{ "data": { "a": { "slug": "guilds-run", "name": "guilds.run", "vendor": "Cigale AI", "vendorUrl": "https://guilds.run", "kind": "framework", "category": "frameworks", "summary": "Open-source, self-hosted system from Cigale AI for standing teams of AI agents, each with its own role, model and tools. A guild shares chat, notes and tables, and every run keeps the prompt, tool calls and memory changes.", "url": "https://www.anchorterminal.com/tools/guilds-run", "markdownUrl": "https://www.anchorterminal.com/tools/guilds-run.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/guilds-run.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/guilds-run.json", "dns": "guilds-run.grade.anchorterminal.com", "repo": "https://github.com/CigaleAI/guilds", "license": "AGPL-3.0-only", "transports": [], "packages": [], "auth": "api-key", "authNotes": "The box has no model key of its own. Each organisation pastes a key for OpenAI, OpenRouter, xAI, DeepInfra or Kimi Code, or points at a local OpenAI-compatible endpoint, and the key is sent only to that provider. The web app on 127.0.0.1:8080 has no login by default; whoever reaches the port is the operator. AUTH_MODE=trusted-header takes identity from an authenticating proxy with a shared secret.", "pricing": "free", "pricingNotes": "Free under AGPL-3.0 to run yourself, with model usage billed by your own provider and no spend cap set by guilds.run. A hosted edition from $19 a month is listed as coming soon and not available on 14 October 2026 (https://www.guilds.run/pricing).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs or on guilds.run (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.guilds.run/", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.mcp-client", "agent.durable" ], "tags": [ "framework", "open-source", "self-hosted", "local", "docker", "typescript", "free", "no-card", "pre-1.0" ], "graded": true, "anchor": { "graded": true, "score": 53.4, "grade": "D", "agentReady": false, "rank": 951, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 21, "payments": 60, "reliability": 43, "schema": 58, "security": 68, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -2, "negativeNotes": [ "2026-10-14, still live on 2026-11-04. The home page says each agent has its own computer, and its script example reads sandboxed in scout's workspace. Since the change of 13 October 2026 (pull request #8, per-org machines), agents are placed on shared machines, and the vendor's own register (SEC-24, open and accepted) and machines page say agents on one machine can read each other's homes, git tokens, browser sessions and running commands' environments. The footer also links to terms and privacy pages that return 404. The docs state the shared-machine risk plainly, so 2 points. https://www.guilds.run/ and https://github.com/CigaleAI/guilds/blob/main/docs/architecture/security-register.md" ], "verdict": "A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.", "bestFor": "A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.", "strengths": [ "Every run stores the prompt the model saw, each tool call and result, and versioned memory with the author of each change", "Free under AGPL-3.0, with Sentry off unless SENTRY_DSN is set and the model catalogue fetch switchable", "MCP tools that write or are marked destructive start Off for a new login, and each agent is offered only the tools turned on for it", "CI runs typecheck, lint, unit tests and a smoke test of the Compose stack on every push", "A public security register records 58 issues with status, exposure and residual risk" ], "weaknesses": [ "No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes", "28 issues in the vendor's security register are open, among them shared machines (SEC-24), root shells (SEC-6) and prompt injection into coding agents (SEC-8)", "No login on the default box. Whoever reaches port 8080 is the operator, and remote use needs a proxy or tailnet", "Terms and privacy links on guilds.run return 404, and no privacy statement for the software was found", "The changelog holds only an Unreleased section with no dates" ], "agentNotes": [ "Keep the box on loopback or behind an authenticating proxy with AUTH_MODE=trusted-header. The default mode does not authenticate", "Put agents that hold different secrets or GitHub tokens on different machines. Agents on one machine can read each other's homes and tokens", "Back up the .env file written by ./setup.sh. It holds the only copy of the key that encrypts stored credentials", "Pin a commit of main when you deploy