Laminar API + MCP vs Navige

Laminar API + MCP

Browser session recordings can be matched to agent traces. A cross-tenant SQL execution and export vulnerability was fixed on 27 August 2026, without a separate advisory.

Navige

Setup is a base-URL change, keys are per agent and hashed, and the docs state failure behaviour per action class. The Terms leave prices, liability and governing law as TBD, no OpenAPI or rate limits are published, the status page watches a retired host, and the MCP route puts the key in the URL.

Laminar API + MCP

1. Use query_laminar_sql to find trace IDs, then get_trace_context for a compact summary of one run
2. Always add a time range and LIMIT to SQL. Server caps on time, memory and result size reject wide scans
3. On 429 from the SQL API, back off. The per-project limit isn't published
4. Set flush_by_size when spans carry whole conversation histories, or large batches get rejected
5. Keep the project API key in a header, not in the URL

Navige

1. Send the Navige key in x-navige-key on the proxy. Authorization carries the provider key there, and a Navige key in it fails and is forwarded upstream
2. Act only on allow or approved from /enforce. Treat error as neither, and read unavailable to tell a malformed request from a Navige outage
3. Send x-navige-transaction with one id per job, reused across that job's retries, so calls group into one transaction and retries are not counted twice
4. On a 429 from the proxy, check for a blocking budget before retrying. Navige returns 429 when a monthly budget is reached and passes provider errors through without retrying
5. Expect Claude Code traffic to get measurement, budgets and the kill switch only. Context trimming, routing, the output ceiling and prompt caching are switched off for it