LangSmith API + MCP vs Overmind

LangSmith API + MCP 81

incident.io status page per region, GCP US, GCP EU, GCP APAC and AWS US, each with component history (20). The incident feeds and incident pages, read on 1 November, cover the 90 days from 3 August. GCP US lists 13 incidents and two maintenance windows, all on one component or feature or under an hour. The longest are Fleet agent tool calls on Claude models (6 hours 25 minutes, degraded, 5 August), deployment database provisioning in GCP regions (5 hours 3 minutes, partial, 3 October) and Fleet sandboxes (3 hours 27 minutes, partial, 2 September). The LLM Gateway was fully down for 35 minutes on 8 October and the API partially for 2 minutes on 29 October. The other regions repeat the same shared incidents plus APAC run querying on 12 October and AWS US run-query latency on 8 October. Minor only (20). Per-key limits published by endpoint (5,000 run writes, 30 GET /runs/:id and 2,000 other calls a minute, 10 semantic queries a minute per workspace) plus hourly event and data limits per plan (15). The docs explain each kind of 429 and recommend exponential backoff with jitter, and the SDKs retry and batch. Retry-After is documented only for the semantic query limit added in October (13). Enterprise has a support SLA. We found no uptime SLA (3). API and remote MCP are GA (10). 20+20+15+13+3+10 = 81.

Overmind 23

No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, JEV_REQUESTS_PER_MINUTE and JEV_TOKENS_PER_SECOND, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable request_key, identical retries return the existing receipt, changed payloads conflict, and run_evaluation is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.

LangSmith API + MCP 78

Closed platform. The SDKs and the open-source MCP server are MIT (18). Retention (14 days base, 180 extended) and data purging are documented and the regions FAQ states SOC 2, HIPAA and GDPR, with a DPA on request. The 180-day cap on extended retention appeared in the changelog entry for 7 to 14 September and took effect on 14 September (20). Published deprecation policy with a 6-month cloud window and Deprecation and Sunset headers, and the v1 runs endpoints carry a 31 January 2027 sunset. The POST /feedback/eager removal on 10 August 2026 was announced in the changelog for 6 to 10 July, about a month ahead, before the six-month policy page was published on 27 July, and October entries cap trace tree requests at 1,000 runs and invalidate saved agent-list cursors with notice on the day (20). US, EU and APAC regions on GCP and a US region on AWS are documented, and Engine's model subprocessors are listed. We couldn't read a full subprocessor list (12). 18+20+20+12 = 70.

Overmind 65

Platform under AGPL-3.0 and SDK and CLI under MIT, both OSI licences, with a paid commercial licence as an option and a licensing page that says which code is which (30). The privacy policy of 3 October 2026 gives retention (subscription plus 30 days, deletion within 90 days, logs 365 days, backups 7 days), AWS eu-west-1 hosting and OAuth token lifetimes. The terms of 1 March 2026 still describe an earlier security product, say data stays in UK and EU data centres while the privacy policy names model, training and inference providers without locations, and incorporate a DPA that isn't published. The two documents agree on retention but not on the product (15). The terms promise 90 days' written notice before withdrawing a capability and 30 days' notice of material changes. No dated deprecation notices were found (8). SDK analytics are an opt-in extra with three documented off switches. The hosted MCP server reports to PostHog with payloads dropped, which the docs don't mention, and no named sub-processor list was found beyond AWS, though the docs name Modal, OpenRouter, Clerk and Stripe (12). 30+15+8+12 = 65.

LangSmith API + MCP 40

No x402 or other machine payment (0). Per-trace pricing is public, a base trace at 0.005 LSU and the extended-retention upgrade at 0.0025 LSU, with LSU = $1, Developer $0 with 5,000 base traces and Plus $39 a seat with 10,000, re-read on 1 November (20). Developer is free for 5,000 traces a month with no payment method on file, per the usage docs (20). A person signs up in a browser to create a key (0). 0+20+20+0 = 40.

Overmind 30

No x402 or other machine payment. Paid work spends prepaid credits, and 402 is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and create_api_key needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.

