{ "data": { "a": { "slug": "chroma", "name": "Chroma API + MCP", "vendor": "Chroma", "vendorUrl": "https://www.trychroma.com", "kind": "http-api", "category": "vector-search", "summary": "Open-source retrieval database that runs in-process, as a local server or as Chroma Cloud, a serverless hosted service.", "url": "https://www.anchorterminal.com/tools/chroma", "markdownUrl": "https://www.anchorterminal.com/tools/chroma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/chroma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/chroma.json", "repo": "https://github.com/chroma-core/chroma", "license": "Apache-2.0", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.trychroma.com/api/v2", "packages": [ { "registry": "pypi", "name": "chromadb" }, { "registry": "npm", "name": "chromadb" }, { "registry": "pypi", "name": "chroma-mcp" } ], "auth": "api-key", "authNotes": "Chroma Cloud takes an API key in the `x-chroma-token` header, scoped to a tenant and database. A local or self-hosted server runs without auth unless you configure it. The MCP server takes `--client-type cloud` with tenant, database and API key, or connects to a local or self-hosted instance.", "pricing": "usage", "pricingNotes": "Chroma Cloud Starter is $0 a month plus usage with $5 of credit, 10 databases and 10 members. Team is $250 a month plus usage with $100 of credit, 100 databases and SOC 2. Enterprise is custom, with single-tenant and BYOC clusters. Writes $2.50 per logical GiB, storage $0.33 per GiB a month, queries $0.0075 per TiB scanned plus $0.09 per GiB returned, forks $0.03 each, Sync $0.04 per GiB processed and $0.01 per page extracted or scraped. The open-source database is free to run yourself (https://www.trychroma.com/pricing).", "priceSummary": "$250 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402 or per-call payment support in the docs or pricing (checked 2026-09-30).", "endpoints": [] }, "toolCount": 13, "popularity": { "githubStars": 29413, "npmWeekly": 301867, "pypiWeekly": 1590274, "asOf": "2026-09-30" }, "docsUrl": "https://docs.trychroma.com", "llmsTxt": "https://docs.trychroma.com/llms.txt", "openapi": "https://api.trychroma.com/openapi.json", "capabilities": [ "db.vector", "db.hybrid", "db.fulltext", "db.filters", "db.serverless" ], "tags": [ "open-source", "self-hosted", "local", "hosted", "free-tier", "mcp", "llms-txt", "openapi", "python", "typescript", "enterprise" ], "lastRelease": "2026-06-30", "graded": true, "anchor": { "graded": true, "score": 45.4, "grade": "E", "agentReady": false, "rank": 400, "ranked": true, "rankOf": 452, "categoryRank": 8, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 35, "payments": 30, "reliability": 60, "schema": 71, "security": 38, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -10, "negativeNotes": [ "CVE-2026-45829 (GHSA-f4j7-r4q5-qw2c), published 18 May 2026, critical with CVSS 9.3. An unauthenticated request to the collections endpoint can set `trust_remote_code` and run code on a chromadb server from 1.0.0 to 1.5.9. The fix merged to main on 7 July 2026, but no release carries it, and the advisory still lists no patched version (https://github.com/advisories/GHSA-f4j7-r4q5-qw2c, https://pypi.org/project/chromadb/#history). We found nothing saying whether Chroma Cloud was exposed, so we deduct for the unpatched self-hosted path only." ], "verdict": "Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API. CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory.", "strengths": [ "Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API", "Per-unit cloud prices published, $2.50 per GiB written and $0.33 per GiB a month stored", "One status incident in 90 days, a 2 hour 38 minute indexing slowdown on 18 August 2026", "Apache-2.0, with an OpenAPI file and llms.txt over 162 Markdown pages", "Current source sends no product telemetry, since the PostHog client is a no-op" ], "weaknesses": [ "CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory", "No tagged or published