FLORA vs Iris-3B

FLORA 53

No x402, MPP or L402 (0). Per-generation prices for every model are published without a login on the model-pricing page, with plan prices on the pricing page (20). Free gives each new workspace $2.50 of usage, which the docs and the MCP changelog (1 September 2026) say an agent can spend through MCP; the REST API answers paid_plan_required on Free, the pricing page marks MCP 'Not included' there, and no page says whether Free needs a card, so this is a one-off trial on one surface (15 of 20). A person signs up in a browser and approves OAuth, or makes a key in Settings (0). 0+20+15+0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.

Iris-3B 90

Free Apache-2.0 software with nothing to buy, so 20 + 20 + 20 for pricing, free use and no sign-up. No payment protocol (0). There is no hosted API. Hardware is the owner's cost. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 60 is 90.

FLORA 79

Platform with an MCP server and an API, read with the API and MCP lines. The API reference is generated from version 5.10.2 of FLORA's OpenAPI document and reproduces each operation's fields with types, enums, patterns and limits in Markdown, but the document itself is not published and the SDK's README says the generated code comes from it; MCP tool inputs are documented with types and constraints and were not seen live (15 of 25). llms.txt and a Markdown twin of every docs page (10). The tools reference says what each tool does and labels it read-only, writes, destructive, spends money or async, and the cost, runs and security pages say when not to call (flora_run_canvas_nodes spends with no confirmation, never re-fire a partial batch, stop on billing errors); per-tool descriptions are one line (16 of 20). Typed inputs with enums for type and status, prefixed id formats (ws_, prj_, run_, tech_), item and length limits and unknown keys rejected, but params is a free-form object whose names come from flora_list_models (11 of 15). An example call per tool, a REST error table with 13 codes and their retryability, the MCP failure shapes and run error codes, and the skills repository's failure-codes reference (14 of 15). Versioned path /v1 with the API version in the SDK changelog, a dated MCP changelog with entries from 28 May to 23 October 2026 and a retired-tools page; no version numbers on the MCP changelog and no written versioning policy (13 of 15). 15+10+16+11+14+13 = 79.

Iris-3B 47

Read for a model the owner runs through a CLI and a Python package. No server, OpenAPI or other machine-readable contract. The CLI uses argparse with typed flags and help text, and the Python functions carry type hints. The 15 October reading of the demo Spaces' Gradio API came from a data endpoint this run doesn't use and is struck. The partial 8 rests on the typed CLI and is kept pending the founder's rule on in-between values (8 of 25). No llms.txt. The README and model card are Markdown in each repository (5 of 10). The card and README state limits (unreliable rendered text and object counts, about one megapixel, depth relative not metric, Turbo's fixed schedule and lower seed variety) but not intended or out-of-scope uses (14 of 20). Flags are typed, with the size presets as an enum only in the Spaces. Height and width take any integer, though Turbo was distilled at seven sizes (9 of 15). Commands for every model and a tips table, but no documented errors (7 of 15). No versioning or changelog beyond dated commits (4 of 15).

FLORA 68

OAuth with the authorisation code grant, PKCE (the metadata lists plain and S256, the docs S256), dynamic client registration, refresh tokens and revocation at the token endpoint, with no named scopes, no documented token lifetimes and no list of OAuth connections in FLORA's settings; API keys ak_ scoped to chosen workspaces with Read, Write and Billing permissions, shown once, five at a time and revoked at once, with no expiry or rotation feature. Only the header form is documented (24 of 30). Read-only keys and per-workspace scoping, roles that cap what an agent can do, guests who cannot generate, spending caps per member, workspace, organisation and overage, and a quote-first rule; flora_run_canvas_nodes spends with no confirmation step (16 of 20). Agents read canvas prompts, comments, Techniques and files written by others; the security page says to treat them as data, to review the quote after reading shared content and to use least-privilege keys for unattended accounts, with no technical filtering described (11 of 15). Operators see spend by member in the app and through flora_get_usage, organisation usage exports through the API, charged_cost per run and failed webhook deliveries; FLORA's own MCP logs are not exposed to the operator (9 of 15). The trust centre lists SOC 2 Type 2, GDPR and CCPA (published 26 October 2026) with no report shown; no security.txt was found on flora.ai, and no disclosure policy or bug bounty for the service. The SDK's SECURITY.md points SDK reports at Stainless while its README says the SDK is generated by Fern (8 of 20). 24+16+11+9+8 = 68.

Iris-3B 44

Read as software the owner runs. No account, key or token is needed to get or run the weights, and the software opens no network service (14 of 30). No write actions beyond image files in the output folder (15 of 20). The output is an image, not text an agent reads as instructions. The card warns of inaccurate, biased or unsafe output, and neither the code nor the demo has a content filter (8 of 15). No call log. Output files are named after the prompt (3 of 15). No SECURITY.md, security.txt, bug bounty or advisories. Released checkpoints are safetensors. Training .pth files, which the CLI also accepts, are read with torch.load(weights_only=False). Dion is pinned to a commit (4 of 20).