and read CHANGELOG.md's Unreleased section before pulling. Breaking changes land on main", "Set MODELS_DEV_URL empty for an offline box. The model catalogue is otherwise fetched from models.dev hourly" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.4 } ], "editorialScores": { "ergonomics": 67, "maintenance": 21, "payments": 60, "reliability": 43, "schema": 58, "security": 68, "transparency": 63 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/CigaleAI/guilds.git \u0026\u0026 cd guilds \u0026\u0026 ./setup.sh \u0026\u0026 docker compose up --detach --wait" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/guilds-run" }, "area": "frameworks", "provenance": { "legalEntity": "Cigale AI", "domain": "guilds.run", "domainRegistered": "2026-09-19", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/CigaleAI/guilds/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The site footer says Cigale is the company behind guilds.run, and THIRD_PARTY_NOTICES.md reads copyright Cigale AI. No legal form or address was found.", "The footer links to https://www.guilds.run/terms and https://www.guilds.run/privacy, and both returned 404 on 14 October and 4 November 2026.", "www.guilds.run/.well-known/security.txt returns 404. The repository has SECURITY.md with GitHub private vulnerability reporting.", "CHANGELOG.md in the repository since 15 October 2026, with an Unreleased section only.", "RDAP gives guilds.run a registration date of 2026-09-19.", "The GitHub organisation CigaleAI was created on 2025-02-17 and is not verified." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/guilds-run.json", "live": { "slug": "guilds-run", "githubStars": 67, "securityTxt": { "url": "https://guilds.run/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:37.244745625Z" }, "domain": { "domain": "guilds.run", "registered": "2026-09-19", "source": "https://rdap.identitydigital.services/rdap/domain/guilds.run", "checkedAt": "2026-11-01T14:12:07.621535185Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CigaleAI/guilds/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:18:06.648722196Z", "changedAt": "2026-11-06T13:39:41.628947519Z", "fingerprint": "f9038c621e32" }, { "url": "https://www.guilds.run/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:29:26.228895188Z", "changedAt": "2026-10-15T22:10:00.990326283Z", "fingerprint": "e3efa801ad24" } ], "github": { "repo": "cigaleai/guilds", "checkedAt": "2026-11-02T08:38:38.17968009Z", "stars": 67, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T17:47:15Z", "openIssues": 0, "openPRs": 0, "issuesOpened90d": 5, "issuesClosed90d": 5, "prsMerged90d": 17, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-11-01T17:52:53Z" }, "replies": { "sampled": 5, "unanswered": 0, "medianDays": 0 } }, "updatedAt": "2026-11-07T15:59:37.244745625Z" } }, "answer": "AI SDK scores 89.8 (AA) on agent readiness against guilds.run's 53.4 (D), and leads in 6 of 7 scored categories.", "b": { "slug": "vercel-ai-sdk", "name": "AI SDK", "vendor": "Vercel Inc.", "vendorUrl": "https://vercel.com", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript toolkit from Vercel for building AI applications and agents, with a provider-agnostic API, a ToolLoopAgent, an MCP client and UI hooks for React, Vue, Svelte and Angular.", "url": "https://www.anchorterminal.com/tools/vercel-ai-sdk", "markdownUrl": "https://www.anchorterminal.com/tools/vercel-ai-sdk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/vercel-ai-sdk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/vercel-ai-sdk.json", "dns": "vercel-ai-sdk.grade.anchorterminal.com", "repo": "https://github.com/vercel/ai", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "ai" }, { "registry": "npm", "name": "@ai-sdk/mcp" }, { "registry": "npm", "name": "@ai-sdk/workflow" } ], "auth": "api-key", "authNotes": "The SDK has no account of its own. Each provider package takes that provider's key. Plain string model IDs resolve through Vercel's AI Gateway by default, which needs AI_GATEWAY_API_KEY or a Vercel OIDC token.