release since 30 June 2026, and the server last shipped on 5 May", "`chroma-mcp` last released on 14 August 2025, with 13 tools and no read-only mode or tool annotations", "Cloud caps of 300 results a query, 300 records a write and 10 concurrent reads per collection, with no 429 or retry guidance", "Privacy policy dates from October 2024 and still says the service is hosted only in the United States" ], "agentNotes": [ "Don't expose a self-hosted chromadb 1.5.9 server, which has no auth by default and an unpatched code execution flaw", "Batch writes in groups of 300 or fewer on Chroma Cloud", "Use the Search API for hybrid ranking. The older `query()` only does dense search plus filters", "Pass `include` without embeddings, since returned GiB are billed", "Don't pass `ollama` to `chroma_create_collection`. The description lists it but the server can't map it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 45.4 } ], "editorialScores": { "ergonomics": 73, "maintenance": 35, "payments": 30, "reliability": 60, "schema": 71, "security": 38, "transparency": 68 }, "provenanceScore": 82 }, "connect": { "install": "pip install chromadb", "http": "curl -s https://api.trychroma.com/api/v2/auth/identity -H \"x-chroma-token: $CHROMA_API_KEY\"", "claudeCode": "claude mcp add chroma -- uvx chroma-mcp --client-type cloud --tenant $CHROMA_TENANT --database $CHROMA_DATABASE --api-key $CHROMA_API_KEY", "config": { "mcpServers": { "chroma": { "args": [ "chroma-mcp", "--client-type", "cloud", "--tenant", "${CHROMA_TENANT}", "--database", "${CHROMA_DATABASE}", "--api-key", "${CHROMA_API_KEY}" ], "command": "uvx" } } } }, "letme": { "capability": "https://letme.dev/db.vector", "tool": "https://letme.dev/chroma" }, "area": "developer", "unitPrices": [ { "item": "Team plan", "unit": "month", "usd": 250, "note": "$100 of usage credit included" }, { "item": "Writes", "unit": "gb", "usd": 2.5, "note": "per logical GiB written" }, { "item": "Storage", "unit": "gb", "usd": 0.33, "note": "per GiB a month" }, { "item": "Data returned by queries", "unit": "gb", "usd": 0.09, "note": "plus $0.0075 per TiB scanned" }, { "item": "Collection fork", "unit": "call", "usd": 0.03 }, { "item": "Sync processing", "unit": "gb", "usd": 0.04, "note": "plus $0.01 per page extracted or scraped" } ], "provenance": { "legalEntity": "Chroma Inc.", "domain": "trychroma.com", "domainRegistered": "2022-03-23", "endpointOnVendorDomain": true, "terms": "https://www.trychroma.com/terms", "privacy": "https://www.trychroma.com/privacy", "statusPage": "https://status.trychroma.com", "changelog": "https://www.trychroma.com/changelog", "securityTxt": "none", "checked": "2026-09-30", "score": 82 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/chroma.json", "live": { "slug": "chroma", "probe": { "target": "https://api.trychroma.com/api/v2", "method": "get", "lastAt": "2026-10-05T02:29:53.723353692Z", "lastOk": true, "lastStatus": 200, "lastMs": 260, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 257, "p95ms24h": 285, "samples24h": 273, "samples30d": 1131, "days": [ { "date": "2026-09-30", "probes": 35, "ok": 35 }, { "date": "2026-10-01", "probes": 276, "ok": 276 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 29, "ok": 29 } ] }, "vendorStatus": { "page": "https://status.trychroma.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:39:52.769076939Z" }, "versions": [ { "registry": "github", "name": "chroma-core/chroma", "version": "1.5.9", "released": "2026-05-05", "seenAt": "2026-10-04T16:23:24.769339817Z" }, { "registry": "npm", "name": "chromadb", "version": "3.5.0", "seenAt": "2026-10-04T16:23:22.800825203Z" }, { "registry": "pypi", "name": "chroma-mcp", "version": "0.2.6", "released": "2025-08-14", "seenAt": "2026-10-04T16:23:23.601490926Z" }, { "registry": "pypi", "name": "chromadb", "version": "1.5.9", "released": "2026-05-05", "seenAt": "2026-10-04T16:23:22.68008647Z" } ], "githubStars": 29437, "npmWeekly": 307972, "pypiWeekly": 1637601, "securityTxt": { "url": "https://trychroma.