Gauge CLI vs LangWatch

Gauge CLI 60

CLI reading. No machine-readable contract, -o json on read commands (10 of 25). No llms.txt; instructions bundled in the CLI for agents (5). The README says what it finds and when local or hosted fits (16 of 20). Commands with help text; typed flags (9 of 15). Worked examples, no error reference (8 of 15). Dated changelog and semver tags (12 of 15). 10 + 5 + 16 + 9 + 8 + 12 = 60.

LangWatch 87

A public OpenAPI 3.1 document of 281 paths and 406 operations on 1 November, served without a key, and typed zod inputs on every MCP tool (25). llms.txt and a Markdown twin of each docs page (10). Every operation has a summary or description, and MCP descriptions say when to pick a tool, for example run_query for counts and rates and discover_schema before a search. 192 operations carry no tag (16). 910 enum keys in the document, with trace filters still accepted as a free-form map alongside the query language (12). Docs pages carry request examples, and the gateway error list gives 34 codes with cause and remedy. Most platform operations document errors only as an error and message string pair (11). Dated public changelog, release notes per package and a document version of 1.0.0, with /api/v1 paths mixed among unversioned ones (13).

Gauge CLI 53

MIT (30). Local data stays in .gauge/ and telemetry fields are listed; hosted data handling wasn't read (18 of 30). Dated changelog, no deprecation policy (10 of 20). Telemetry on by default, disclosed with an opt-out (20). 30 + 18 + 10 + 20 = 78.

LangWatch 76

Apache 2.0 platform with the platform/app/ee directory under a separate Enterprise licence, and MIT SDKs and MCP server (27). The privacy policy of 29 September 2026 names its processors and the retention docs are detailed, but the documents disagree in places. The pricing page says 30-day retention is included where the docs say 49 days, the terms describe a 14-day free trial where the pricing page says free forever, and the terms give two addresses and two spellings of the entity. The terms also grant LangWatch a perpetual licence to use client data to improve the platform, while saying it will not train on it (18). Deprecated endpoints are marked in the OpenAPI document and the docs, and breaking changes are flagged in the changelogs, but no removal dates or notice period were found (10). EU hosting on AWS is stated and processors are named in the privacy policy. Self-hosted telemetry is documented connection by connection with an off switch. The public sub-processor list is on a host we could not read (18).

Gauge CLI 55

Local tool. Agent credentials stay on your machine in local mode; hosted login with a device flow (20 of 30). Test agents run in fresh Docker sessions with injected inputs, and the gateway brokers credentials in hosted mode (12 of 20). Agents under test read your product's docs and outputs, with no prompt-injection guidance (5 of 15). Local transcripts and SQLite evidence per run (10 of 15). No security policy found (8 of 20). 20 + 12 + 5 + 10 + 8 = 55.

LangWatch 71

OAuth authorisation code with PKCE and dynamic client registration on the remote MCP server, and API keys with read or write per category, a project, team or organisation scope, expiry and revocation, plus write-only ingestion keys. The apiKey query parameter on /sse was removed in MCP server 2.0.0 (30). Restricted keys and lite members give read-only access, but no tool asks for confirmation before a delete and the MCP tools carry no annotations (14). Traces hold whatever the application logged, and we found no prompt-injection guidance for agents reading them (3). The audit log is Enterprise only and leaves out sign-ins and reads of product data. The key list shows a last-used date (9). SECURITY.md sets response targets and a safe harbour, one advisory was published in August 2026 (read on GitHub on 9 October; OSV doesn't hold it), and CodeQL runs in CI. ISO 27001 and a CREST penetration test are stated, with reports on request. No security.txt and no bug bounty found (15).

Gauge CLI 75

CLI reading for an agent driving it. Bundled instructions match the installed version, and output is filterable with -o json (20 of 25). Run summaries and Findings with queryable fields (15 of 20). Errors not documented as a reference (10 of 20). Reruns from checkpoints and a recheck command with a confirm step (15 of 20). Four commands to start, Node only (15 of 15). 20 + 15 + 10 + 15 + 15 = 75.

LangWatch 67

The MCP server registers 110 tools in the 3.0.0 source, with no toolsets or dynamic loading found. Trace tools return a compact digest by default, which earns 3 back (8). Cursor paging with next_cursor, limit and pageSize, filters, a projection DSL on trace search and a digest or json format switch (20). Gateway errors carry a stable code, tips, a docs link and a fault field, and the MCP client passes them on. Platform errors are plainer (16). No readOnlyHint or destructiveHint in the MCP source. Idempotency exists for evaluations and ingested events, and several delete tools archive instead of removing (8). Python, TypeScript and Go SDKs, a CLI, and few required parameters (15).

Gauge CLI 82

CLI 0.28.0 on 4 November 2026 (30). Six releases in 90 days (20). Issues and pull requests weren't read; a support address and issue tracker are published (12 of 25). Current official package (15). CI on push and pull request (5 of 10, results not read). 30 + 20 + 12 + 15 + 5 = 82.

LangWatch 90

Platform 3.21.0 on 21 October 2026, TypeScript SDK 2.1.0 and MCP server 3.0.0 on 30 October (30). 19 platform releases dated since 3 August in CHANGELOG.md, and weekly dated entries on the public changelog to 25 October (20). Per the 9 October check, not re-read on 1 November (GitHub's pages refuse our reader), 52 open issues and 222 open pull requests, with new issues labelled and prioritised by maintainers within a week, and support by email, Discord and GitHub (17). Current official SDKs, Python 1.4.0 on 6 September, TypeScript 2.1.0 on 30 October and Go 1.0.0 on 9 September. The MCP server is still not in the official MCP registry (15). CI workflows for the app, each SDK and the MCP server, CodeQL and dependency bumps in the changelog, with fixes for dependency alerts in October. We could not confirm the pass state (8).