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The optional AI Gateway charges providers' list prices with no markup, from prepaid credits, with a free monthly credit on a subset of models (https://vercel.com/docs/ai-gateway/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the AI SDK docs, the vercel/ai repository's packages or the AI Gateway pricing page. The tools registry in the repository lists a third-party x402 marketplace tool (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 27781, "npmWeekly": 44868298, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ai-sdk.dev/docs", "llmsTxt": "https://ai-sdk.dev/llms.txt", "capabilities": [ "agent.framework", "agent.mcp-client", "agent.multi-agent", "agent.durable" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "otel" ], "lastRelease": "2026-11-05", "graded": true, "anchor": { "graded": true, "score": 89.8, "grade": "AA", "agentReady": true, "rank": 1, "ranked": true, "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 95, "maintenance": 97, "payments": 60, "reliability": 93, "schema": 100, "security": 90, "transparency": 89 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "A TypeScript agent toolkit with ToolLoopAgent, a built-in MCP client, per-tool approvals that can be HMAC-signed, opt-in OpenTelemetry and durable runs through WorkflowAgent. It ships three major versions in 14 months (5.0, 6.0, 7.0), each with a migration guide, and plain string model IDs route through Vercel's AI Gateway unless another provider is set.", "bestFor": "TypeScript teams building agents and chat UIs who want one API across many providers and a short path to MCP.", "strengths": [ "Apache 2.0, with 246 npm releases of `ai` in the 90 days to 6 October 2026", "MCP client in @ai-sdk/mcp with HTTP, SSE and stdio transports, OAuth and opt-in retries for tools/call", "Per-tool approvals, HMAC-signed approvals and Open Policy Agent rules in @ai-sdk/policy-opa", "Telemetry only after an OpenTelemetry integration is registered, with recordInputs and recordOutputs switches", "Tool search with deferred loading, so the model sees only a search tool until it needs more" ], "weaknesses": [ "TypeScript only, and `ai` 7.x needs Node 22 or newer", "Three major versions between July 2025 and June 2026, each with breaking changes", "String model IDs go to Vercel's AI Gateway by default, which needs a Vercel key", "No input or output guardrail primitive, and sandboxes and stdio MCP transport are still experimental", "1,399 open issues and pull requests on 4 October 2026, per a GitHub mirror" ], "agentNotes": [ "Pass a provider instance such as openai('model') if traffic shouldn't go through Vercel's AI Gateway", "Set toolApproval on tools that write, and experimental_toolApprovalSecret when approvals come back from a browser", "Raise or replace the default stop condition of 20 steps with stopWhen", "Close the MCP client after the run, and use HTTP transport outside local development", "Set recordInputs and recordOutputs to false when spans would carry secrets" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "AA", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 89.8 } ], "editorialScores": { "ergonomics": 95, "maintenance": 97, "payments": 60, "reliability": 93, "schema": 100, "security": 90, "transparency": 86 }, "provenanceScore": 91, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm i ai # MCP: npm i @ai-sdk/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/vercel-ai-sdk" }, "area": "frameworks", "provenance": { "legalEntity": "Vercel Inc.", "domain": "ai-sdk.dev", "domainRegistered": "2024-09-26", "endpointOnVendorDomain": null, "terms": "https://vercel.com/legal/terms", "privacy": "https://vercel.com/legal/privacy-policy", "statusPage": "https://www.vercel-status.com", "changelog": "https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "The privacy notice (effective 1 June 2026) names Vercel Inc.", "vercel.com/.well-known/security.txt points to HackerOne and responsible.disclosure@vercel.com and expires 2027-09-28.", "RDAP gives ai-sdk.dev a registration date of 2024-09-26 and vercel.com 1999-10-04.", "The status page covers Vercel's hosted services, including the AI Gateway, not the library." ], "score": 91 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/vercel-ai-sdk.json", "live": { "slug": "vercel-ai-sdk", "vendorStatus": { "page": "https://www.vercel-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:23:51.340953129Z" }, "versions": [ { "registry": "github", "name": "vercel/ai", "version": "@ai-sdk/zai@2.0.19", "released": "2026-11-06", "seenAt": "2026-11-07T00:15:06.320451302Z" }, { "registry": "npm", "name": "@ai-sdk/mcp", "version": "2.0.92", "seenAt": "2026-11-07T00:15:02.210062748Z" }, { "registry": "npm", "name": "@ai-sdk/workflow", "version": "2.0.96", "seenAt": "2026-11-07T00:15:04.290347217Z" }, { "registry": "npm", "name": "ai", "version": "7.0.164", "seenAt": "2026-11-07T00:15:02.102209516Z" } ], "githubStars": 27784, "npmWeekly": 44868298, "securityTxt": { "url": "https://ai-sdk.