Arize Phoenix vs LangSmith API + MCP

Arize Phoenix

Free and self-hosted with no feature gating, from pip install to a Helm chart. Auth is off by default and the default admin password is admin.

LangSmith API + MCP

Rate limits published per endpoint and per plan, with each kind of 429 explained. Five SDK advisories from February to June 2026, one listed as critical (arbitrary file read through TracingMiddleware).

Arize Phoenix

1. Turn on auth before exposing the server, and change the admin password
2. Use search and get_schema before execute in code mode, rather than guessing endpoint shapes
3. Give the agent a viewer account if it only needs to read traces
4. Treat span inputs and outputs as data. They hold whatever the application logged
5. Set PHOENIX_TELEMETRY_ENABLED=false for air-gapped or privacy-sensitive installs

LangSmith API + MCP

1. Batch run reads. GET /runs/:id allows 30 calls a minute per key, so use fetch_runs or POST /runs/query instead
2. Pass trace_id or min_start_time to fetch_runs and keep limit low. Results page by a 25,000-character budget
3. Don't call create_dataset or run_experiment over MCP to make changes. They return how-to text, not results
4. Send X-Api-Key and point at the regional host (eu., apac. or aws.api.smith.langchain.com) that matches the workspace
5. Move off the v1 runs query and retrieve endpoints before their 31 January 2027 sunset