Gauge CLI vs W&B Weave

Gauge CLI 53

MIT (30). Local data stays in .gauge/ and telemetry fields are listed; hosted data handling wasn't read (18 of 30). Dated changelog, no deprecation policy (10 of 20). Telemetry on by default, disclosed with an opt-out (20). 30 + 18 + 10 + 20 = 78.

W&B Weave 72

The SDKs are Apache-2.0 on GitHub. Since 13 October 2026 (commit ada0360f, released in v0.53.13) the trace server implementation is no longer in wandb/weave; the commit says it is now in wandb/core, which isn't public. The hosted service is proprietary under the Master Service Agreement, and self-managed deployment goes through an account representative. Closed platform with open SDKs, read as langsmith and braintrust (18 of 30). MSA, DPA, privacy policy and sub-processor list are all public, per the 8 October check. The MSA lets W&B use Customer Data to improve its services, develop new products and run AI functions, no retention period for trace data was found, and the documents name three entities, Weights and Biases, LLC, CoreWeave, Inc. and the Forge brand (18 of 30). SDK release notes flag deprecated methods. No dated deprecation policy for the Service API, and no end date for Weave now that Agent Lens is named its successor (8 of 20). Nine sub-processors and one affiliate are listed with locations and 10 days' notice of changes (18 of 20). 18 + 18 + 8 + 18 = 62.

Gauge CLI 60

CLI reading. No machine-readable contract, -o json on read commands (10 of 25). No llms.txt; instructions bundled in the CLI for agents (5). The README says what it finds and when local or hosted fits (16 of 20). Commands with help text; typed flags (9 of 15). Worked examples, no error reference (8 of 15). Dated changelog and semver tags (12 of 15). 10 + 5 + 16 + 9 + 8 + 12 = 60.

W&B Weave 74

A live OpenAPI 3.1 document at trace.wandb.ai/openapi.json with 114 paths, 127 operations and 334 schemas, unchanged on 1 November (25). llms.txt and a Markdown twin of every docs page (10). 76 of 127 operations carry a description, the document's title is the framework default, and when to use each endpoint is left to the guides (11). Request bodies are typed, with filter and sort objects, though query is a nested expression tree and several fields are marked beta and subject to change (11). The query guide has a curl example. The document lists only 200 and 422 responses (7). Dated SDK release notes per version, though on 1 November the newest entry is 0.53.12 while v0.53.13 and v0.54.0 are tagged. The API itself reports version 0.1.0 with a few /v2/ paths and no API changelog of its own (10).

Gauge CLI 60

Local package. Installs from npm as @withgauge/cli with Node 22.13 or later and Docker stated (20). checks.yml runs npm run check on push and pull request across a matrix, and the repository has 76 test files; whether main passes wasn't read (20 of 25). Issues weren't read (5, unchecked). A dated changelog with Added sections per release (15). Version 0.28.0 (0). 20 + 20 + 5 + 15 + 0 = 60.

W&B Weave 68

Graded as a hosted service on the Service API and OTLP endpoints at trace.wandb.ai. Statuspage site at status.forge.coreweave.com with ten components, a Weave backend component among them, and history pages (20). From 3 August to 1 November the history holds one entry, "API Degraded" on 1 September, posted after the fact with no duration and no component, saying a Google Cloud incident made "our API and site" degraded or unavailable. The 8 October reading of it as minor stands, and nothing is posted on the Weave backend component, so minor only (20). The earlier reading from the page's /api/ path, which its robots.txt disallows, is replaced by the history pages. No request rate limits for the multi-tenant Service API were found on 1 November either. The one limits page covers run logging on Dedicated Cloud, and the pricing page says Pro has rate limits without giving them (0). The SDK's retry schedule is documented, from 1 second doubling to 5 minutes with a 36 hour timeout, and the source retries 429 but no other 4xx. No Retry-After or idempotency guidance for direct API callers was found (8). SLA of 99.5 per cent monthly uptime for Enterprise Multi-tenant and Dedicated Cloud, per the 8 October check (10). Weave carries no preview label, though Agent Lens does (10). 20 + 20 + 0 + 8 + 10 + 10 = 68.

Gauge CLI 55

Local tool. Agent credentials stay on your machine in local mode; hosted login with a device flow (20 of 30). Test agents run in fresh Docker sessions with injected inputs, and the gateway brokers credentials in hosted mode (12 of 20). Agents under test read your product's docs and outputs, with no prompt-injection guidance (5 of 15). Local transcripts and SQLite evidence per run (10 of 15). No security policy found (8 of 20). 20 + 12 + 5 + 10 + 8 = 55.

W&B Weave 63

Forge API keys in headers only, shown once, revocable by deletion and rotated by replacement. Service account keys are limited to a team or an organisation, and admins can enforce organisation-scoped keys. Keys have no per-permission scopes, and no expiry setting was found (22 of 30). Project roles and restricted projects, and the MCP server has a read-only mode that drops its write tools. No read-only API key (10 of 20). Traces hold whatever the application logged. PII redaction is documented, and no prompt-injection guidance for agents reading traces was found (4 of 15). Audit logs through an API, on Multi-tenant Cloud for Enterprise plans only (10 of 15). SOC 2 Type II, ISO 27001, 27017 and 27018, a private HackerOne bounty by invitation and a reporting address. No security.txt, and reporters must sign an NDA. OSV's only advisory for weave is GHSA-r49h-6qxq-624f (CVE-2024-7340, High, fixed in 0.50.8, July 2024), outside the 12 months (17 of 20).

Gauge CLI 40

Scored on the hosted option. No payment protocol (0). Credit prices weren't found on the pages read (0). Local mode is free with no card (20). Local mode needs no sign-up (20). 0 + 0 + 20 + 20 = 40.

W&B Weave 35

No x402 or other machine payment (0). Plan prices and the ingestion overage, $0.10 per MB on Pro, are published without a login (20). Free includes 1 GB of Weave ingestion a month. The pricing page doesn't say whether a card is needed and the signup page is drawn by script, so 15 of 20. A person signs up in a browser and creates the key in the console (0).

Gauge CLI 82

CLI 0.28.0 on 4 November 2026 (30). Six releases in 90 days (20). Issues and pull requests weren't read; a support address and issue tracker are published (12 of 25). Current official package (15). CI on push and pull request (5 of 10, results not read). 30 + 20 + 12 + 15 + 5 = 82.

W&B Weave 87

Python SDK v0.54.0 tagged on 23 October 2026 (30). Nine tagged Python releases from 3 August, v0.53.6 (13 August) to v0.54.0, read from a clone, and the TypeScript SDK's version moved from 0.16.7 to 0.16.10 in the same window (20). GitHub's pages and API refused our reader, so issue reply times went unseen (14 of 25). Current Python and TypeScript SDKs; the repository's TypeScript SDK is at 0.16.10 against 0.54.0 for Python, and npm's own dates weren't read (15). CI workflows for tests, nightly tests and Node tests, with lock files. 0.53.11 had to pin an OpenTelemetry exporter below 1.45 after weave.init() broke, and 0.53.12 lifted the cap (8). 30 + 20 + 14 + 15 + 8 = 87.