Baserun vs Overmind

Baserun 0

Last releases were PyPI 2.0.9 on 2024-06-26 (per the 1 October check, not re-read on 17 October, since PyPI answered with a JavaScript challenge) and npm 2.1.3, still the latest on 17 October, both more than two years old (0). No releases in the last 90 days (0). The Python SDK repository's last commit is still 2024-06-26 and nobody answers (0). SDKs aren't current (0). No CI beyond a pre-commit workflow (0).

Overmind 76

overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.

Baserun 5

Nothing can be called. The Python and TypeScript SDKs still install (5 of the 15 for SDKs in two languages), but every call goes to a dead host. No sizing, pagination, error or retry behaviour to assess (0).

Overmind 76

About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, preview_rows bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and evidence_resource links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable request_key on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass project_id on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.

Baserun 15

Scored on what's left. docs.baserun.ai still serves an llms.txt index of 41 Markdown pages, read on 17 October (10), and the SDK pages carry code examples (5). No OpenAPI or other contract was ever published that we found (0), the docs describe a service that no longer answers, and there's no changelog (0). The llms.txt still links a changelog at www.baserun.ai, which fails the TLS handshake.

Overmind 81

The docs say each deployment serves its OpenAPI schema at /api/schema/, and the repository holds a generated client of 451 files under frontend/src/openapi. api.overmindlab.ai's robots.txt allows only /.well-known/, so the schema itself wasn't read. Every MCP tool takes a Pydantic input model with extra="forbid", compiled to JSON Schema in overbae/services/mcp/catalog.py, read in the source at main on 31 October 2026 (25). llms.txt with 42 pages, llms-full.txt and Markdown for every page on Mintlify (10). Tool descriptions say what each does and what it doesn't ("Does not activate application routing", "no execution", "Passive: never starts provider work"), and the MCP reference warns that an inspection-style name doesn't mean zero cost. Some workbench descriptions are clipped to the point of being hard to parse (16). Typed inputs with Literal enums, length and range bounds, UUID formats and required fields (13). The docs have worked examples for the CLI, SDK, OTLP and inference, and document status classes (401, 402, 403, 404, 409) and structured MCP errors with code, message, retryability and field details, without a full error-code list (10). The MCP server exposes a contract version and a catalogue fingerprint at overmind://interface/current. The SDK changelog has one undated Unreleased section and no product changelog was found (7). 25+10+16+13+10+7 = 81.

Baserun 5

The old credential model was one project API key read from BASERUN_API_KEY (no longer accepted anywhere, 0). No security policy, security.txt or certification found (0). The risk that remains is the SDK default. baserun on PyPI sends trace data to https://app.baserun.ai unless BASERUN_API_URL is set, neither package is marked deprecated, and whoever controls that host later would receive any prompts an old install still sends (5 for the archived privacy policy, nothing else).

Overmind 70

API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes overmind:read and overmind:write, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and overmind://activity returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.

Baserun 0

No longer sold (0 on every line). There's no way to buy, try or get a key, and no x402 or other machine payment (0).

Overmind 30

No x402 or other machine payment. Paid work spends prepaid credits, and 402 is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and create_api_key needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.

Baserun 36

The SDKs are MIT, copyright Mochi Labs, Inc., and the platform was closed with terms that now survive only in Internet Archive copies (10). No statement on what happened to customer trace data after shutdown (0). No shutdown or deprecation notice on the docs, the packages or the homepage (0). No subprocessor list that we could load (0).

Overmind 65

Platform under AGPL-3.0 and SDK and CLI under MIT, both OSI licences, with a paid commercial licence as an option and a licensing page that says which code is which (30). The privacy policy of 3 October 2026 gives retention (subscription plus 30 days, deletion within 90 days, logs 365 days, backups 7 days), AWS eu-west-1 hosting and OAuth token lifetimes. The terms of 1 March 2026 still describe an earlier security product, say data stays in UK and EU data centres while the privacy policy names model, training and inference providers without locations, and incorporate a DPA that isn't published. The two documents agree on retention but not on the product (15). The terms promise 90 days' written notice before withdrawing a capability and 30 days' notice of material changes. No dated deprecation notices were found (8). SDK analytics are an opt-in extra with three documented off switches. The hosted MCP server reports to PostHog with payloads dropped, which the docs don't mention, and no named sub-processor list was found beyond AWS, though the docs name Modal, OpenRouter, Clerk and Stripe (12). 30+15+8+12 = 65.