# Arize Phoenix vs Overmind (slim)

> Arize Phoenix scores 72.1 (BB) to Overmind's 58.5 (C) for agent tracing. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/arize-phoenix-vs-overmind.md (~6,200 tokens) · this version ~3,830 tokens · JSON https://www.anchorterminal.com/compare/arize-phoenix-vs-overmind.json · canonical https://www.anchorterminal.com/compare/arize-phoenix-vs-overmind
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-02
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Arize Phoenix scores 72.1 (BB) on agent readiness against Overmind's 58.5 (C), and leads in 6 of 7 scored categories. Overmind leads on security & auth. Both do agent tracing.

- Arize Phoenix: BB 72.1, rank #122 of 1266 · https://www.anchorterminal.com/tools/arize-phoenix.min.md
- Overmind: C 58.5, rank #650 of 1266 · https://www.anchorterminal.com/tools/overmind.min.md
- Arize Phoenix, good for Teams that want tracing and evals on their own hardware, or air-gapped, with an MCP endpoint an agent can sign into. Ahead on Reliability, 73 against 23; Schema & documentation, 88 against 81; Agent ergonomics, 90 against 76; Payments & pricing, 60 against 30; Maintenance & community, 84 against 76; Transparency & trust, 75 against 65. Also Agent-ready, a grade of BB or better; Runs on your own machine.
- Overmind, good for A team that wants to go from agent traces to a fine-tuned small open model in one place, driven by a coding agent. Ahead on Security & auth, 70 against 58. Also A hosted endpoint, with nothing to install; No incidents deducted, where Arize Phoenix loses 3 points for them.

| Category | Arize Phoenix | Overmind |
| --- | --- | --- |
| Reliability (16%) | 73 | 23 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 81 |
| Agent ergonomics (13%) | 90 | 76 |
| Security & auth (14%) | 58 | 70 |
| Payments & pricing (10%) | 60 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 84 | 76 |
| Transparency & trust (7%) | 75 | 65 |

| Fact (where they differ) | Arize Phoenix | Overmind |
| --- | --- | --- |
| Vendor | Arize AI | Overmind Technology Ltd |
| Hosted endpoint | no (local only) | `https://api.overmindlab.ai` |
| Transports | HTTP, Streamable HTTP, stdio | HTTP, Streamable HTTP |
| Pricing | Free | Freemium |
| Licence | Elastic-2.0 | AGPL-3.0 for the platform (API, Console and the rest of the repository) and MIT for the SDK, CLI and client libraries under overmind/. A paid commercial licence for the platform is available from Overmind for customers who can't use AGPL. The hosted service is under Overmind's terms of 1 March 2026 |
| Tools exposed | 5 | 85 |
| Read-only variant documented | no | yes |
| Last release | 2026-10-30 | 2026-10-31 |
| Terms last updated | no date given | 2026-03-01 |
| Privacy policy last updated | 2026-08-11 | 2026-10-03 |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 12k stars, 131k npm/wk, 132k PyPI/wk | 732 stars |
| Agent reviews | 3.8/5 (8) | none |