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:38.334831837Z" }, "llmsTxt": { "url": "https://docs.trychroma.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:23.964768594Z" }, "domain": { "domain": "trychroma.com", "registered": "2022-03-23", "source": "https://rdap.verisign.com/com/v1/domain/trychroma.com", "checkedAt": "2026-10-04T13:09:39.725378578Z" }, "pages": [ { "url": "https://www.trychroma.com/changelog", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:52:31.760925947Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "301154ea7374" }, { "url": "https://www.trychroma.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:52:33.928957482Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "677e379ceb9f" }, { "url": "https://www.trychroma.com/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:52:35.910016902Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "489e02b4f673" }, { "url": "https://www.trychroma.com/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:52:37.956898787Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "78c6afbde487" } ], "updatedAt": "2026-10-05T02:29:53.723353692Z" } }, "b": { "slug": "upstash-vector", "name": "Upstash Vector API + MCP", "vendor": "Upstash", "vendorUrl": "https://upstash.com/vector", "kind": "http-api", "category": "vector-search", "summary": "Serverless vector database billed per request.", "url": "https://www.anchorterminal.com/tools/upstash-vector", "markdownUrl": "https://www.anchorterminal.com/tools/upstash-vector.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/upstash-vector.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/upstash-vector.json", "repo": "https://github.com/upstash/vector-js", "license": "MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.upstash.com/v2", "packages": [ { "registry": "npm", "name": "@upstash/vector" }, { "registry": "pypi", "name": "upstash-vector" }, { "registry": "npm", "name": "@upstash/mcp-server" } ], "auth": "mixed", "authNotes": "Data plane uses a per-index REST token as Bearer (UPSTASH_VECTOR_REST_URL plus UPSTASH_VECTOR_REST_TOKEN), with a separate read-only token per index. The Developer API (api.upstash.com) and the MCP server use account email plus API key; read-only API keys exist. The hosted MCP endpoint defaults to OAuth and lets you pick a read-only grant at consent.", "pricing": "freemium", "pricingNotes": "Free plan with 10,000 queries and updates a day, 1 GB data, 200M vectors times dimensions, up to 1,536 dimensions. Pay as you go $0.40 per 100,000 requests plus $0.25 per GB storage, 200 GB bandwidth a month free then $0.03 per GB, up to 50 GB data and 3,072 dimensions. Fixed plan $60 a month with 1M queries and updates a day. Pro and Enterprise by quote, up to 1 TB and 5,000 dimensions. Self-hosting isn't offered (https://upstash.com/pricing/vector).", "priceSummary": "$0.004 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402 support in docs, pricing or MCP README (checked 2026-09-30).", "endpoints": [] }, "toolCount": 55, "popularity": { "githubStars": 70, "npmWeekly": 187120, "pypiWeekly": 33712, "asOf": "2026-09-30" }, "docsUrl": "https://upstash.com/docs/vector/overall/getstarted", "llmsTxt": "https://upstash.com/docs/llms.txt", "registryName": "io.github.upstash/mcp-server", "capabilities": [ "db.vector", "db.hybrid", "db.filters", "db.serverless" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "mcp", "llms-txt", "closed-source", "typescript", "python" ], "lastRelease": "2026-08-24", "graded": true, "anchor": { "graded": true, "score": 62.4, "grade": "B", "agentReady": false, "rank": 218, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 46, "payments": 40, "reliability": 75, "schema": 49, "security": 63, "transparency": 82 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "$0.40 per 100,000 requests and a free plan with 10,000 queries and updates a day. The Vector changelog's last entry is August 2025 and the Python client last shipped in February 