# Letta vs Vibe-Trading (slim)

> Letta scores 59.7 (C) to Vibe-Trading's 57.8 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/letta-vs-vibe-trading.md (~5,650 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/compare/letta-vs-vibe-trading.json · canonical https://www.anchorterminal.com/compare/letta-vs-vibe-trading
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Letta scores 59.7 (C) on agent readiness against Vibe-Trading's 57.8 (C), and leads in 2 of 7 scored categories. Vibe-Trading leads on reliability and security & auth. Both do agent harnesses.

- Letta: C 59.7, rank #687 of 1510 · https://www.anchorterminal.com/tools/letta.min.md
- Vibe-Trading: C 57.8, rank #781 of 1510 · https://www.anchorterminal.com/tools/vibe-trading.min.md
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Also No incidents deducted, where Vibe-Trading loses 9 points for them.
- Vibe-Trading, good for A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent. Ahead on Reliability, 63 against 58; Security & auth, 70 against 35. Also No key needed to call it; Free to start without a card.

| Category | Letta | Vibe-Trading |
| --- | --- | --- |
| Reliability (16%) | 58 | 63 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 70 | 72 |
| Agent ergonomics (13%) | 67 | 67 |
| Security & auth (14%) | 35 | 70 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 82 |
| Transparency & trust (7%) | 55 | 53 |

| Fact (where they differ) | Letta | Vibe-Trading |
| --- | --- | --- |
| Vendor | Letta | HKUDS |
| Transports | stdio | stdio, Streamable HTTP, SSE (legacy) |
| Auth | OAuth or key | None |
| Pricing | Freemium | Free |
| Licence | Apache-2.0 | MIT |
| Tools exposed | none | 82 |
| llms.txt | yes | no |
| Last release | 2026-11-06 | 2026-10-21 |
| Terms last updated | no date given | no document linked |
| Privacy policy last updated | no date given | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk | 37k stars |

Why the edge:
- Security & auth, Vibe-Trading +35: Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.); Vibe-Trading 70 (Harness reading used for nanobot and goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.1.18, and the only call to PyPI is the owner-run `vibe-trading update`. The API answers only loopback clients without `API_AUTH_KEY`, Docker binds 127.0.0.1 and runs as user `vibe`, and the MCP HTTP transport binds 127.0.0.1 with a Host and Origin allow-list against DNS rebinding but no token. Broker keys go to the OS keyring; model keys sit in `agent/.env` in clear text. The docs carry no statement that nothing is collected (24). Live orders need a mandate that only the owner commits through the web UI or API, with hard caps and a kill switch, and an optional TAP mode waits for human approval of each Alpaca write. No order tool is exposed over MCP, and shell tools are off on the API and every MCP transport unless enabled. The local CLI runs `bash` and file writes without asking, and generated backtest code runs as a network-capable subprocess with a narrowed environment and no sandbox (13). Reader and search tools add warning-only `security_warnings` from regex rules, and external MCP tool hints are treated as untrusted in the source. The `claude-cli` provider's tool filters are described as convenience filters, not a boundary (9). A live-action ledger written append-only with a hash-chained copy, run cards with hashed execution records, tool traces and per-run token usage (13). SECURITY.md with private advisory reporting and a five-business-day acknowledgement. Three advisories were published on 2 October 2026 with CVE identifiers, five months after the 0.1.7 fix, while the email TLS and cross-site settings fixes in 0.1.16 got none. No security.txt and no bounty (11). 24+13+9+13+11 = 70.)
- Reliability, Vibe-Trading +5: Letta 58 (Local-software lines, read for the harness. `@letta-ai/letta-code` on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.); Vibe-Trading 63 (Read with the local-software lines, as for nanobot and Agent Zero, since the owner runs it. `vibe-trading-ai` installs from PyPI for Python 3.11 or newer, with classifiers for 3.11 to 3.13, and a Docker Compose setup ships in the repository (20). A CI workflow runs the test suite on pushes and pull requests to main, with hash-locked dependency checks on Linux, macOS and Windows, and the repository holds 961 test files. Whether the latest runs on main passed couldn't be read, because GitHub's Actions pages weren't reachable (15 of 25). The repository page showed 7 open issues and 57 open pull requests on 25 October 2026, per that check (GitHub's pages answer 403 on 2 November), against 771 commits in the 30 days to 2 November, and the 0.1.18 notes list two known issues already fixed on main. Issue threads weren't read (18 of 25). CHANGELOG.md says it follows Semantic Versioning, with dated entries from 0.1.8, a Known issues section and an upgrade note for the LangChain 1.x move in 0.1.10, but on 0.x breaking changes ride in minor versions and there is no Breaking section (10 of 15). Version 0.1.18 with the classifier Development Status 4, Beta (0).)