Merge Agent Handler vs SandBase

Merge Agent Handler 83

Access keys can be limited to named Registered Users and Tool Packs and to the runtime:all scope, with expiry, rotation and revocation, and a child key is never wider than its parent. The simplified URL uses OAuth. Two points off because the master key can't be revoked and agent signup returns an unrestricted key (28). Tool Packs select individual tools, input overrides fix field values and a runtime-only key can't change configuration. No confirmation step for destructive tools was found (15). The Security Gateway redacts or blocks tool arguments, and AI Guardrails can screen responses with content passed as data inside boundary markers. Guardrails fail open and new ones screen requests only (11). Tool Call Logs and an Audit Trail are kept 90 days by default with CSV export and an API. The SIEM log endpoints are Enterprise only (14). SOC 2 Type II, ISO 27001, HIPAA, yearly penetration tests and a disclosure programme at security@merge.dev. security.txt returned 404, no paid bounty terms were found, and the programme bars public disclosure without approval (15).

SandBase 45

Standard keys (sk- and 64 hex characters) act for one organisation with no user-selectable scopes, can carry an expiry and a spending limit, are shown once and are revoked permanently in the console. CLI Login keys from the browser approval (device secret plus PKCE S256) are scoped to mcp:invoke and answer 403 insufficient_scope outside it. No OAuth for the MCP server and no API for managing keys. Above plain revocable keys, below OpenRouter's 25 with OAuth PKCE and a management API (22). The OpenAPI file's generateContent operation 'also accepts x-goog-api-key and the key query parameter for Google SDK compatibility', noting headers are safer, and all four Gemini operations list a GoogleQueryApiKey scheme, read on 8 November 2026. A secret in a URL query string is a documented option, so 10 off (12 of 30). Per-key spending limits and expiry, the organisation's funding boundary and a monthly limit on auto top-up bound spend, and an agent can't lift a key's limit by topping up. No read-only key, per-period budget, per-run cap, allowlist of tools or providers or approval step before a paid run. Monid earned 16 with per-period budgets, a per-run cap and read-only scopes, which SandBase lacks (12 of 20). Runs return scraped pages and social posts from third parties, and neither the skill nor the docs read say to treat them as untrusted. Monid took 3 with none (3 of 15). Request history lists each request's status and cost, sandbase_runs and account history return runs with cost, GET /v1/tasks/{task_id}/cost gives a task's cost, and billing records export as CSV. No key-level audit (created by, last used) was found. Monid earned 13 with key usage records (12 of 15). security.txt answered a client error. SECURITY.md in sandbaseai/sandbase names the SDKs, examples, catalogue and API as in scope for GitHub private vulnerability reporting with acknowledgement within 3 business days, and the CLI repository has its own. No bug bounty or certification found. Paid earned 6 for a reporting address without security.txt (6 of 20). 12+12+3+12+6 = 45.

Merge Agent Handler 72

The editorial half. Closed service under a Master Services Agreement that names Merge API, Inc., a Delaware corporation, with California law (15). The MSA says Merge will not use Customer Data to train, fine-tune or improve any AI, and the privacy policy says it doesn't train generalised models on personal information. Logs are kept 90 days by default, a deleted Registered User's records go with it, and a closed account is purged after 30 days. Retention of stored credentials for the life of an account is left to the agreement and the DPA (22). No deprecation policy or dated sunset notices were found. The agreement can change on 30 days' notice or on continued use (4). The sub-processor list, updated 4 May 2026, gives each processor's location and includes Anthropic, OpenAI and AWS Bedrock. Standard plans are hosted on AWS US-East (17).

SandBase 48

The editorial half. The catalogue service, routing, billing, API, MCP server, Agents runtime and sandboxes are closed; the CLI, bridge, skill, catalogue, examples and SDKs are Apache-2.0. The terms (14 October 2026) name AXIOMCLOUD PTE. LTD. under Singapore law and cover agents, scraping APIs, provider licences and billing, with no registration number or address on any page read. Paid, Nevermined and Monid earned 17 for closed platforms with open SDKs (17 of 30). The privacy policy (30 October 2026) names the company, lists the customer content it handles and says the information an operation needs goes to the selected provider. It states no retention periods ('We do not claim a universal retention duration'), says only that it 'does not grant SandBase an unrestricted right' to use private content, and asserts no transfer mechanism. It agrees with the terms but leaves retention and training open. OpenRouter earned 15 where the policies settled storage, and Monid 5 where they were silent on run data (12 of 30). No deprecation policy or dated notices. The terms promise notice of material changes and say that beta parts of the service 'may change, have quotas or be discontinued', and the pricing page promises notice before sandbox pricing changes (3 of 20). The policy names Cloudflare, Google and GitHub sign-in, Stripe, Airwallex, Google Analytics 4 and PostHog (United States), but not the hosting provider, other data locations or the model and data providers. Monid earned 6 and Nevermined 14 (9 of 20). 17+12+3+9 = 41. The provenance half is computed from the provenance block.