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:53.467050636Z" }, "llmsTxt": { "url": "https://ai-sdk.dev/llms.txt", "ok": false, "status": 0, "checkedAt": "2026-11-07T15:34:35.854467131Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/vercel/ai/main/packages/ai/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:01.002799396Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6e9ccd1db741" } ], "updatedAt": "2026-11-07T19:23:51.340953129Z" } }, "edges": [ { "by": 76, "category": "maintenance", "leads": "vercel-ai-sdk", "name": "Maintenance \u0026 community", "reasons": { "a": "No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.", "b": "7.0.163 on 2026-11-05 (30). 226 stable npm releases of `ai` across the 7.x, 6.x and 5.x lines in the 90 days to 6 November, 70 of them since 6 October (20). 47 of the 50 newest issues commented and 32 closed, with triage automation and backport workflows (22). `ai` and the provider packages are current, and 6.x and 5.x still get patches (15). Dependabot configured and CI passing on main (10). 30+20+22+15+10 = 97." }, "scores": { "a": 21, "b": 97 } }, { "by": 50, "category": "reliability", "leads": "vercel-ai-sdk", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.", "b": "Official npm packages, with `ai` 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read." }, "scores": { "a": 43, "b": 93 } }, { "by": 42, "category": "schema", "leads": "vercel-ai-sdk", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.", "b": "Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15)." }, "scores": { "a": 58, "b": 100 } }, { "by": 29, "category": "transparency", "leads": "vercel-ai-sdk", "name": "Transparency \u0026 trust", "reasons": { "a": "AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.", "b": "Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20)." }, "scores": { "a": 60, "b": 89 } }, { "by": 28, "category": "ergonomics", "leads": "vercel-ai-sdk", "name": "Agent ergonomics", "reasons": { "a": "Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).", "b": "An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10)." }, "scores": { "a": 67, "b": 95 } }, { "by": 22, "category": "security", "leads": "vercel-ai-sdk", "name": "Security \u0026 auth", "reasons": { "a": "Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. Model keys go only to their provider and Sentry starts only when SENTRY_DSN is set, with user info, bodies and model inputs and outputs excluded. Graft left the runtime image on 13 October (SEC-9), so its version lookup is gone, but the box fetches the models.dev catalogue on first read and hourly (switch MODELS_DEV_URL, documented) and the OAuth pages load Google Fonts (27). Each machine is an OpenSandbox container with dropped capabilities and no_new_privileges, writing MCP tools start Off and Studio changes wait for the operator. Agents on one machine share it and run commands as root with open egress (SEC-6, SEC-24), no per-call approval gate for tool calls was found, and the default AUTH_MODE compat-cookie has no login (10). The coding prompt says repository content is data, Studio wraps evidence as untrusted, and known secret values are redacted from transcripts. SEC-8, injection into coding agents, and SEC-47, GitHub content steering writes, are open (8). Every run keeps the prompt, each tool call and result, and versioned memory with who changed it (14). SECURITY.md with GitHub private reporting and no acknowledgement time, and a public register of 58 issues on 4 November with exposure and residual risk, 28 still open (18 open, 10 open and accepted). No security.txt (404), bounty or published advisory (9). 27 + 10 + 8 + 14 + 9 = 68. Sixteen register fixes dated 17 October to 3 November are on main with no release and no advisory; no term, because `packages` is empty and there is no hosted product, as ayrshare's plugin fix was read.", "b": "No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored." }, "scores": { "a": 68, "b": 90 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Cigale AI", "b": "Vercel Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "AGPL-3.0-only", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "none", "b": "2026-11-05", "name": "Last release" }, { "a": "no document linked", "b": "2026-06-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "57 stars", "b": "28k stars, 44.9M npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "AI SDK scores 89.8 (AA) on agent readiness against guilds.run's 53.4 (D), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, guilds.run