agents-tree vs Galileo API + MCP

agents-tree 60

Local-package reading, as for agent-tree, superpowers and tokeneconomizer. Installs from PyPI with uv tool install agents-tree or pipx, with Python 3.10 or later and POSIX stated in pyproject.toml and Linux and macOS in the herdr manifest (20). .github/workflows/test.yaml runs pylint, pyright, 173 pytest tests, a test run and a package build on Python 3.10 to 3.14 on every push and pull request. Whether the runs pass wasn't checked, as github.com couldn't be read (15 of 25). Issues couldn't be read for the same reason (5 of 25, unchecked). Semver tags and Conventional Commit messages, but no changelog, and the README's caveat that transcript formats may change is the only note on breakage; the switch to reading every provider by default came with 1.0.0 (5 of 15). Version 1.2.0 (15). 60 in all.

Galileo API + MCP 18

No status page found. status.galileo.ai doesn't resolve and neither the homepage, the docs nor the Splunk docs link one (0). With no history to read, 5. No rate limits published for Galileo's own API. The pricing page lists custom rate limits on Enterprise only (0). The error catalogue marks each error retriable or not and the Python SDK raises a named RateLimitError on 429, but the 429 entries cover AI-provider limits, the OpenAPI spec declares no 429 and we found no Retry-After guidance (5). No SLA on any plan (0). The REST API is GA. The MCP server is labelled under construction until it reaches general availability (8).

agents-tree 60

Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). No card or account (20). A person installs it from PyPI with one command and no sign-up (20). 60 in all.

Galileo API + MCP 20

No x402 or other machine payment (0). Plan prices are public, Pro at $100 a month billed yearly for 50,000 traces, but overage only "scales based on number of traces" (10). The Free plan exists with 5,000 traces a month. The pricing page doesn't say whether a card is needed, so half (10). A person signs up in a browser at app.galileo.ai/sign-up (0).

agents-tree 66

Harness reading of the framework checklist, as agent-tree and superpowers were read. 30 for what leaves the machine and credentials, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No credentials, no network code and no runtime dependencies; PyPI releases are built by trusted publishing with no stored token and wait for a maintainer to approve the pypi environment. It reads every transcript of four agent CLIs, prompts included, and the herdr plugin runs the repository's bundled source rather than a PyPI release (26). Read-only by design. SQLite files are opened with mode=ro, nothing is written to an agent's files, and the only writes are a pane mark (directory 0700, file 0600, O_NOFOLLOW) and herdr's config block with a backup and check. It can't act on an agent (17). Control characters and escape sequences are stripped from every transcript field before a view, and the help warns that output run inside an agent lands in its context, but --json passes prompts and last messages unredacted with no note that they are untrusted (10). It keeps no state or log of its own. The detail view names each transcript's path, and herdr's config keeps a backup (8). No SECURITY.md, no security.txt and no advisories found; GitHub's security page couldn't be read. CI pins third-party actions to commit SHAs with Dependabot on them (5). 66 in all.

Galileo API + MCP 33

API key in a header (Splunk-AO-API-Key in the current spec, Galileo-API-Key in older docs), a JWT from /login/api_key that expires after 24 hours, or HTTP Basic with a username and password, which the docs list as an option. We found no key scopes, expiry or rotation docs (18). Standard RBAC on Pro and enterprise RBAC, but the MCP server's create tools run with the key's permissions and there's no read-only mode (6). Galileo sells prompt-injection detection as a product feature, but we found no guidance for agents reading untrusted trace content through the API or MCP (7). No audit log found (0). No security.txt, no trust page (trust.galileo.ai doesn't resolve, galileo.ai/security is a 404), no SECURITY.md in either SDK repository and no SOC 2, ISO or HIPAA claim on the homepage, pricing page or privacy policy (2).

agents-tree 64

Framework reading, docs a model can follow, as agent-tree was read. --json writes one document with schema_version 1 and a fixed set of session, agent and detail fields, and model.py types them as dataclasses, but no JSON Schema or field reference is published (14 of 25). README, AGENTS.md and docs/demo are Markdown in the repository; no llms.txt (10). The README says what it shows and reads, has a caveats section per provider (context window inference, internal formats, how running sessions are found), and the command's help says not to run it inside an agent (15 of 20). argparse with choices for --provider and --color, positive-number checks for --window and --interval, and --json refused with --watch (10 of 15). Usage examples for every flag, key and column tables, and errors as messages on stderr with exit code 1, with few error outputs documented (10 of 15). Semver tags and a schema version, no changelog (5 of 15). 64 in all.

Galileo API + MCP 79

OpenAPI 3.1 at api.galileo.ai/public/v2/openapi.json. The copy pinned in the Python SDK on 13 July has 184 paths and 244 operations (25). llms.txt on docs.galileo.ai and on the Splunk docs site, with Markdown pages (10). 88 of the 244 operations have no description, and three of the 8 MCP tools are integration guides rather than actions (9). Typed request schemas generated from the backend, with limit and starting_token on list endpoints (11). The spec declares only 200 and 422 responses, but the Splunk docs carry an error catalogue of 111 entries, each with a code, HTTP status, cause, fix and a retriable flag. Cookbooks give examples (11). Versioned /v2 API and dated release notes, split between docs.galileo.ai (to 7 August) and the Splunk docs (15 September) (13).

agents-tree 63

1.2.0 on PyPI on 8 October 2026, 24 days before the check, and a commit on main on 11 October (30). Five PyPI releases between 7 and 8 October 2026 (20). Issue and pull-request replies couldn't be read, as github.com was unreachable. The bare clone shows two Dependabot branches of 28 October unmerged (5 of 25). Not an MCP server and in no official directory; herdr's plugin marketplace couldn't be read (0). No runtime dependencies, a lock file, CI on five Python versions and Dependabot for the workflow actions, with its two updates unmerged (8 of 10). 63 in all.

Galileo API + MCP 74

TypeScript SDK 2.3.2 on 2026-10-01 (30). TypeScript 2.3.0, 2.3.1 and 2.3.2 in September and Python 2.5.0, 2.5.1 and 2.6.0 in July (20). Dated release notes on two sites and Slack support on Pro, but the Python SDK has had no commit since 30 July and the product is mid-migration (8). Official Python and TypeScript SDKs, neither of which references the new Splunk SaaS hosts (10). CI tests, codecov and Dependabot. The Python CHANGELOG.md stops at v0.10.0 from May 2025 while releases have reached 2.6.0, and the TypeScript SDK shipped a breaking rename (logstream to logStreamName) in patch 2.1.2 (6).

agents-tree 62

MIT, an OSI licence (30). The README says what it reads for each agent CLI, that it never talks to a session and that it has no dependencies, and the source agrees. AGENTS.md forbids real session data in the repository. There is no privacy page, though the software sends nothing (22 of 30). No deprecation policy. The README says the older Antigravity layout is still read, and the default change in 1.0.0 came with a major version (5 of 20). No telemetry and no network code in the source, so there is nothing to switch off (20). 77 in all.

Galileo API + MCP 55

Closed platform with terms from Galileo Technologies, Inc. Both SDKs are Apache-2.0 (15). The privacy policy was last updated on 1 November 2024, says data goes to servers in the US, allows de-identified customer data to be used for research and development and gives no retention periods. We found no DPA or subprocessor list (8). The rename to Splunk Agent Observability is dated 7 August 2026 in the release notes, but there's no timeline for api.galileo.ai, docs.galileo.ai or the SDKs (8). US data location stated, no subprocessors listed (5).