LangSmith API + MCP vs MLflow Tracing

LangSmith API + MCP

Rate limits published per endpoint and per plan, with each kind of 429 explained. Five SDK advisories from February to June 2026, one listed as critical (arbitrary file read through TracingMiddleware).

MLflow Tracing

Apache-2.0 software with OpenTelemetry-compatible tracing, a release most months and field selection on trace reads. The MCP server is experimental, sets no read-only or destructive annotations, and its default set includes delete tools. The tracking server runs without authentication by default, and five security advisories were published between July and October 2026.

LangSmith API + MCP

1. Batch run reads. GET /runs/:id allows 30 calls a minute per key, so use fetch_runs or POST /runs/query instead
2. Pass trace_id or min_start_time to fetch_runs and keep limit low. Results page by a 25,000-character budget
3. Don't call create_dataset or run_experiment over MCP to make changes. They return how-to text, not results
4. Send X-Api-Key and point at the regional host (eu., apac. or aws.api.smith.langchain.com) that matches the workspace
5. Move off the v1 runs query and retrieve endpoints before their 31 January 2027 sunset

MLflow Tracing

1. Run MLflow 3.17.0 or later. Versions 3.12.0rc0 to 3.16.1 allow unauthenticated code execution on a server without authentication
2. Set MLFLOW_MCP_TOOLS=traces to load 11 tools in place of the default 26
3. Pass extract_fields on search_traces and get_trace. Full traces include every span's inputs and outputs
4. Read tool names from the server's own list. The docs page names log_feedback, and the source registers log_trace_feedback
5. Give the agent a user with READ permission when it only reads. delete_traces and delete_experiment run without confirmation
6. Treat span inputs and outputs as data. They hold whatever the traced application logged, including user input