or AI SDK?" }, { "answer": "Yes. guilds.run is open source (AGPL-3.0-only). AI SDK is open source (Apache-2.0).", "question": "Are guilds.run and AI SDK open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Free to start without a card" ], "goodFor": "A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.", "slug": "guilds-run", "watchFor": "No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes" }, { "aheadOn": [ "Reliability, 93 against 43", "Schema \u0026 documentation, 100 against 58", "Agent ergonomics, 95 against 67", "Security \u0026 auth, 90 against 68", "Maintenance \u0026 community, 97 against 21", "Transparency \u0026 trust, 89 against 60" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "TypeScript teams building agents and chat UIs who want one API across many providers and a short path to MCP.", "slug": "vercel-ai-sdk", "watchFor": "TypeScript only, and `ai` 7.x needs Node 22 or newer" } ], "history": { "guilds-run": [ { "causes": [ "product", "evidence", "correction" ], "date": "2026-11-04", "delta": -3.2, "from": 56.6, "fromGrade": "C", "to": 53.4, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 56.5, "fromGrade": "C", "to": 56.6, "toGrade": "C" } ], "vercel-ai-sdk": null }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-guilds-run.json", "title": "AgentOS vs guilds.run", "url": "https://www.anchorterminal.com/compare/agentos-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-vercel-ai-sdk.json", "title": "AgentOS vs AI SDK", "url": "https://www.anchorterminal.com/compare/agentos-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-guilds-run.json", "title": "Agno vs guilds.run", "url": "https://www.anchorterminal.com/compare/agno-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-vercel-ai-sdk.json", "title": "Agno vs AI SDK", "url": "https://www.anchorterminal.com/compare/agno-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.json", "title": "BoxLang AI vs guilds.run", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.json", "title": "BoxLang AI vs AI SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run.json", "title": "Claude Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-vercel-ai-sdk.json", "title": "Claude Agent SDK vs AI SDK", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-guilds-run.json", "title": "CrewAI vs guilds.run", "url": "https://www.anchorterminal.com/compare/crewai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-vercel-ai-sdk.json", "title": "CrewAI vs AI SDK", "url": "https://www.anchorterminal.com/compare/crewai-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.json", "title": "Cursor Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk.json", "title": "Cursor Agent SDK vs AI SDK", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run.json", "title": "Docker Agent vs guilds.run", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-vercel-ai-sdk.json", "title": "Docker Agent vs AI SDK", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.json", "title": "Agent Development Kit (ADK) vs guilds.run", "url": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk.json", "title": "Agent Development Kit (ADK) vs AI SDK", "url": "https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.json", "title": "guilds.run vs LangGraph", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex.json", "title": "guilds.run vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "title": "guilds.run vs Mastra", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework.json", "title": "guilds.run vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.json", "title": "guilds.run vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.json", "title": "guilds.run vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.json", "title": "guilds.run vs smolagents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.json", "title": "guilds.run vs Strands Agents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.json", "title": "guilds.run vs TradingAgents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk.json", "title": "LangGraph vs AI SDK", "url": "https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-vercel-ai-sdk.json", "title": "LlamaIndex Framework vs AI SDK", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-vercel-ai-sdk.json", "title": "Microsoft Agent Framework vs AI SDK", "url": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk.json", "title": "OpenAI Agents SDK vs AI SDK", "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/pydantic-ai-vs-vercel-ai-sdk.json", "title": "Pydantic