and never writes to a session. Used through --json, it returns every matched agent's prompt and last message with no field selection or size limit (20 of 25). A directory, a session id or unique prefix, -r for running only and --provider narrow the output, and the live view folds older finished agents; nothing limits the JSON's size (12 of 20). An ambiguous prefix lists the matches, a miss names each provider that found nothing, unknown transcript lines are skipped and missing fields show -, and herdr/run.sh names the Python it needs (14 of 20). Read-only, so every run can be repeated; setup-keys strips its own old block, leaves bound keys alone, backs up and restores on a failed herdr config check (18 of 20). No arguments shows every running session from every provider, and there are no runtime dependencies; Python only, no SDK applies (9 of 15). 73 in all.

Braintrust API + MCP 66

42 MCP tools load at once, with no toolsets or server-side allowlist found (5). REST lists take limit, starting_after and ending_before, and sql_query truncates field values to 1,024 characters by default and swaps results over 1 MB for a signed overflow_url (20). Error codes are declared per operation, the MCP server returns 413 above 100 MiB, and 429 carries Retry-After. Error bodies are typed as plain text (14). Event inserts upsert on id and ACL batch updates are documented as idempotent. Several MCP tools have a no-write test_* twin. We couldn't see whether the hosted tools carry readOnlyHint or destructiveHint (12). Few required parameters, and SDKs in TypeScript, Python, Go, Java, Ruby and C# (15).