CrewAI vs AI SDK

CrewAI 74

Agent, Task and tool classes are Pydantic-typed, but we found no generated API reference for the Python library (15). llms.txt at docs.crewai.com, per the listing's earlier check (10). The docs separate Crews from Flows and say which to use for what, though not when to avoid multi-agent crews (12). Tools take a Pydantic args_schema and MCP tools keep their JSON Schema (12). Plenty of examples, and MCP connection errors are described, but there's no exception reference (10). Dated changelog at docs.crewai.com/en/changelog (15).

AI SDK 100

Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).

CrewAI 65

Anonymous telemetry on by default (versions, crew and agent configuration, tool usage, agent roles and tool names, no prompts or task descriptions), off with CREWAI_DISABLE_TELEMETRY or OTEL_SDK_DISABLED (20). Pre-tool-call hooks can block a call or ask a person to approve it, and MCP tools can be allow-listed, but there's no sandbox now that CodeInterpreterTool is gone (15). Task guardrails and hooks, and the MCP page says to trust a server before using it, but we found no prompt-injection guidance (10). Tracing to CrewAI AMP or third-party tools such as Langfuse and MLflow (12). A security policy in the repository with private reporting through GitHub, security@crewai.com, response times, safe harbour and a CVE commitment through GitHub's CNA, and a valid security.txt that points to it. No paid bug bounty. The four March 2026 CVEs came through CERT/CC, and October fixes cite two GHSA ids that OSV didn't list on 1 November (8). Framework reading, so SOC 2 isn't scored.

AI SDK 90

No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.

CrewAI 40

No payment protocol (0). Scored on CrewAI AMP, the hosted option. Its free Basic plan is public but the only paid plan is contact-sales (0). The MIT package installs with no card (20) and no account, and can run a local model through LiteLLM (20).

AI SDK 60

No payment protocol (0). Scored on the AI Gateway, the paid option, which charges providers' list prices with no markup and lists per-model rates and add-on prices without a login (20). The Apache 2.0 package installs with no card (20) and no account, and provider packages run any model, including local ones (20).

CrewAI 75

Official package on PyPI with Requires-Python >=3.10,<3.14 in the pyproject at 1.15.33 (20). The Run Tests workflow runs the suite on pull requests only, and CodeQL, a vulnerability scan and a nightly canary run on main; run results weren't re-read on 1 November because GitHub's pages answer 403 (15). Between 99 and 184 open issues, triaged with labels and a stale bot, per the 1 October check, not re-read on 1 November (18). A dated changelog that notes deprecations, but no written versioning policy, new capabilities ship in patch releases, and 1.15.29, a patch release on 23 October 2026, removed public import paths and changed how every agent runs, marked as breaking only on 28 October (7). 1.15.33, stable (15).

AI SDK 93

Official npm packages, with ai 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.

CrewAI 80

The mcps field gives an agent an MCP server in five lines, with static and dynamic tool filters and tool-list caching (25). max_iter defaults to 20, max_execution_time and max_rpm cap runs, and respect_context_window is on by default (20). MCP connection failures are logged as warnings and the agent carries on without those tools, and we found no exception reference (10). max_retry_limit retries an agent twice on error, and Flows persist state with @persist (20). An agent needs role, goal and backstory before it does anything, and it's Python only (5).

AI SDK 95

An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).

CrewAI 79

MIT (30). The telemetry page lists what's collected and what isn't, but doesn't say where it goes or how long it's kept (15). Deprecations such as function_calling_llm and allow_code_execution appear in the dated changelog and docs, with no written deprecation policy (10). Telemetry disclosed in the docs and README with two opt-out variables (20).

AI SDK 89

Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).