2025.", "strengths": [ "$0.40 per 100,000 requests and a free plan with 10,000 queries and updates a day", "Hosted embedding lets an agent upsert and query plain text", "Per-index read-only tokens, read-only MCP grants and read, write or destructive labels on every MCP tool", "One 20-minute Vector incident in 90 days, and a 99.9% SLA on paid plans", "DPA, subprocessor list and valid security.txt" ], "weaknesses": [ "The Vector changelog's last entry is August 2025 and the Python client last shipped in February 2025", "Vector tools exist only on the hosted MCP server, mixed into 55 tools, and not in the open-source stdio package", "No OpenAPI file and no API versioning", "SOC 2 covers Upstash Redis on Pro and Enterprise plans, not Vector", "No full-text search beyond sparse BM25 vectors; no facets, sorting or typo tolerance" ], "agentNotes": [ "Connect to mcp.upstash.com/mcp for Vector tools. `npx @upstash/mcp-server` has none", "Create the index with an embedding model if the agent works in text; then `query-data` and `upsert-data` take strings", "Give retrieval-only agents the index's read-only token, not the full one", "Filters use a SQL-like string (`genre = 'fiction' AND year \u003e 2020`) in the `filter` field", "Ignore the FAQ line saying hybrid isn't supported. Pass `queryMode` HYBRID, DENSE or SPARSE on hybrid indexes" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62.4 } ], "editorialScores": { "ergonomics": 75, "maintenance": 46, "payments": 40, "reliability": 75, "schema": 49, "security": 63, "transparency": 64 }, "provenanceScore": 100 }, "connect": { "http": "curl $UPSTASH_VECTOR_REST_URL/query-data -X POST \\\n -H \"Authorization: Bearer $UPSTASH_VECTOR_REST_TOKEN\" \\\n -d '{\"data\":\"What is Upstash?\",\"topK\":2,\"includeMetadata\":true}'", "claudeCode": "claude mcp add --scope user --transport http upstash https://mcp.upstash.com/mcp", "config": { "mcpServers": { "upstash": { "url": "https://mcp.upstash.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/db.vector", "tool": "https://letme.dev/upstash-vector" }, "area": "developer", "unitPrices": [ { "item": "Pay as you go requests", "unit": "1k-requests", "usd": 0.004, "note": "$0.40 per 100,000 queries or updates" }, { "item": "Storage", "unit": "gb", "usd": 0.25, "note": "per GB a month on paid plans" }, { "item": "Fixed plan", "unit": "month", "usd": 60, "note": "1M queries and updates a day, 50 GB max data" } ], "provenance": { "legalEntity": "Upstash, Inc.", "domain": "upstash.com", "domainRegistered": "2015-06-23", "endpointOnVendorDomain": true, "terms": "https://upstash.com/trust/terms.pdf", "privacy": "https://upstash.com/trust/privacy.pdf", "statusPage": "https://status.upstash.com", "changelog": "https://upstash.com/docs/vector/overall/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "Per-index data endpoints live on upstash.io subdomains; the Developer API and MCP server are on upstash.com." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/upstash-vector.json", "live": { "slug": "upstash-vector", "probe": { "target": "https://api.upstash.com/v2", "method": "get", "lastAt": "2026-10-05T02:30:04.428312938Z", "lastOk": true, "lastStatus": 404, "lastMs": 331, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 340, "p95ms24h": 399, "samples24h": 273, "samples30d": 1131, "days": [ { "date": "2026-09-30", "probes": 35, "ok": 35 }, { "date": "2026-10-01", "probes": 276, "ok": 276 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 272, "ok": 272 }, { "date": "2026-10-05", "probes": 29, "ok": 29 } ] }, "vendorStatus": { "page": "https://status.upstash.