Chroma API + MCP vs OpenSearch

Chroma API + MCP

Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API. CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory.

OpenSearch

OpenSearch 3.9.0 runs vector, text and hybrid search under Apache-2.0, with an OpenAPI 3.1 description of its REST API and API keys limited by permission and index pattern. The owner runs the cluster, no status page or SLA comes with the software, and no tool in the MCP server sets a read-only or destructive annotation.

Chroma API + MCP

1. Don't expose a self-hosted chromadb 1.5.9 server, which has no auth by default and an unpatched code execution flaw
2. Batch writes in groups of 300 or fewer on Chroma Cloud
3. Use the Search API for hybrid ranking. The older query() only does dense search plus filters
4. Pass include without embeddings, since returned GiB are billed
5. Don't pass ollama to chroma_create_collection. The description lists it but the server can't map it

OpenSearch

1. Create the index with index.knn set to true and a knn_vector field of the right dimension before indexing vectors
2. Put the filter clause inside the knn query for filtering during the search. A filter outside it runs afterwards and can return fewer than k hits
3. Ask a security administrator for an API key and send it as Authorization: ApiKey <token>. The token is shown once and lasts 90 days at most
4. Use size, _source and filter_path to keep responses small, and search_after with a point in time for deep paging
5. Set OPENSEARCH_SETTINGS_ALLOW_WRITE=false on the MCP server unless writes are needed. GenericOpenSearchApiTool can call any endpoint