Gauge CLI vs HoneyHive

Gauge CLI 60

CLI reading. No machine-readable contract, -o json on read commands (10 of 25). No llms.txt; instructions bundled in the CLI for agents (5). The README says what it finds and when local or hosted fits (16 of 20). Commands with help text; typed flags (9 of 15). Worked examples, no error reference (8 of 15). Dated changelog and semver tags (12 of 15). 10 + 5 + 16 + 9 + 8 + 12 = 60.

HoneyHive 86

Two public OpenAPI 3.1 specs in an MIT repository, version 1.17.0 on 4 November 2026, data plane with 69 paths and 108 operations and control plane with 10 paths and 17 operations (25). llms.txt with every page as Markdown (10). All but 3 operations have a description, deprecated operations are flagged (57 of them) and POST /v1/events/search is labelled the primary way to read events (16). Typed request bodies with bounds such as limit 1 to 1,000 and additionalProperties: false, though event inputs, outputs and metadata are free-form objects (11). Only 9 operations carry examples, no 429 is declared, and since 24 September permission and key failures all return 404 (9). Spec changelog generated with oasdiff, plus dated product, client and self-hosting changelogs (15).

Gauge CLI 60

Local package. Installs from npm as @withgauge/cli with Node 22.13 or later and Docker stated (20). checks.yml runs npm run check on push and pull request across a matrix, and the repository has 76 test files; whether main passes wasn't read (20 of 25). Issues weren't read (5, unchecked). A dated changelog with Added sections per release (15). Version 0.28.0 (0). 20 + 20 + 5 + 15 + 0 = 60.

HoneyHive 39

Better Stack page at status.honeyhive.ai with a single component, Backend Platform, and nothing separate for the data plane, control plane or ingestion (12 of 20). On 4 November 2026 the page showed "Some services are down", Backend Platform in Downtime and uptime figures of 0.000, 14.836 and 43.447 per cent, with no incident write-ups readable (its /history path redirects to the page itself). We can't tell whether the monitor watches a retired host, but the vendor's own page shows the figures, so 0. The pricing page publishes 1,000 requests a minute on Free and custom limits on Enterprise, and the changelog gives a 7 MiB ingestion body limit (12). The OpenAPI specs declare no 429 and we found no Retry-After or backoff guidance. The Python SDK has a configurable retry budget (5). Enterprise lists an uptime SLA with service credits, but no SLA document is published, so 0 under this run's reading. API, SDKs and CLI are GA (10).

Gauge CLI 40

Scored on the hosted option. No payment protocol (0). Credit prices weren't found on the pages read (0). Local mode is free with no card (20). Local mode needs no sign-up (20). 0 + 0 + 20 + 20 = 40.

HoneyHive 20

No x402 or other machine payment (0). The only paid plan is Enterprise at a custom price, so there's no public per-unit or plan price (0). The free Developer plan needs no card (20). A person signs up in a browser to get a key (0).

Gauge CLI 53

MIT (30). Local data stays in .gauge/ and telemetry fields are listed; hosted data handling wasn't read (18 of 30). Dated changelog, no deprecation policy (10 of 20). Telemetry on by default, disclosed with an opt-out (20). 30 + 18 + 10 + 20 = 78.

HoneyHive 67

Closed platform. The Python SDK, CLI and OpenAPI specs are MIT (18). The privacy policy (11 January 2025) covers platform data, defers retention to the pricing page (30 days on Free), names AWS and Stripe and uses standard contractual clauses for EU transfers, per the 1 October check. Self-hosted data-flow docs exist and a DPA is custom on Enterprise (14). 57 operations marked deprecated in the spec, and dated changelog notices for charts (5 October), datasets and datapoints (14 and 21 October) and experiment runs (27 October) that say the old endpoints keep working for now, with no end date. Against that, the v2.0.0 spec of 8 May removed GET /events and nine other operations without deprecation, per its own oasdiff changelog (14). AWS hosting and US transfer stated, no full subprocessor list. The Python SDK sends no usage data of its own, and the TypeScript SDK's PostHog client is commented out (8).

Gauge CLI 75

CLI reading for an agent driving it. Bundled instructions match the installed version, and output is filterable with -o json (20 of 25). Run summaries and Findings with queryable fields (15 of 20). Errors not documented as a reference (10 of 20). Reruns from checkpoints and a recheck command with a confirm step (15 of 20). Four commands to start, Node only (15 of 15). 20 + 15 + 10 + 15 + 15 = 75.

HoneyHive 63

No MCP server for platform data. The docs MCP only searches documentation. Event search defaults to 1,000 rows with no field projection, so an agent has to set limit itself (10). Filters, date ranges, limit and page on search (18). Since 24 September a bad key, a revoked key and a missing permission all return the same 404 as a missing resource, which leaves an agent guessing (10). POST /session/start is idempotent on session_id. We found no other idempotency keys (10). Python SDK, TypeScript SDKs and a CLI generated one to one from the specs with agent skills. Few required parameters (15).

Gauge CLI 55

Local tool. Agent credentials stay on your machine in local mode; hosted login with a device flow (20 of 30). Test agents run in fresh Docker sessions with injected inputs, and the gateway brokers credentials in hosted mode (12 of 20). Agents under test read your product's docs and outputs, with no prompt-injection guidance (5 of 15). Local transcripts and SQLite evidence per run (10 of 15). No security policy found (8 of 20). 20 + 12 + 5 + 10 + 8 = 55.

HoneyHive 61

Five key types. Project keys (hh_), read-only project keys (hh_ro_) since 11 June, fine-grained control plane keys (hh_fgcp_) with chosen permissions and a required expiry of at most 365 days, and ingestion-only keys (hh_ingst_) bound to one project since 17 September, and fine-grained data plane keys (hh_fgdp_) since 5 October. Revocation takes effect within two minutes (30). Read-only and ingestion-only keys give least privilege, and deleting a workspace with active children fails with 409 unless --dangerously-delete-child-scopes is passed (18). Traces hold whatever the application logged, and we found no prompt-injection guidance for agents reading them (3). No audit log found (0). The pricing page claims SOC 2 Type II, GDPR and HIPAA. The Drata trust centre at trust.honeyhive.ai rendered nothing readable to us, there's no security.txt, and the CLI changelog lists "Security fixes" in 1.6.0 without detail (10).