LangSmith API + MCP 79

Personal access tokens inherit the user's permissions. Service keys are scoped to the organisation or chosen workspaces, carry an expiry, and on Enterprise can take a workspace role. Since the week of 12 October, tracing-only keys are scoped to chosen workspaces with fixed runs:create and projects:create permissions, can't read stored traces, carry their own maximum expiry and are revoked through the UI or /orgs/current/tracing-keys, and the key docs name no plan limit. The remote MCP uses OAuth 2.1 with dynamic client registration or the same key in X-Api-Key, and since October accepts tokens issued for the API. Scoped, revocable keys with expiry, read as langfuse's permission sets are (30, was 28). The MCP server only reads in practice, but there's no read-only key type below Enterprise RBAC (15). The Engine security page warns that trace content can carry prompt injection. The MCP page says nothing about it (6). Audit logs on Enterprise, queryable by API (10). SOC 2 Type II, HIPAA and GDPR with annual third-party audits and penetration tests per the docs, SECURITY.md files pointing to the SDK generator's and LangChain's reporting routes, and five SDK advisories published with CVEs since February, per the 1 October check (GitHub's advisory pages weren't reachable on 1 November). www.langchain.com answers "Invalid .well-known request" for security.txt, so none (18). 30+15+6+10+18 = 79.

Overmind 70

API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes overmind:read and overmind:write, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and overmind://activity returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.

LangSmith API + MCP 85

The SDKs moved on 16 October from langsmith-sdk (now archived) to langsmith-python and langsmith-javascript, with the same PyPI and npm packages. Python 0.14.16 on 29 October and JavaScript 0.11.6 dated 31 October in its changelog (30). 31 Python SDK tags in the 90 days to 1 November, 0.10.16 (5 August) to 0.14.16 across the old and new repositories, and JavaScript releases to 0.11.6 (20). Both new repositories take commits daily and auto-label new issues. We didn't load reply times (12). Python and TypeScript SDKs both current (15). CI, release and benchmark workflows run in public in both repositories. Pass state not checked (8). 30+20+12+15+8 = 85.

Overmind 76

overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.

LangSmith API + MCP 86

Public OpenAPI 3.1 at api.smith.langchain.com/openapi.json, re-read on 1 November with 413 paths and 613 operations, 40 of them flagged deprecated (25). llms.txt and Markdown docs (10). MCP tool docstrings are long and practical. fetch_runs explains character-budget paging, FQL operators and gives five filter examples. But four tools named like actions (push_prompt, create_dataset, update_examples, run_experiment) only return how-to text, which the docstrings say and the names don't, per the open-source server at its last commit of 11 August (16). Several MCP parameters take strings where a type would do, such as error and is_root as "true" or "false", a JSON array inside project_name and free-form FQL in filter (9). Examples throughout the docs and docstrings. Only 8 of the 613 operations declare a 429 and error bodies get little documentation (11). Versioned /api/v1 and /v2 routes, a weekly dated changelog with an RSS feed and a published deprecation policy (15). 25+10+16+9+11+15 = 86.

Overmind 81

The docs say each deployment serves its OpenAPI schema at /api/schema/, and the repository holds a generated client of 451 files under frontend/src/openapi. api.overmindlab.ai's robots.txt allows only /.well-known/, so the schema itself wasn't read. Every MCP tool takes a Pydantic input model with extra="forbid", compiled to JSON Schema in overbae/services/mcp/catalog.py, read in the source at main on 31 October 2026 (25). llms.txt with 42 pages, llms-full.txt and Markdown for every page on Mintlify (10). Tool descriptions say what each does and what it doesn't ("Does not activate application routing", "no execution", "Passive: never starts provider work"), and the MCP reference warns that an inspection-style name doesn't mean zero cost. Some workbench descriptions are clipped to the point of being hard to parse (16). Typed inputs with Literal enums, length and range bounds, UUID formats and required fields (13). The docs have worked examples for the CLI, SDK, OTLP and inference, and document status classes (401, 402, 403, 404, 409) and structured MCP errors with code, message, retryability and field details, without a full error-code list (10). The MCP server exposes a contract version and a catalogue fingerprint at overmind://interface/current. The SDK changelog has one undated Unreleased section and no product changelog was found (7). 25+10+16+13+10+7 = 81.