Laminar API + MCP vs LangSmith API + MCP

Laminar API + MCP

Browser session recordings can be matched to agent traces. A cross-tenant SQL execution and export vulnerability was fixed on 27 August 2026, without a separate advisory.

LangSmith API + MCP

Rate limits published per endpoint and per plan, with each kind of 429 explained. Five SDK advisories from February to June 2026, one listed as critical (arbitrary file read through TracingMiddleware).

Laminar API + MCP

1. Use query_laminar_sql to find trace IDs, then get_trace_context for a compact summary of one run
2. Always add a time range and LIMIT to SQL. Server caps on time, memory and result size reject wide scans
3. On 429 from the SQL API, back off. The per-project limit isn't published
4. Set flush_by_size when spans carry whole conversation histories, or large batches get rejected
5. Keep the project API key in a header, not in the URL

LangSmith API + MCP

1. Batch run reads. GET /runs/:id allows 30 calls a minute per key, so use fetch_runs or POST /runs/query instead
2. Pass trace_id or min_start_time to fetch_runs and keep limit low. Results page by a 25,000-character budget
3. Don't call create_dataset or run_experiment over MCP to make changes. They return how-to text, not results
4. Send X-Api-Key and point at the regional host (eu., apac. or aws.api.smith.langchain.com) that matches the workspace
5. Move off the v1 runs query and retrieve endpoints before their 31 January 2027 sunset