Chroma API + MCP vs Qdrant API + MCP

Chroma API + MCP

Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API. CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory.

Qdrant API + MCP

Database keys can be read-only, limited to chosen collections and expire after 90 days by default. The MCP server has 2 tools, can't manage collections or run filtered queries, and last released on 10 December 2025.

Chroma API + MCP

1. Don't expose a self-hosted chromadb 1.5.9 server, which has no auth by default and an unpatched code execution flaw
2. Batch writes in groups of 300 or fewer on Chroma Cloud
3. Use the Search API for hybrid ranking. The older query() only does dense search plus filters
4. Pass include without embeddings, since returned GiB are billed
5. Don't pass ollama to chroma_create_collection. The description lists it but the server can't map it

Qdrant API + MCP

1. Create payload indexes on the fields you filter on, or filtered search slows on large collections
2. Use /points/query with prefetch to fuse dense and BM25 results
3. Pass wait=true on upserts when the next step reads its own writes
4. On 429, wait for the Retry-After seconds before retrying
5. Set with_vector=false unless the task needs vectors, since they dominate response size