Hugging Face Inference Providers vs SWE-2 Flash

Hugging Face Inference Providers 58

Router reading of the model checklist (tool use, structured output, caching, context, batch, SDKs, errors), as for openrouter. Tool calling through the OpenAI-compatible API with tool_choice, support flagged per provider in /v1/models (15 of 20). Structured output documented, support flagged per provider and false on some (10 of 15). No prompt caching guidance found, though the Enterprise usage API counts cached input tokens (3 of 15). Routes to models with up to 1,048,576 tokens of context per the model list, a judgement call since a router has no default model (15). No batch API (0 of 10). Official clients in Python and JavaScript, plus any OpenAI SDK (10). Errors not documented (5 of 15).

SWE-2 Flash 10

Model reading (tool use, structured output, caching, context, batch, SDKs). Tool use is Devin's harness, not something a caller configures; no context length, output limit or cache price is published for SWE-2 Flash (5 of 25). No documented output-size or reasoning controls for this model; SWE-2's effort levels aren't stated for Flash (0 of 20). No model-level error documentation (0 of 20). No idempotency or retry guidance (0 of 20). One flag or picker selects it and devin -p runs a single turn and prints to stdout, but there is no SDK or direct endpoint (5 of 15). 5 + 0 + 0 + 0 + 5 = 10.

Hugging Face Inference Providers 62

No OpenAPI document for the router (openapi.json paths answer 404). The task reference pages are generated from typed JSON Schema specs in huggingface.js, and the router's /v1/models gives a machine-readable catalogue, so 12 of 25. llms.txt for the Inference Providers docs and a Markdown twin of every page via .md (10). Guides say what each task and policy is for, with a quick setup page for coding agents (14 of 20). Parameter tables with types for chat completion, though response_format and tool_choice show as unknown types (9 of 15). Examples in Python, JavaScript and curl on every task page, but no documented error responses for the router (9 of 15). No changelog of its own; the Hub changelog doesn't cover it and dated changes are only in the hub-docs history (8 of 15).

SWE-2 Flash 29

Model reading. No model API, so no OpenAPI entry; the Devin v3 OpenAPI file lists SWE-2 agents only, and no model card was found (0). docs.devin.ai serves llms.txt and Markdown copies of every page (10). The launch post says what it is for (automations, code review, feature development, documentation) and the CLI docs say when to pick a SWE model, but the models pages don't list SWE-2 Flash yet (6 of 20). No documented model ID, reasoning settings, context or output limits to type (0 of 15). The CLI pages show --model and /model examples, with no model-specific errors (3 of 15). Named, dated model versions on Cognition's blog and public release notes, but no release note for SWE-2 Flash yet; the newest is 2 November (10 of 15). 0 + 10 + 6 + 0 + 3 + 10 = 29.

Hugging Face Inference Providers 80

Model reading. huggingface_hub 2.4.0 tagged on 29 October 2026 and the Inference Providers docs updated daily by an automated job, last on 6 November (30). huggingface_hub 2.2.0, 2.3.0 and 2.4.0 and @huggingface/inference 4.13.28 to 4.13.32 in the 90 days (20). No dedicated changelog; the Hub has a forum and Discord, and GitHub issue replies were not read (8 of 15). Current official SDKs in Python and JavaScript (15). The Python client supports Python 3.10 and later, per the Inference Endpoints check; CI not read (7 of 10).

SWE-2 Flash 53

Model reading. Released 4 November 2026 (30). Churn and notice in place of release counts: SWE-1.6, SWE-1.7, SWE-1.7 Lightning, SWE-2 (10 September) and now SWE-2 Flash in a few months, with no model deprecation notice period found and short names that move to the newest model (10 of 20). Public release notes and a support address, no public tracker (10 of 25). No official SDK for the model (0 of 15). The docs are kept current but don't yet cover this model (3 of 10). 30 + 10 + 10 + 0 + 3 = 53.

Hugging Face Inference Providers 79

Model reading. Fine-grained user access tokens that can be limited to the Make calls to Inference Providers permission, rotated and revoked, plus a public revocation endpoint for leaked tokens, and organisation approval of fine-grained tokens on paid plans (30). Hugging Face says it doesn't store user data for training, but data handling past the router follows each provider's policy, with no per-request filter to exclude providers that train or retain (12 of 20). Request bodies and responses aren't stored when routed and debug logs are kept up to 30 days without user data or tokens, with provider retention outside that statement (10 of 15). Usage by model and provider in account settings, an Enterprise usage API, and Team and Enterprise admins can disable providers and set a spending limit (13 of 15). SOC 2 Type 2 for the Hub, of which the docs say Inference Providers is a feature, and security.txt valid to 2030 per the Inference Endpoints check; no bug bounty found (14 of 20).

