Helicone AI Gateway + MCP vs LangSmith API + MCP

Helicone AI Gateway + MCP

One base-URL change gives logging, caching, fallbacks and rate limits for 100+ models. Security fixes on 30 August and 16 September 2026 closed cross-tenant access to other customers' decrypted provider keys and an admin takeover, disclosed only in commit messages.

LangSmith API + MCP

Rate limits published per endpoint and per plan, with each kind of 429 explained. Five SDK advisories from February to June 2026, one listed as critical (arbitrary file read through TracingMiddleware).

Helicone AI Gateway + MCP

1. Bring your own provider keys. Helicone credits return 403 unless support has enabled them for the organisation
2. Rotate any provider keys stored in Helicone before 30 August 2026
3. Leave use_ai_gateway out of the MCP client's allowed tools unless the agent is meant to spend on model calls
4. Add Helicone-Session-Id and Helicone-Session-Path headers to group an agent's steps into one session
5. Use the EU host (eu.helicone.ai) if the account was created there

LangSmith API + MCP

1. Batch run reads. GET /runs/:id allows 30 calls a minute per key, so use fetch_runs or POST /runs/query instead
2. Pass trace_id or min_start_time to fetch_runs and keep limit low. Results page by a 25,000-character budget
3. Don't call create_dataset or run_experiment over MCP to make changes. They return how-to text, not results
4. Send X-Api-Key and point at the regional host (eu., apac. or aws.api.smith.langchain.com) that matches the workspace
5. Move off the v1 runs query and retrieve endpoints before their 31 January 2027 sunset