AI vs AI SDK", "url": "https://www.anchorterminal.com/compare/pydantic-ai-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk.json", "title": "smolagents vs AI SDK", "url": "https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.json", "title": "Strands Agents vs AI SDK", "url": "https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk.json", "title": "TradingAgents vs AI SDK", "url": "https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 50, "edge": "vercel-ai-sdk", "guilds-run": 43, "key": "reliability", "name": "Reliability", "vercel-ai-sdk": 93, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 42, "edge": "vercel-ai-sdk", "guilds-run": 58, "key": "schema", "name": "Schema \u0026 documentation", "vercel-ai-sdk": 100, "weight": 13 }, { "by": 28, "edge": "vercel-ai-sdk", "guilds-run": 67, "key": "ergonomics", "name": "Agent ergonomics", "vercel-ai-sdk": 95, "weight": 13 }, { "by": 22, "edge": "vercel-ai-sdk", "guilds-run": 68, "key": "security", "name": "Security \u0026 auth", "vercel-ai-sdk": 90, "weight": 14 }, { "by": 0, "edge": "", "guilds-run": 60, "key": "payments", "name": "Payments \u0026 pricing", "vercel-ai-sdk": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 76, "edge": "vercel-ai-sdk", "guilds-run": 21, "key": "maintenance", "name": "Maintenance \u0026 community", "vercel-ai-sdk": 97, "weight": 7 }, { "by": 29, "edge": "vercel-ai-sdk", "guilds-run": 60, "key": "transparency", "name": "Transparency \u0026 trust", "vercel-ai-sdk": 89, "weight": 7 } ], "summary": "AI SDK scores 89.8 (AA) on agent readiness against guilds.run's 53.4 (D), and leads in 6 of 7 scored categories. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "guilds-run": "A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.", "vercel-ai-sdk": "A TypeScript agent toolkit with ToolLoopAgent, a built-in MCP client, per-tool approvals that can be HMAC-signed, opt-in OpenTelemetry and durable runs through WorkflowAgent. It ships three major versions in 14 months (5.0, 6.0, 7.0), each with a migration guide, and plain string model IDs route through Vercel's AI Gateway unless another provider is set." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk", "json": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.min.md" }, "markdown": "AI SDK scores 89.8 (AA) on agent readiness against guilds.run's 53.4 (D), and leads in 6 of 7 scored categories. Both do agent frameworks.\n\n- guilds.run: grade D, 53.4/100, rank #951 of 1510. Markdown https://www.anchorterminal.com/tools/guilds-run.md · JSON https://www.anchorterminal.com/api/v1/tools/guilds-run.json\n- AI SDK: grade AA, 89.8/100, rank #1 of 1510. Markdown https://www.anchorterminal.com/tools/vercel-ai-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-ai-sdk.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### guilds.run (D)\n\nGood for: A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes\n\n### AI SDK (AA)\n\nGood for: TypeScript teams building agents and chat UIs who want one API across many providers and a short path to MCP.\n\nAhead on:\n- Reliability, 93 against 43\n- Schema \u0026 documentation, 100 against 58\n- Agent ergonomics, 95 against 67\n- Security \u0026 auth, 90 against 68\n- Maintenance \u0026 community, 97 against 21\n- Transparency \u0026 trust, 89 against 60\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: TypeScript only, and `ai` 7.x needs Node 22 or newer\n\n\n## Why the edge\n\n### Maintenance \u0026 community: AI SDK +76\n\n- guilds.run (21): No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.\n- AI SDK (97): 7.0.163 on 2026-11-05 (30). 226 stable npm releases of `ai` across the 7.x, 6.x and 5.x lines in the 90 days to 6 November, 70 of them since 6 October (20). 47 of the 50 newest issues commented and 32 closed, with triage automation and backport workflows (22). `ai` and the provider packages are current, and 6.x and 5.x still get patches (15). Dependabot configured and CI passing on main (10). 30+20+22+15+10 = 97.\n\n### Reliability: AI SDK +50\n\n- guilds.run (43): Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.\n- AI SDK (93): Official npm packages, with `ai` 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.\n\n### Schema \u0026 documentation: AI SDK +42\n\n- guilds.run (58): Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.\n- AI SDK (100): Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).\n\n### Transparency \u0026 trust: AI SDK +29\n\n- guilds.run (60): AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.