guilds.run vs LlamaIndex Framework

guilds.run 21

No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.

LlamaIndex Framework 69

llama-index-core 0.14.25 on 21 September 2026, 46 days before this check (20). Two core changelog entries in the 90 days (19 August and 21 September), with integration packages and Workflows (2.24.1 to 2.26.1) publishing in between, so partial (12). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). Core, Workflows and integrations are current (15). CI and CodeQL passing on main and a stale-package policy that moves unmaintained integrations out of main (10). 20+12+12+15+10 = 69.

guilds.run 43

Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.

LlamaIndex Framework 70

Local-package reading. Official PyPI packages with Python 3.10 to below 4.0 (20). Public unit-test, type-check, lint, coverage and CodeQL workflows, with the type-check, lint and CodeQL runs on main passing on 3 November (25). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). A dated, generated changelog per package, but core is 0.x and minors such as 0.13 and 0.14 carried breaking changes (8). Core isn't 1.0; Workflows is at 2.x, so partial (5). 20+25+12+8+5 = 70.

guilds.run 58

Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.

LlamaIndex Framework 85

Framework reading. A typed Python API with a generated reference (22). llms.txt indexing the framework docs, plus a docs search API and an MCP server for the docs (10). The agents guide says what each agent class is for, and the MCP page lists the three ways to use MCP (15). Tools are typed from function signatures and Pydantic models (13). Many examples and notebooks, few documented error types (10). Dated changelog (15). 22+10+15+13+10+15 = 85.

guilds.run 60

AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.

LlamaIndex Framework 67

MIT (30). The library stores nothing itself; OpenAI is the default provider unless changed, which the docs show (20). A stale-package policy and removals noted in the changelog, such as deprecated IPEX integrations removed in 0.14.25, without dated notice (10). No telemetry, though no page states it (12). 30+20+10+12 = 72.

guilds.run 67

Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).

LlamaIndex Framework 73

Framework reading. MCP tools through a separate llama-index-tools-mcp package, with allowed tools selectable (18). Memory token limits, iteration caps and streaming events (16). Tool errors returned to the agent, with few typed errors (12). Workflow context serialises and resumes, and the DBOS package makes runs durable (16). Few required parameters, but OpenAI is the silent default for LLM and embeddings, Python here with a separate TypeScript edition (11). 18+16+12+16+11 = 73.

guilds.run 68

Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. Model keys go only to their provider and Sentry starts only when SENTRY_DSN is set, with user info, bodies and model inputs and outputs excluded. Graft left the runtime image on 13 October (SEC-9), so its version lookup is gone, but the box fetches the models.dev catalogue on first read and hourly (switch MODELS_DEV_URL, documented) and the OAuth pages load Google Fonts (27). Each machine is an OpenSandbox container with dropped capabilities and no_new_privileges, writing MCP tools start Off and Studio changes wait for the operator. Agents on one machine share it and run commands as root with open egress (SEC-6, SEC-24), no per-call approval gate for tool calls was found, and the default AUTH_MODE compat-cookie has no login (10). The coding prompt says repository content is data, Studio wraps evidence as untrusted, and known secret values are redacted from transcripts. SEC-8, injection into coding agents, and SEC-47, GitHub content steering writes, are open (8). Every run keeps the prompt, each tool call and result, and versioned memory with who changed it (14). SECURITY.md with GitHub private reporting and no acknowledgement time, and a public register of 58 issues on 4 November with exposure and residual risk, 28 still open (18 open, 10 open and accepted). No security.txt (404), bounty or published advisory (9). 27 + 10 + 8 + 14 + 9 = 68. Sixteen register fixes dated 17 October to 3 November are on main with no release and no advisory; no term, because packages is empty and there is no hosted product, as ayrshare's plugin fix was read.

LlamaIndex Framework 74

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in llama-index-core (25). Human-in-the-loop events in Workflows and agents can wait for a person, but there's no per-tool approval primitive and CodeActAgent's executor is the developer's to supply (12). The threat model puts input validation on the application, with no prompt-injection guidance in the agent pages (5). Instrumentation events and callback handlers for tracing (14). A huntr bug bounty, GitHub private reporting and public advisories with fixed versions (18). 25+12+5+14+18 = 74.