Agent Development Kit (ADK) vs TradingAgents

Agent Development Kit (ADK)

Python, TypeScript, Go, Java and Kotlin, with tool confirmation and context compaction built in. Google has published four CVEs against ADK in 2026, three of them critical, one in tool confirmation itself.

TradingAgents

An Apache 2.0 LangGraph framework at 0.7.0 with six releases in 90 days, a dated changelog with upgrade notes, a public test matrix and point-in-time rules for historical runs. It has no MCP client or server, no PyPI package and no documentation beyond the README, and its output is a model-written rating that places no orders.

Agent Development Kit (ADK)

1. Run 2.7.0 or later, which fixes the adk web code-injection CVE and the tool-confirmation forgery
2. Always pass tool_filter to McpToolset
3. Pin a 2.x minor and read the changelog before each bump. 2.12.0 needs Python 3.11 or later, which its changelog doesn't say
4. Set EventsCompactionConfig on the App for long sessions so context doesn't grow without limit
5. Keep ADK Web off public interfaces

TradingAgents

1. Run headless with tradingagents --ticker <T> --date <YYYY-MM-DD> --analysts market,news,fundamentals --save --no-show; a missing answer stops the run and names the flag
2. Guard on the REVIEW signal before mapping propagate()'s decision to a rating; it means no rating could be parsed
3. Set SEC_EDGAR_USER_AGENT to the operator's own name and address before fetching US fundamentals
4. Keep provider keys out of the working directory tree unless intended, since the package loads the nearest .env on import
5. Treat the rating as model output for research; the framework places no orders and its results vary between runs