Chroma API + MCP vs LanceDB

Chroma API + MCP

Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API. CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory.

LanceDB

Embedded, no server, and tables can live directly in S3, GCS or Azure storage. No self-serve hosted API. Enterprise is sold through a contact form.

Chroma API + MCP

1. Don't expose a self-hosted chromadb 1.5.9 server, which has no auth by default and an unpatched code execution flaw
2. Batch writes in groups of 300 or fewer on Chroma Cloud
3. Use the Search API for hybrid ranking. The older query() only does dense search plus filters
4. Pass include without embeddings, since returned GiB are billed
5. Don't pass ollama to chroma_create_collection. The description lists it but the server can't map it

LanceDB

1. Use it through the Python or TypeScript library. There's no public endpoint an agent can call without an Enterprise deployment
2. Build an FTS index before calling query_type="hybrid", or hybrid search has no keyword side
3. Call optimize() after many small writes, since each write adds a new file version
4. Use select() to drop the vector column from results unless the task needs it
5. On object storage, set a read consistency interval if several processes write the same table