HoneyHive vs Overmind

HoneyHive 44

Better Stack page at status.honeyhive.ai with a single component, Backend Platform, and nothing separate for the data plane, control plane or ingestion (12 of 20). The page showed 80.992 per cent uptime for that component and the banner "Some services are down" when we loaded it at 00:59 UTC on 2 October, with no incident write-ups for the last 90 days. The only write-up we found was a SOC 2 incident-response drill from March 2025. We can't tell whether the monitor watches a retired host, but the vendor's own page shows the figure, so 0. The pricing page publishes 1,000 requests a minute on Free and custom limits on Enterprise, and the changelog gives a 7 MiB ingestion body limit (12). The OpenAPI specs declare no 429 and we found no Retry-After or backoff guidance. The Python SDK has a configurable retry budget (5). Enterprise includes an uptime SLA with service credits, terms not published (5). API, SDKs and CLI are GA (10).

Overmind 23

No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, JEV_REQUESTS_PER_MINUTE and JEV_TOKENS_PER_SECOND, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable request_key, identical retries return the existing receipt, changed payloads conflict, and run_evaluation is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.

HoneyHive 63

No MCP server for platform data. The docs MCP only searches documentation. Event search defaults to 1,000 rows with no field projection, so an agent has to set limit itself (10). Filters, date ranges, limit and page on search (18). Since 24 September a bad key, a revoked key and a missing permission all return the same 404 as a missing resource, which leaves an agent guessing (10). POST /session/start is idempotent on session_id. We found no other idempotency keys (10). Python SDK, TypeScript SDKs and a CLI generated one to one from the specs with agent skills. Few required parameters (15).

Overmind 76

About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, preview_rows bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and evidence_resource links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable request_key on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass project_id on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.

HoneyHive 20

No x402 or other machine payment (0). The only paid plan is Enterprise at a custom price, so there's no public per-unit or plan price (0). The free Developer plan needs no card (20). A person signs up in a browser to get a key (0).

Overmind 30

No x402 or other machine payment. Paid work spends prepaid credits, and 402 is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and create_api_key needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.

HoneyHive 61

Four key types. Project keys (hh_), read-only project keys (hh_ro_) since 11 June, fine-grained control plane keys (hh_fgcp_) with chosen permissions and a required expiry of at most 365 days, and ingestion-only keys (hh_ingst_) bound to one project since 17 September. Revocation takes effect within two minutes (30). Read-only and ingestion-only keys give least privilege, and deleting a workspace with active children fails with 409 unless --dangerously-delete-child-scopes is passed (18). Traces hold whatever the application logged, and we found no prompt-injection guidance for agents reading them (3). No audit log found (0). The pricing page claims SOC 2 Type II, GDPR and HIPAA. The Drata trust centre at trust.honeyhive.ai rendered nothing readable to us, there's no security.txt, and the CLI changelog lists "Security fixes" in 1.6.0 without detail (10).

Overmind 70

API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes overmind:read and overmind:write, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and overmind://activity returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.

HoneyHive 86

Two public OpenAPI 3.1 specs in an MIT repository, data plane with 45 paths and 70 operations and control plane with 8 paths and 15 operations (25). llms.txt with every page as Markdown (10). Every operation has a description, deprecated operations are flagged (22 of them) and POST /v1/events/search is labelled the primary way to read events (16). Typed request bodies with bounds such as limit 1 to 1,000 and additionalProperties: false, though event inputs, outputs and metadata are free-form objects (11). Only 9 operations carry examples, no 429 is declared, and since 24 September permission and key failures all return 404 (9). Spec changelog generated with oasdiff, plus dated product, client and self-hosting changelogs (15).

Overmind 81

The docs say each deployment serves its OpenAPI schema at /api/schema/, and the repository holds a generated client of 451 files under frontend/src/openapi. api.overmindlab.ai's robots.txt allows only /.well-known/, so the schema itself wasn't read. Every MCP tool takes a Pydantic input model with extra="forbid", compiled to JSON Schema in overbae/services/mcp/catalog.py, read in the source at main on 31 October 2026 (25). llms.txt with 42 pages, llms-full.txt and Markdown for every page on Mintlify (10). Tool descriptions say what each does and what it doesn't ("Does not activate application routing", "no execution", "Passive: never starts provider work"), and the MCP reference warns that an inspection-style name doesn't mean zero cost. Some workbench descriptions are clipped to the point of being hard to parse (16). Typed inputs with Literal enums, length and range bounds, UUID formats and required fields (13). The docs have worked examples for the CLI, SDK, OTLP and inference, and document status classes (401, 402, 403, 404, 409) and structured MCP errors with code, message, retryability and field details, without a full error-code list (10). The MCP server exposes a contract version and a catalogue fingerprint at overmind://interface/current. The SDK changelog has one undated Unreleased section and no product changelog was found (7). 25+10+16+13+10+7 = 81.