Galileo API + MCP vs Gauge CLI

Galileo API + MCP 18

No status page found. status.galileo.ai still has no DNS record and docs.galileo.ai links none (0). The Splunk site links a system status page, but splunk.com is paused for us on its website terms, so it is unread. With no history to read, 5. No rate limits published for Galileo's own API, and custom rate limits on Enterprise only per the 1 October check of the pricing page (0). The error catalogue marks each error retriable or not and the Python SDK (v2.7.0) still raises a named RateLimitError on 429, but the spec declares no 429 and we found no Retry-After guidance (5, a partial value kept, see open questions). No SLA on any plan (0). The REST API is GA. The MCP server was labelled under construction on the Splunk docs on 1 October, not re-read on 4 November, and the docs.galileo.ai MCP page carries no label (8, kept). 0+5+0+5+0+8 = 18.

Gauge CLI 60

Local package. Installs from npm as @withgauge/cli with Node 22.13 or later and Docker stated (20). checks.yml runs npm run check on push and pull request across a matrix, and the repository has 76 test files; whether main passes wasn't read (20 of 25). Issues weren't read (5, unchecked). A dated changelog with Added sections per release (15). Version 0.28.0 (0). 20 + 20 + 5 + 15 + 0 = 60.

Galileo API + MCP 33

API key in a header (Splunk-AO-API-Key in the current spec, Galileo-API-Key in older docs), a JWT from /login/api_key that expires after 24 hours, or HTTP Basic with a username and password, which the docs list as an option. We found no key scopes, expiry or rotation docs (18). Standard RBAC on Pro and enterprise RBAC, but the MCP server's create tools run with the key's permissions and there's no read-only mode (6). Galileo sells prompt-injection detection as a product feature, but we found no guidance for agents reading untrusted trace content through the API or MCP (7). No audit log found (0). No security.txt, no trust page (trust.galileo.ai doesn't resolve, galileo.ai/security is a 404), no SECURITY.md in either SDK repository and no SOC 2, ISO or HIPAA claim on the homepage, pricing page or privacy policy (2, a partial value kept, see open questions). Re-read on 4 November, galileo.ai/security and /.well-known/security.txt answer 404 and the homepage names no certification. 18+6+7+0+2 = 33.

Gauge CLI 55

Local tool. Agent credentials stay on your machine in local mode; hosted login with a device flow (20 of 30). Test agents run in fresh Docker sessions with injected inputs, and the gateway brokers credentials in hosted mode (12 of 20). Agents under test read your product's docs and outputs, with no prompt-injection guidance (5 of 15). Local transcripts and SQLite evidence per run (10 of 15). No security policy found (8 of 20). 20 + 12 + 5 + 10 + 8 = 55.

Galileo API + MCP 20

No x402 or other machine payment (0). galileo.ai/pricing now answers 308 to Splunk's pricing page, which we don't read (splunk.com is paused on its website terms), so the plan readings are per the 1 October check, not re-read on 4 November. Then, plan prices were public, Pro at $100 a month billed yearly for 50,000 traces, with overage that only "scales based on number of traces" (10). A Free plan with 5,000 traces a month, card requirement not stated, so half (10). A person signs up in a browser at app.galileo.ai/sign-up, still linked from the homepage (0). 0+10+10+0 = 20.

Gauge CLI 40

Scored on the hosted option. No payment protocol (0). Credit prices weren't found on the pages read (0). Local mode is free with no card (20). Local mode needs no sign-up (20). 0 + 0 + 20 + 20 = 40.

Galileo API + MCP 79

OpenAPI 3.1 at api.galileo.ai/public/v2/openapi.json, linked from the llms.txt on docs.galileo.ai. We didn't request the API host. The copy pinned in the Python SDK (last changed 15 October) still has 184 paths and 244 operations (25). llms.txt and Markdown pages on docs.galileo.ai (10). 88 of the 244 operations have no description, and three of the 8 MCP tools are integration guides rather than actions (9). Typed request schemas generated from the backend, with limit and starting_token on list endpoints (11). The spec declares 200 and 422 on almost every operation and no 429. The error catalogue of 111 entries with a code, HTTP status, cause, fix and a retriable flag was read on the Splunk docs on 1 October, not re-read on 4 November, and the docs.galileo.ai copy loads its entries by script. Cookbooks give examples (11). Versioned /v2 API and dated release notes on docs.galileo.ai (newest 27 October 2026) and the Splunk docs (13, kept). 25+10+9+11+11+13 = 79.

Gauge CLI 60

CLI reading. No machine-readable contract, -o json on read commands (10 of 25). No llms.txt; instructions bundled in the CLI for agents (5). The README says what it finds and when local or hosted fits (16 of 20). Commands with help text; typed flags (9 of 15). Worked examples, no error reference (8 of 15). Dated changelog and semver tags (12 of 15). 10 + 5 + 16 + 9 + 8 + 12 = 60.

Galileo API + MCP 74

TypeScript SDK v2.4.0 on 16 October 2026, Python SDK v2.7.0 on 14 October, and dated release notes on 13 and 27 October (30). In the 90 days from 6 August, TypeScript 2.3.0 (16 September), 2.3.1 (22 September), 2.3.2 (1 October) and 2.4.0, Python 2.7.0, and release notes dated 7 August, 13 October and 27 October (20). Dated release notes and Slack support on Pro. github.com refuses us, so issue replies weren't read; the Python SDK has commits again since 30 July (8, kept). Official Python and TypeScript SDKs (10). CI tests, codecov and Dependabot in both repositories. The Python CHANGELOG.md still stops at v0.10.0 from May 2025 while releases have reached 2.7.0 (6). 30+20+8+10+6 = 74.

Gauge CLI 82

CLI 0.28.0 on 4 November 2026 (30). Six releases in 90 days (20). Issues and pull requests weren't read; a support address and issue tracker are published (12 of 25). Current official package (15). CI on push and pull request (5 of 10, results not read). 30 + 20 + 12 + 15 + 5 = 82.