FLORA 68

Closed service under terms of service (17 November 2025) that name FLORA AND FAUNA FLOWERSHOP, INC., give the user all rights in output and limit FLORA's licence in user data to running the service; the SDK is Apache-2.0 and the skills MIT (15 of 30). The terms, the data, security and IP page and the MCP security page agree that FLORA does not train on user data or let model providers train on it. The privacy notice (1 June 2026) is silent on training, names only Google Analytics and an unnamed session replay tool, and gives no retention period beyond the life of the account; a DPA is for Enterprise and paid workspaces with client data (18 of 30). The MCP changelog dates deprecations with replacements (a beta endpoint deprecated 28 May and removed 30 June 2026, execute deprecated 11 September and retired 8 October 2026) and a retired-tools page lists five, but there is no written notice period, and flora_comments forwards with no end date (12 of 20). The sub-processors page (2 June 2026) names 23 services with their locations, including India, the UK, China and Singapore, with no commitment to notice of changes (16 of 20). 15+18+12+16 = 61.

Iris-3B 52

Apache-2.0 for code and weights, with a NOTICE file, a third-party licence table and the full training and distillation recipe. The training images and the Turbo prompt sets are not released or named in the README or card (25 of 30). Self-hosted, so inputs stay on the owner's hardware, but we found no statement saying so and speridlabs.com has no privacy policy (15 of 30). No deprecation policy, version tags or pinned revisions (2 of 20). No telemetry calls found in the inference code. Training defaults to report_to: wandb, which sends run config and validation images to Weights & Biases, can be set to none, and is not mentioned in the README (8 of 20).

FLORA 68

MCP reading for context cost. 59 tools (56 callable by the model) with no toolsets or read-only subset; since 23 September 2026 the list is filtered to the account's access and flora_list_tools returns what the connection has (7 of 25). Cursor pagination with limit 1 to 100 on 10 REST list endpoints, history filters by workspace, project and status, include_inputs off by default, per-node and per-slide document reads, and up to 20 runs read in one call (17 of 20). One REST error envelope with code, message and field errors, retryability per code, a Flora-Request-Id, MCP failures grouped into retry now, retry later, change input and report, and retired tool names answering with their replacement (18 of 20). Idempotency-Key on every mutating REST request and a body key on Technique runs; every MCP tool carries readOnlyHint and destructiveHint annotations and spending tools are marked destructive; quote: true prices before running; the MCP create call has no idempotency key (16 of 20). Few required parameters (project_id, type, prompt, with the workspace resolved from the project) and an official TypeScript SDK and a Go CLI, but no SDK in a second language (10 of 15). 7+17+18+16+10 = 68.

Iris-3B 54

Read as a local image model an agent calls through the CLI or Python. Images are written to files with a contact sheet, so nothing large returns into context. Batch prompts through --txt-file (15 of 25). Output size through --height and --width, an output folder, --max-side for depth and a tile budget for restoration with --no-budget to lift it (12 of 20). No documented error responses. A Turbo checkpoint with incompatible flags exits with a message naming the flags to drop (6 of 20). A fixed --seed reproduces an image and there are no side effects beyond files, but files are named after the prompt and overwritten on repeat (14 of 20). Sensible defaults and two required inputs (--checkpoint and a prompt). No SDK beyond the Python package, which isn't on PyPI, and about 12 GB of weights before a first image (7 of 15).

FLORA 83

Closed service with a dated changelog. The newest MCP changelog entry is 23 October 2026, and flora.ai/updates has product entries to 28 October (30). 31 dated MCP changelog entries between 4 August and 23 October 2026 (20). Support at support@florafauna.ai, bug and feature forms, a Discord linked from the home page, weekly training sessions, and GitHub issues on the skills repository as its support URL (2 open); no response times stated (10 of 15). ai.flora/flora 0.11.5 is in the official MCP registry under a DNS-verified namespace since 16 October 2026 (15). The TypeScript SDK @flora-ai/flora 0.21.1 (14 October 2026, 157 downloads in the week to 1 November) has CI, release-please and an npm publish workflow; the skills repository was last pushed on 18 October 2026 (8 of 10). 30+20+10+15+8 = 83.

Iris-3B 70

Read for an open-weight model first released on 5 October 2026. The newest change is a merged demo fix on 15 October 2026 (a clone on 4 November shows no later commit, and the Hub repository's last commit is 12 October), 20 days before this check (30). Three dated weight releases, base on 5 October, depth and restoration on 8 October and Turbo on 12 October (20). The project lead answered and closed issue 1 within a day, and two outside pull requests merged within two days. A second outside pull request (demo downloads) merged on 13 October. Counted by script on 4 November 2026, none of the six Hugging Face discussions, opened from 9 to 12 October, has a reply from Speridlabs, and GitHub's issue pages weren't readable, so issue 3 is per the 15 October check (14 of 25, held). No SDK and no PyPI package. Community ComfyUI packs and quantised conversions exist but are not the vendor's (2 of 15). Dependencies are current (PyTorch 2.7.1, transformers 4.57), but there's no CI and wandb is a required dependency for inference (4 of 10).