Merge Agent Handler 55

No x402, MPP or L402 (0). Plan prices are public, $1,000 a month for 25,000 credits up to $3,200 for 100,000 (the upper steps per the 8 October check), at one credit per tool call. On 1 November the page says only that overages are billed at the end of the month, with no rate, so 15 of 20 (15). The Free plan gives 2,000 credits a month with no card (20). The docs and the OpenAPI file describe an unauthenticated POST /api/v1/agent/signup/ that returns a key, a tool pack and a registered user. We did not call it, so this rests on the documentation. A paid plan needs a person and a card (20).

SandBase 40

No x402, MPP or L402 on the home page, pricing, billing, llms.txt or the OpenAPI paths; the balance is funded through Stripe or Airwallex checkout (0). Prices per million tokens, per image, per seconds of video or per call on public pages without a login, such as anthropic/claude-sonnet-5.5 at $1.70 in and $8.50 out per million tokens, and inspect returns each price before a run (20). Every organisation gets 100 free calls a day on eligible data APIs, which a zero-balance organisation can still use per the skill, and Start is $0. No card requirement was found on the pricing page or the billing guide, which asks for a saved card only for auto top-up. Nevermined earned 20 for a free plan with no card requirement found (20). A person approves a browser sign-in, through the CLI's flow or the console, before any key exists, and no keyless or programmatic route was found (0). 0+20+20+0 = 40.

Merge Agent Handler 68

The catalogue is large (Slack alone lists 50 tools), which scores 5, plus 10 for Tool Packs with per-tool selection, the connectors URL scope, the search_tools meta-tool and a pin that drops structuredContent (15). tools/list pages by 100 with ?paginated=true, and logs and lists take cursors and filters. Controls on tool output size were not found (16). Errors carry an error_type, data.reauth_reason, a named guardrail on a block and a request id that matches the log row (17). The connectors endpoint returns annotation hints (read only, destructive) per tool. We could not confirm they appear in tools/list, and tool calls take no idempotency key (10). There is no Agent Handler SDK. Clients use the MCP SDKs or the Python CLI, and agent signup returns the ids a first call needs (10).

SandBase 81

Read on the MCP tools, with the HTTP API where a line covers it. Seven tools (sandbase_discover, sandbase_inspect, sandbase_run, sandbase_run_get, sandbase_runs, sandbase_account, sandbase_run_cancel) with one-line descriptions, from the bridge's built-in copy and the skill, which agree; the live tools/list wasn't read. Ten or fewer compact tools (25). sandbase_discover filters by query, type and vendor with a limit, sandbase_run_get pages a run's output by cursor and limit, sandbase_runs by limit and offset, account history by page up to 100, and Agents lists by cursor. Other output sizing depends on each provider's parameters, and the skill sends large results to the CLI's -o file. Monid took 18 with more filters and no paging of run output (18 of 20). Bridge errors are isError results naming the cause and the next step (sign in again, top up, raise the key's spending limit, wait 10 to 30 seconds), and a 402 separates a key's spending limit from an empty balance. The API's platform errors are a bare string with no code or retryable flag (16 of 20). Idempotency keys on Agents writes, session events, cancel and Agent Service runs (sandbase_run_cancel requires one, and the CLI generates one for service runs), and the bridge refuses to resend a run once it may have reached the server, but POST /v1/run and sandbase_run take no key and no tool carries readOnlyHint or destructiveHint. Smithery earned 10 with idempotent upserts and safe client retries (10 of 20). A run needs only a tool name and arguments. SDKs for Python, TypeScript and Go sit in sandbaseai/sandbase at 0.1.0, installed from GitHub and on no package registry, and the OpenAI, Anthropic and E2B SDKs work by changing the base URL. Monid took 8 with the CLI alone (12 of 15). 25+18+16+10+12 = 81.