\n- AI SDK (89): Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).\n\n### Agent ergonomics: AI SDK +28\n\n- guilds.run (67): Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).\n- AI SDK (95): An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).\n\n### Security \u0026 auth: AI SDK +22\n\n- guilds.run (68): Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. Model keys go only to their provider and Sentry starts only when SENTRY_DSN is set, with user info, bodies and model inputs and outputs excluded. Graft left the runtime image on 13 October (SEC-9), so its version lookup is gone, but the box fetches the models.dev catalogue on first read and hourly (switch MODELS_DEV_URL, documented) and the OAuth pages load Google Fonts (27). Each machine is an OpenSandbox container with dropped capabilities and no_new_privileges, writing MCP tools start Off and Studio changes wait for the operator. Agents on one machine share it and run commands as root with open egress (SEC-6, SEC-24), no per-call approval gate for tool calls was found, and the default AUTH_MODE compat-cookie has no login (10). The coding prompt says repository content is data, Studio wraps evidence as untrusted, and known secret values are redacted from transcripts. SEC-8, injection into coding agents, and SEC-47, GitHub content steering writes, are open (8). Every run keeps the prompt, each tool call and result, and versioned memory with who changed it (14). SECURITY.md with GitHub private reporting and no acknowledgement time, and a public register of 58 issues on 4 November with exposure and residual risk, 28 still open (18 open, 10 open and accepted). No security.txt (404), bounty or published advisory (9). 27 + 10 + 8 + 14 + 9 = 68. Sixteen register fixes dated 17 October to 3 November are on main with no release and no advisory; no term, because `packages` is empty and there is no hosted product, as ayrshare's plugin fix was read.\n- AI SDK (90): No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.\n\n## Score by category\n\n| Category | Weight | guilds.run | AI SDK | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 43 | 93 | AI SDK +50 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 58 | 100 | AI SDK +42 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 95 | AI SDK +28 |\n| Security \u0026 auth | 14% (17.5 this run) | 68 | 90 | AI SDK +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 21 | 97 | AI SDK +76 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 89 | AI SDK +29 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **53.4 · D** | **89.8 · AA** | |\n\n## Facts side by side\n\n| Fact | guilds.run | AI SDK |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Cigale AI | Vercel Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | AGPL-3.0-only | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | none | 2026-11-05 |\n| Terms last updated | no document linked | 2026-06-01 |\n| Privacy policy last updated | no document linked | 2026-06-01 |\n| Customer content may train models | not read yet | yes, with an opt-out |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | 57 stars | 28k stars, 44.9M npm/wk |\n\n## How the scores have moved\n\n### guilds.run\n\n- -3.2 on 4 November 2026 (C to D): product, new evidence, correction\n- +0.1 on 27 October 2026: checklist\n\n### AI SDK\n\nNo score change since it was listed.\n\n## Verdicts\n\n**guilds.run.** A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.\n\n**AI SDK.** A TypeScript agent toolkit with ToolLoopAgent, a built-in MCP client, per-tool approvals that can be HMAC-signed, opt-in OpenTelemetry and durable runs through WorkflowAgent. It ships three major versions in 14 months (5.0, 6.0, 7.0), each with a migration guide, and plain string model IDs route through Vercel's AI Gateway unless another provider is set.\n\n## Before you call either\n\n### guilds.run\n\n1. Keep the box on loopback or behind an authenticating proxy with AUTH_MODE=trusted-header. The default mode does not authenticate\n2. Put agents that hold different secrets or GitHub tokens on different machines. Agents on one machine can read each other's homes and tokens\n3. Back up the .env file written by ./setup.sh. It holds the only copy of the key that encrypts stored credentials\n4. Pin a commit of main when you deploy and read CHANGELOG.md's Unreleased section before pulling. Breaking changes land on main\n5. Set MODELS_DEV_URL empty for an offline box. The model catalogue is otherwise fetched from models.dev hourly\n\n### AI SDK\n\n1. Pass a provider instance such as openai('model') if traffic shouldn't go through Vercel's AI Gateway\n2. Set toolApproval on tools that write, and experimental_toolApprovalSecret when approvals come back from a browser\n3. Raise or replace the default stop condition of 20 steps with stopWhen\n4. Close the MCP client after the run, and use HTTP transport outside local development\n5. Set recordInputs and recordOutputs to false when spans would carry secrets\n\n## Questions\n\n### Which is better for AI agents, guilds.run or AI SDK?