LlamaIndex Framework vs TradingAgents

LlamaIndex Framework 85

Framework reading. A typed Python API with a generated reference (22). llms.txt indexing the framework docs, plus a docs search API and an MCP server for the docs (10). The agents guide says what each agent class is for, and the MCP page lists the three ways to use MCP (15). Tools are typed from function signatures and Pydantic models (13). Many examples and notebooks, few documented error types (10). Dated changelog (15). 22+10+15+13+10+15 = 85.

TradingAgents 61

Framework reading. No API reference or docs site. Typed interfaces exist in the source, Pydantic models for the research manager's, trader's and portfolio manager's outputs and Annotated signatures on the twelve data tools, with no py.typed marker (10 of 25). The README and changelog are Markdown in the repository; no llms.txt (4 of 10). The README states limits plainly, that runs vary, which statements past-dated runs withhold and why, and that it is a research tool, not advice (15 of 20). Configuration is a plain dict of string keys, though environment overrides are coerced to the default's type and fail loudly on a bad value (8 of 15). Runnable Python and CLI examples throughout the README; the vendor error hierarchy is documented only in source docstrings (9 of 15). Dated changelog for every release from 0.1.0 with upgrade notes (15).

LlamaIndex Framework 70

Local-package reading. Official PyPI packages with Python 3.10 to below 4.0 (20). Public unit-test, type-check, lint, coverage and CodeQL workflows, with the type-check, lint and CodeQL runs on main passing on 3 November (25). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). A dated, generated changelog per package, but core is 0.x and minors such as 0.13 and 0.14 carried breaking changes (8). Core isn't 1.0; Workflows is at 2.x, so partial (5). 20+25+12+8+5 = 70.

TradingAgents 52

Read with the local-software lines, because the owner runs it. Python 3.11 or later is stated and CI tests 3.11 to 3.14, but the project publishes no PyPI package. No workflow uploads one, and the README installs from a clone or Docker Compose. From 0.7.0 a release workflow builds a wheel and source archive from each tag and attaches them to the GitHub release (12 of 20). Public CI on every push and pull request runs the test suite (about 1,009 test functions at v0.7.1) on four Python versions and once in America/New_York, a clean-install import check and Ruff. The 25 October check read the pass state from shields.io, a third-party copy of GitHub data this run doesn't use, so that reading is struck, and the pass state on main is unread (15, as berth and agentvfs). Issue counts came from the same source and are struck too. On the clone, 0.7.1 (27 October) fixes 22 numbered issues, 17 of them above #1518, the newest fixed in 0.7.0 on 16 October, and credits 15 outside contributors; open crash or regression issues and reply times are unread (15, as berth on the same pattern). The changelog follows Keep a Changelog and Semantic Versioning and lists breaking changes under "Upgrading from", but 0.5.1, a patch release, moved import paths and removed classes (10 of 15). Version 0.7.1 with no stability statement (0). 12+15+15+10+0 = 52.

LlamaIndex Framework 73

Framework reading. MCP tools through a separate llama-index-tools-mcp package, with allowed tools selectable (18). Memory token limits, iteration caps and streaming events (16). Tool errors returned to the agent, with few typed errors (12). Workflow context serialises and resumes, and the DBOS package makes runs durable (16). Few required parameters, but OpenAI is the silent default for LLM and embeddings, Python here with a separate TypeScript edition (11). 18+16+12+16+11 = 73.

TradingAgents 61

Framework reading, scored on what an outside agent needs to call it. No MCP client or server, so it can't be attached as tools; a run is four lines of Python (TradingAgentsGraph(config=...).propagate(ticker, date)) or one headless CLI command with flags (10 of 25). Analyst selection, debate and risk rounds (default 1), max_tool_rounds (20), max_recur_limit (100), article limits and --no-html size a run (14 of 20). A typed vendor error hierarchy separates unavailable from absent data, the headless CLI names the missing flag before a run starts, and an unparseable decision returns REVIEW rather than Hold (15 of 20). Checkpoint resume is opt-in, a backtest rerun with the same run_id skips finished cells, and settlement writes each decision once; nothing writes to an outside system (15 of 20). Sensible defaults, but the default provider is OpenAI's GPT-6 models with a key, and Python only (7 of 15).

LlamaIndex Framework 74

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in llama-index-core (25). Human-in-the-loop events in Workflows and agents can wait for a person, but there's no per-tool approval primitive and CodeActAgent's executor is the developer's to supply (12). The threat model puts input validation on the application, with no prompt-injection guidance in the agent pages (5). Instrumentation events and callback handlers for tracing (14). A huntr bug bounty, GitHub private reporting and public advisories with fixed versions (18). 25+12+5+14+18 = 74.

TradingAgents 62

Framework reading. 30 for what leaves the machine and how credentials are held, 20 for least privilege and approvals, 15 for prompt injection, 15 for audit and 20 for the security programme. Keys are read from the environment, and the package loads the nearest .env on import by walking up from the working directory. The ChatGPT sign-in uses PKCE and dynamic client registration, keeps tokens in a 0600 file and revokes them on logout. The only calls of its own are the interactive CLI's daily release and notice check, with no run data, off without a terminal or with TRADINGAGENTS_NO_UPDATE_CHECK=1. SEC EDGAR gets a placeholder contact address unless one is set (24 of 30). It places no orders and holds no broker credentials, the data tools only read, and every ticker is validated before it is used in a file path. No approval hooks, which nothing in it needs (14 of 20). News, Reddit and StockTwits text goes into prompts. The source names prompt injection as the reason for path validation, but no guidance on injection was found in the README (5 of 15). Saved reports record the run's settings and each agent's report, the memory log keeps every decision, and debug=True streams the graph (11 of 15). Security reports go to GitHub private vulnerability reporting per the issue template, and the changelog has Security sections for a langchain-core patch and a dependency removed over CVE-2026-22218. No SECURITY.md, no security.txt on tauric.ai (404 on 2 November), no bounty, and the repository's advisories page wasn't read (8 of 20). 24+14+5+11+8 = 62.

LlamaIndex Framework 69

llama-index-core 0.14.25 on 21 September 2026, 46 days before this check (20). Two core changelog entries in the 90 days (19 August and 21 September), with integration packages and Workflows (2.24.1 to 2.26.1) publishing in between, so partial (12). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). Core, Workflows and integrations are current (15). CI and CodeQL passing on main and a stale-package policy that moves unmaintained integrations out of main (10). 20+12+12+15+10 = 69.

TradingAgents 78

0.7.1 on 27 October 2026 (30). Seven releases in the 90 days to 2 November, 0.4.0 (31 August), 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0 and 0.7.1 (20). The earlier issue and pull request counts came from shields.io and are struck. On the clone, fixes cite issue numbers and each release credits the people who reported or fixed them (15 outside contributors in 0.7.1), but 251 of the 258 commits since 4 August are by one maintainer's accounts and reply times couldn't be read (13 of 25, as pipecat on clone evidence). No PyPI package; versions ship as GitHub releases with a wheel since 0.7.0 (8 of 15). CI with tests, lint and a clean-install check; dependencies set lower bounds only and no Dependabot configuration is in the repository (7 of 10). 30+20+13+8+7 = 78.