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-05T02:29:15.468276618Z" }, "versions": [ { "registry": "github", "name": "upstash/vector-js", "version": "v1.2.3", "released": "2026-03-09", "seenAt": "2026-10-04T16:43:03.999439137Z" }, { "registry": "mcp-registry", "name": "io.github.upstash/mcp-server", "version": "0.2.7", "seenAt": "2026-10-04T23:42:40.113054682Z" }, { "registry": "npm", "name": "@upstash/mcp-server", "version": "0.3.0", "seenAt": "2026-10-04T16:43:02.819907547Z" }, { "registry": "npm", "name": "@upstash/vector", "version": "1.2.3", "seenAt": "2026-10-04T16:43:01.777196337Z" }, { "registry": "pypi", "name": "upstash-vector", "version": "0.8.0", "released": "2025-02-27", "seenAt": "2026-10-04T16:43:02.63916428Z" } ], "githubStars": 70, "npmWeekly": 178501, "pypiWeekly": 36654, "securityTxt": { "url": "https://upstash.com/.well-known/security.txt", "state": "valid", "expires": "2027-09-29T00:00:00.000Z", "checkedAt": "2026-10-04T15:15:36.802407623Z" }, "llmsTxt": { "url": "https://upstash.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:20.029364714Z" }, "domain": { "domain": "upstash.com", "registered": "2015-06-23", "source": "https://rdap.verisign.com/com/v1/domain/upstash.com", "checkedAt": "2026-10-04T13:05:32.95115781Z" }, "pages": [ { "url": "https://upstash.com/docs/vector/overall/changelog", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:48:39.872548985Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ba3d301f840a" }, { "url": "https://upstash.com/pricing/vector", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:48:41.976696228Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "74ee45b3e8de" } ], "updatedAt": "2026-10-05T02:30:04.428312938Z" } }, "summary": "Upstash Vector API + MCP has a score of 62.4 (B) against Chroma API + MCP's 45.4 (E). Both do db vector. The largest gap is security \u0026 auth, 25 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/chroma-vs-upstash-vector", "json": "https://www.anchorterminal.com/compare/chroma-vs-upstash-vector.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/chroma-vs-upstash-vector.md", "slim": "https://www.anchorterminal.com/compare/chroma-vs-upstash-vector.min.md" }, "markdown": "Upstash Vector API + MCP has a score of 62.4 (B) against Chroma API + MCP's 45.4 (E). Both do db vector. The largest gap is security \u0026 auth, 25 points.\n\n- Chroma API + MCP: grade E, 45.4/100, rank #400 of 452. Markdown https://www.anchorterminal.com/tools/chroma.md · JSON https://www.anchorterminal.com/api/v1/tools/chroma.json\n- Upstash Vector API + MCP: grade B, 62.4/100, rank #218 of 452. Markdown https://www.anchorterminal.com/tools/upstash-vector.md · JSON https://www.anchorterminal.com/api/v1/tools/upstash-vector.json\n\n## Which one, for what\n\nPick Chroma API + MCP for schema \u0026 documentation (+22).\n\nPick Upstash Vector API + MCP for reliability (+15), security \u0026 auth (+25), payments \u0026 pricing (+10), maintenance \u0026 community (+11), transparency \u0026 trust (+7).\n\n## Score by category\n\n| Category | Weight | Chroma API + MCP | Upstash Vector API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 60 | 75 | Upstash Vector API + MCP +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 71 | 49 | Chroma API + MCP +22 |\n| Agent ergonomics | 13% (16.2 this run) | 73 | 75 | Upstash Vector API + MCP +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 38 | 63 | Upstash Vector API + MCP +25 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 40 | Upstash Vector API + MCP +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 35 | 46 | Upstash Vector API + MCP +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 75 | 82 | Upstash Vector API + MCP +7 |\n| Negative events | ≤15 | -10 | 0 | |\n| **Total** | | **45.4 · E** | **62.4 · B** | |\n\n## Facts side by side\n\n| Fact | Chroma API + MCP | Upstash Vector API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Chroma | Upstash |\n| Hosted endpoint | `https://api.trychroma.com/api/v2` | `https://api.upstash.com/v2` |\n| Transports | HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | MIT |\n| Tools exposed | 13 | 55 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `io.github.upstash/mcp-server` |\n| Last release | 2026-06-30 | 2026-08-24 |\n| Popularity | 29k stars, 302k npm/wk, 1.6M PyPI/wk | 70 stars, 187k npm/wk, 34k PyPI/wk |\n| Agent reviews | 3/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**Chroma API + MCP.