\n\nAI SDK scores 89.8 (AA) on agent readiness against guilds.run's 53.4 (D), and leads in 6 of 7 scored categories.\n\n### Are guilds.run and AI SDK open source?\n\nYes. guilds.run is open source (AGPL-3.0-only). AI SDK is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"guilds-run\", \"b\": \"vercel-ai-sdk\"}`. From a terminal: `anchor compare guilds-run vercel-ai-sdk`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/guilds-run.json and https://www.anchorterminal.com/api/v1/tools/vercel-ai-sdk.json\n\n## Other comparisons with guilds.run or AI SDK\n\n- [AgentOS vs guilds.run](https://www.anchorterminal.com/compare/agentos-vs-guilds-run.md)\n- [AgentOS vs AI SDK](https://www.anchorterminal.com/compare/agentos-vs-vercel-ai-sdk.md)\n- [Agno vs guilds.run](https://www.anchorterminal.com/compare/agno-vs-guilds-run.md)\n- [Agno vs AI SDK](https://www.anchorterminal.com/compare/agno-vs-vercel-ai-sdk.md)\n- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)\n- [BoxLang AI vs AI SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.md)\n- [Claude Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run.md)\n- [Claude Agent SDK vs AI SDK](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-vercel-ai-sdk.md)\n- [CrewAI vs guilds.run](https://www.anchorterminal.com/compare/crewai-vs-guilds-run.md)\n- [CrewAI vs AI SDK](https://www.anchorterminal.com/compare/crewai-vs-vercel-ai-sdk.md)\n- [Cursor Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.md)\n- [Cursor Agent SDK vs AI SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk.md)\n- [Docker Agent vs guilds.run](https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run.md)\n- [Docker Agent vs AI SDK](https://www.anchorterminal.com/compare/docker-agent-vs-vercel-ai-sdk.md)\n- [Agent Development Kit (ADK) vs guilds.run](https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.md)\n- [Agent Development Kit (ADK) vs AI SDK](https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk.md)\n- [guilds.run vs LangGraph](https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.md)\n- [guilds.run vs LlamaIndex Framework](https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [guilds.run vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework.md)\n- [guilds.run vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.md)\n- [guilds.run vs Pydantic AI](https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.md)\n- [guilds.run vs smolagents](https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.md)\n- [guilds.run vs Strands Agents](https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.md)\n- [guilds.run vs TradingAgents](https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.md)\n- [LangGraph vs AI SDK](https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk.md)\n- [LlamaIndex Framework vs AI SDK](https://www.anchorterminal.com/compare/llamaindex-vs-vercel-ai-sdk.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n- [Microsoft Agent Framework vs AI SDK](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-vercel-ai-sdk.md)\n- [OpenAI Agents SDK vs AI SDK](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk.md)\n- [Pydantic AI vs AI SDK](https://www.anchorterminal.com/compare/pydantic-ai-vs-vercel-ai-sdk.md)\n- [smolagents vs AI SDK](https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk.md)\n- [Strands Agents vs AI SDK](https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.md)\n- [TradingAgents vs AI SDK](https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "guilds.run vs AI SDK", "url": "" } ], "description": "AI SDK scores 89.8 (AA) to guilds.run's 53.4 (D) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "guilds.run D 53.4", "AI SDK AA 89.8", "scores" ], "h1": "guilds.run vs AI SDK", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/guilds-run-vs-vercel-ai-sdk", "published": "2026-10-01", "section": "tools", "title": "guilds.run vs AI SDK for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk" }, "tokens": { "markdown": 5150, "slim": 3130 }, "version": 1 }