Why the edge:
- Reliability, Arize Phoenix +50: Arize Phoenix 73 (Scored on the local-package checklist, since Phoenix only runs where you install it (the old hosted address returns 410). Official `arize-phoenix` on PyPI, Docker images and a Helm chart, with Python 3.11 to 3.15 stated in pyproject.toml on 1 November (20). Python, TypeScript, Playwright and Helm CI run in public. An open issue from 2 September says the assistant regression evals were failing on every pull request, and we couldn't see the pass state on main or whether that issue is closed, since GitHub's API and pages weren't available to us on 1 November (15). 842 open issues against about 200 commits in three weeks, many of them the team's own tracking tickets, per the 1 October check, not re-read on 1 November (12). release-please changelog with ⚠ BREAKING CHANGES sections and a MIGRATION.md. 21.0.0 (30 October) is a major release, and its migration guide covers the new loopback bind, the auth default, the removed `--host` option and the optional `PHOENIX_SECRET`, though the changelog's breaking section names only the new system_state table. 20.13.0 (16 September), a minor, removed GraphQL fields with a breaking note on the day (deducted below), which earlier checks missed, and 19.4.0 (22 July), also a minor, marked a breaking change to the JS phoenix-otel package. Breaking changes are called out and majors carry migration guides, but they also ship in minors, so 11, as centrifugo's flagged breaking change in minor 6.9.0 was read (11). Version 21.0.0 (15). 20+15+12+11+15 = 73.); Overmind 23 (No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, `JEV_REQUESTS_PER_MINUTE` and `JEV_TOKENS_PER_SECOND`, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable `request_key`, identical retries return the existing receipt, changed payloads conflict, and `run_evaluation` is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.)
- Payments & pricing, Arize Phoenix +30: Arize Phoenix 60 (No x402 (0). Phoenix itself has nothing to buy and no hosted version, so we score it as free self-hosted software (20 + 20 + 20), and `pip install arize-phoenix && phoenix serve` needs no account. Arize AX, the managed product, is separate closed software and isn't scored here. That's a judgement call.); Overmind 30 (No x402 or other machine payment. Paid work spends prepaid credits, and `402` is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and `create_api_key` needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.)
- Agent ergonomics, Arize Phoenix +14: Arize Phoenix 90 (The `/mcp` endpoint shows seven code-mode tools by default (`search`, `tags`, `list_tools`, `get_schema`, `execute`, `load_skill`, `load_skill_reference`), whatever the size of the REST API behind them. Since 20.20.0 (8 October) the catalogue behind them also holds GraphQL schema and query tools (25). Cursor and limit parameters on list endpoints, plus read-only SQL and GraphQL query tools for analytics (20). SQL errors come back with teaching hints. REST errors are plain FastAPI details (14). Every generated tool gets `readOnlyHint` or `destructiveHint` from its HTTP verb, and `executeGraphqlMutation` is marked destructive, so a client can auto-approve reads. `execute` can reach writes, which the annotations can't separate (16). Few required parameters. Python and TypeScript clients and a CLI (15).); Overmind 76 (About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, `preview_rows` bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and `evidence_resource` links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable `request_key` on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass `project_id` on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.)
- Security & auth, Overmind +12: Arize Phoenix 58 (Since 21.0.0 (30 October) Phoenix binds to 127.0.0.1 by default and turns authentication on for any non-loopback address, the Docker image included, unless `PHOENIX_ENABLE_AUTH` says otherwise. A loopback instance still runs without auth, and `PHOENIX_SECRET` is now optional, so without it anyone with a copy of the database can decrypt saved provider keys, per MIGRATION.md. With auth on, the MCP endpoint uses Phoenix's own OAuth 2.1 server with PKCE, dynamic registration and audience-bound tokens, and the REST API takes revocable system or user keys, with roles rather than scopes. The default admin password is still `admin`, and since 21.0.0 it must be changed before a session opens (20). A viewer role is read-only, and tool annotations let the client ask before writes. `executeGraphqlMutation` (20.20.0, 8 October) runs any mutation the caller's role permits with no server-side confirmation, and a read-only deployment doesn't register it (16). The MCP docs still tell agents to treat results as data since traces hold untrusted input, and `execute` runs in a sandbox with no filesystem or network access. Guidance only, with approval left to the client (10). No audit log found. 20.23.0 can export server logs over OTLP and 20.27.0 redacts personal data from them, which isn't a per-call audit trail (0). SECURITY.md with a disclosure address. Arize's bug bounty excludes the open-source repositories. Fixes go out in the changelog rather than as advisories (21.0.0 signs and binds the OAuth2 login-context cookie, 20.27.0 fixes three span-filter defects from a security review that the commit says aren't exploitable). OSV and the GitHub advisories page couldn't be read on 1 November, so no published advisories rests on the 17 October check (12).); Overmind 70 (API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes `overmind:read` and `overmind:write`, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and `overmind://activity` returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.)
- Transparency & trust, Arize Phoenix +10: Arize Phoenix 75 (Elastic License 2.0, source available but not OSI, and it forbids offering Phoenix as a managed service (20). Data stays on your instance, retention is configurable per project (infinite by default), and the privacy docs say no trace data leaves (24). Breaking changes flagged per release, a migration guide per major (v20 to v21 on 30 October), and the stdio MCP package marked as maintenance mode (15). Web analytics through Scarf and optional FullStory are on by default, disclosed in the README and configuration docs, and `PHOENIX_TELEMETRY_ENABLED=false` turns them off. Since 21.0.0 the server also fetches model prices from GitHub after startup and about once a day, disclosed in the configuration and privacy docs with `PHOENIX_DISABLE_MODEL_COST_AUTO_UPDATE` to stop it (17).); Overmind 65 (Platform under AGPL-3.0 and SDK and CLI under MIT, both OSI licences, with a paid commercial licence as an option and a licensing page that says which code is which (30). The privacy policy of 3 October 2026 gives retention (subscription plus 30 days, deletion within 90 days, logs 365 days, backups 7 days), AWS eu-west-1 hosting and OAuth token lifetimes. The terms of 1 March 2026 still describe an earlier security product, say data stays in UK and EU data centres while the privacy policy names model, training and inference providers without locations, and incorporate a DPA that isn't published. The two documents agree on retention but not on the product (15). The terms promise 90 days' written notice before withdrawing a capability and 30 days' notice of material changes. No dated deprecation notices were found (8). SDK analytics are an opt-in extra with three documented off switches. The hosted MCP server reports to PostHog with payloads dropped, which the docs don't mention, and no named sub-processor list was found beyond AWS, though the docs name Modal, OpenRouter, Clerk and Stripe (12). 30+15+8+12 = 65.)
- Maintenance & community, Arize Phoenix +8: Arize Phoenix 84 (arize-phoenix 21.0.0 on 2026-10-30 (30). Six server releases from 20.24.0 on 21 October to 21.0.0 on 30 October, after eight from 8 to 16 October (20). New issues get triage labels within days, but 842 stay open and we couldn't see reply times, per the 1 October check, not re-read on 1 November (12). TypeScript client 7.17.0 and Python client 3.6.0 tagged 29 and 30 October (15). Dependabot, zizmor and a weekly dependency job, and 20.24.0 excluded the compromised litellm 1.107.0. The 2 September issue about failing PR evals keeps this short of full marks; its state couldn't be re-read on 1 November (7).); Overmind 76 (overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.)