SWE-2 Flash 53

Read as a hosted model reached through Devin's local clients. The CLI signs in through a browser, or the enterprise identity provider, and stores an API token in credentials.toml that by default is persistent and does not expire and carries the user's access, with no scopes found for it (10 of 30). Devin CLI documents an OS-level sandbox with network filtering, hooks that can block tool calls, and enterprise model allowlists and team settings (14 of 20). Guardrails against prompt injection are Enterprise only and cover user messages, as on the devin listing (8 of 15). Enterprise analytics count tool calls and consumption by model and user; no per-user audit log for the CLI was found (8 of 15). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address, no bug bounty and no security.txt, per the devin listing (13 of 20). Training: self-serve customer data may train Cognition's models by default, with an opt-out on paid plans that also turns on zero data retention at model providers. Cognition withheld the weights over cyber misuse, which is recorded as a fact, not scored. 10 + 14 + 8 + 8 + 13 = 53.

Hugging Face Inference Providers 25

Hosted lines. status.huggingface.co is a Better Stack page with 90-day component history for the Hub, Inference Endpoints, Spaces, the CDNs and Jobs, but no component for Inference Providers or the router (10 of 20). With no component, there is no readable incident history for the surface agents call, and the feed's 23 items from 10 June to 7 October 2026 don't name it (5). No rate limits for the router were found; the Hub rate-limits page gives numbers for Hub APIs, resolvers and pages only (0). No 429 or overload guidance for the router was found (0). No SLA found (0). Chat completions on the router is generally available; the Responses API is labelled beta (10). Routing between providers with :fastest or :cheapest softens a single provider's outage, which this checklist doesn't score.

SWE-2 Flash 50

Model reading, for the surface it runs on, Devin Desktop and Devin CLI. Status page at www.devinstatus.com (Atlassian Statuspage) with Desktop Agent and Desktop Tab components besides the cloud ones, read on 4 November 2026 (20). The history feed for the 90 days from 6 August lists 'Devin unavailable' for 20 minutes on 13 August with no component named, read as across the board and a major as on the devin listing; Devin Cloud unavailable on 13 August and the web app down on 24 September name cloud surfaces this model doesn't use; the rest are degraded-performance incidents (new sessions on 3 September, 'multiple services' on 17 September, Ask Devin on 26 October, automation triggers on 4 November) and session queuing on 10 and 11 August, read as minor and a scheduled Devin Desktop extension marketplace upgrade on 7 August, read as maintenance. One major (10). No rate limit figures for the model or the CLI; usage is a daily and weekly quota with no numbers (0). No 429, backoff or retry guidance for this surface (0). Cognition publishes an SLA (25 February 2026) with uptime and response times that applies when included in an order form, read as a contractual SLA on Enterprise, as on other listings (10). The launch post makes it available today with no preview or beta label (10). 20 + 10 + 0 + 0 + 10 + 10 = 50.

Hugging Face Inference Providers 71

Closed service under Terms of Service that name Inference Providers, with an Apache-2.0 Python client and an MIT JavaScript client (20). The security page and the docs agree on no training, no stored bodies and 30-day logs, but the privacy policy dates from 28 March 2023 and each provider's own data policy governs the rest (18 of 30). No deprecation policy found. Provider support changes and the 7 October removal of free credits are dated only in the docs repository history (5 of 20). The privacy policy lists 11 subprocessors with countries per the Inference Endpoints check, and the docs name every provider a request can reach, though not where each runs (15 of 20).

SWE-2 Flash 64

Editorial half. Closed model under Cognition's platform terms; the weights aren't public and the sharing programme isn't described yet (15). Terms, privacy policy, security page and DPA agree, with training on self-serve data by default and no retention periods, as read for the devin listing (18). The API versioning policy covers API endpoints, not models, and no model deprecation notice was found (5 of 20). Sub-processors listed with purpose and country, per the devin listing's 8 October check (18). 15 + 18 + 5 + 18 = 56.