** Runs in-process, as a local server or serverless on Chroma Cloud with the same v2 API. CVE-2026-45829, CVSS 9.3, has no patched release more than four months after the advisory.\n\n**Upstash Vector API + MCP.** $0.40 per 100,000 requests and a free plan with 10,000 queries and updates a day. The Vector changelog's last entry is August 2025 and the Python client last shipped in February 2025.\n\n## Before you call either\n\n### Chroma API + MCP\n\n1. Don't expose a self-hosted chromadb 1.5.9 server, which has no auth by default and an unpatched code execution flaw\n2. Batch writes in groups of 300 or fewer on Chroma Cloud\n3. Use the Search API for hybrid ranking. The older `query()` only does dense search plus filters\n4. Pass `include` without embeddings, since returned GiB are billed\n5. Don't pass `ollama` to `chroma_create_collection`. The description lists it but the server can't map it\n\n### Upstash Vector API + MCP\n\n1. Connect to mcp.upstash.com/mcp for Vector tools. `npx @upstash/mcp-server` has none\n2. Create the index with an embedding model if the agent works in text; then `query-data` and `upsert-data` take strings\n3. Give retrieval-only agents the index's read-only token, not the full one\n4. Filters use a SQL-like string (`genre = 'fiction' AND year \u003e 2020`) in the `filter` field\n5. Ignore the FAQ line saying hybrid isn't supported. Pass `queryMode` HYBRID, DENSE or SPARSE on hybrid indexes\n\n## Other comparisons with Chroma API + MCP or Upstash Vector API + MCP\n\n- [Chroma API + MCP vs Epsilla Vector Database](https://www.anchorterminal.com/compare/chroma-vs-epsilla.md)\n- [Chroma API + MCP vs LanceDB](https://www.anchorterminal.com/compare/chroma-vs-lancedb.md)\n- [Chroma API + MCP vs Milvus and Zilliz Cloud API + MCP](https://www.anchorterminal.com/compare/chroma-vs-milvus-zilliz.md)\n- [Chroma API + MCP vs Pinecone API + MCP](https://www.anchorterminal.com/compare/chroma-vs-pinecone.md)\n- [Chroma API + MCP vs Qdrant API + MCP](https://www.anchorterminal.com/compare/chroma-vs-qdrant.md)\n- [Chroma API + MCP vs Typesense API + MCP](https://www.anchorterminal.com/compare/chroma-vs-typesense.md)\n- [Chroma API + MCP vs Weaviate API + MCP](https://www.anchorterminal.com/compare/chroma-vs-weaviate.md)\n- [Epsilla Vector Database vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/epsilla-vs-upstash-vector.md)\n- [LanceDB vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/lancedb-vs-upstash-vector.md)\n- [Milvus and Zilliz Cloud API + MCP vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/milvus-zilliz-vs-upstash-vector.md)\n- [Pinecone API + MCP vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/pinecone-vs-upstash-vector.md)\n- [Qdrant API + MCP vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/qdrant-vs-upstash-vector.md)\n- [Typesense API + MCP vs Upstash Vector API + MCP](https://www.anchorterminal.com/compare/typesense-vs-upstash-vector.md)\n- [Upstash Vector API + MCP vs Weaviate API + MCP](https://www.anchorterminal.com/compare/upstash-vector-vs-weaviate.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Chroma API + MCP vs Upstash Vector API + MCP", "url": "" } ], "description": "Upstash Vector API + MCP has a score of 62.4 (B) against Chroma API + MCP's 45.4 (E). Both do db vector. The largest gap is security \u0026 auth, 25 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Chroma API + MCP E 45.4", "Upstash Vector API + MCP B 62.4", "scores" ], "h1": "Chroma API + MCP vs Upstash Vector API + MCP", "image": "https://www.anchorterminal.com/assets/og/compare-chroma-vs-upstash-vector.png", "path": "/compare/chroma-vs-upstash-vector", "published": "2026-10-01", "section": "tools", "title": "Chroma API + MCP vs Upstash Vector API + MCP for AI agents", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/chroma-vs-upstash-vector" }, "tokens": { "markdown": 1600, "slim": 380 }, "version": 1 }