Overmind vs W&B Weave

Overmind 23

No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, JEV_REQUESTS_PER_MINUTE and JEV_TOKENS_PER_SECOND, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable request_key, identical retries return the existing receipt, changed payloads conflict, and run_evaluation is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.

W&B Weave 68

Graded as a hosted service on the Service API and OTLP endpoints at trace.wandb.ai. Statuspage site at status.forge.coreweave.com with ten components, a Weave backend component among them, and history pages (20). From 3 August to 1 November the history holds one entry, "API Degraded" on 1 September, posted after the fact with no duration and no component, saying a Google Cloud incident made "our API and site" degraded or unavailable. The 8 October reading of it as minor stands, and nothing is posted on the Weave backend component, so minor only (20). The earlier reading from the page's /api/ path, which its robots.txt disallows, is replaced by the history pages. No request rate limits for the multi-tenant Service API were found on 1 November either. The one limits page covers run logging on Dedicated Cloud, and the pricing page says Pro has rate limits without giving them (0). The SDK's retry schedule is documented, from 1 second doubling to 5 minutes with a 36 hour timeout, and the source retries 429 but no other 4xx. No Retry-After or idempotency guidance for direct API callers was found (8). SLA of 99.5 per cent monthly uptime for Enterprise Multi-tenant and Dedicated Cloud, per the 8 October check (10). Weave carries no preview label, though Agent Lens does (10). 20 + 20 + 0 + 8 + 10 + 10 = 68.

Overmind 76

overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.

W&B Weave 87

Python SDK v0.54.0 tagged on 23 October 2026 (30). Nine tagged Python releases from 3 August, v0.53.6 (13 August) to v0.54.0, read from a clone, and the TypeScript SDK's version moved from 0.16.7 to 0.16.10 in the same window (20). GitHub's pages and API refused our reader, so issue reply times went unseen (14 of 25). Current Python and TypeScript SDKs; the repository's TypeScript SDK is at 0.16.10 against 0.54.0 for Python, and npm's own dates weren't read (15). CI workflows for tests, nightly tests and Node tests, with lock files. 0.53.11 had to pin an OpenTelemetry exporter below 1.45 after weave.init() broke, and 0.53.12 lifted the cap (8). 30 + 20 + 14 + 15 + 8 = 87.

Overmind 81

The docs say each deployment serves its OpenAPI schema at /api/schema/, and the repository holds a generated client of 451 files under frontend/src/openapi. api.overmindlab.ai's robots.txt allows only /.well-known/, so the schema itself wasn't read. Every MCP tool takes a Pydantic input model with extra="forbid", compiled to JSON Schema in overbae/services/mcp/catalog.py, read in the source at main on 31 October 2026 (25). llms.txt with 42 pages, llms-full.txt and Markdown for every page on Mintlify (10). Tool descriptions say what each does and what it doesn't ("Does not activate application routing", "no execution", "Passive: never starts provider work"), and the MCP reference warns that an inspection-style name doesn't mean zero cost. Some workbench descriptions are clipped to the point of being hard to parse (16). Typed inputs with Literal enums, length and range bounds, UUID formats and required fields (13). The docs have worked examples for the CLI, SDK, OTLP and inference, and document status classes (401, 402, 403, 404, 409) and structured MCP errors with code, message, retryability and field details, without a full error-code list (10). The MCP server exposes a contract version and a catalogue fingerprint at overmind://interface/current. The SDK changelog has one undated Unreleased section and no product changelog was found (7). 25+10+16+13+10+7 = 81.

W&B Weave 74

A live OpenAPI 3.1 document at trace.wandb.ai/openapi.json with 114 paths, 127 operations and 334 schemas, unchanged on 1 November (25). llms.txt and a Markdown twin of every docs page (10). 76 of 127 operations carry a description, the document's title is the framework default, and when to use each endpoint is left to the guides (11). Request bodies are typed, with filter and sort objects, though query is a nested expression tree and several fields are marked beta and subject to change (11). The query guide has a curl example. The document lists only 200 and 422 responses (7). Dated SDK release notes per version, though on 1 November the newest entry is 0.53.12 while v0.53.13 and v0.54.0 are tagged. The API itself reports version 0.1.0 with a few /v2/ paths and no API changelog of its own (10).

Overmind 70

API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes overmind:read and overmind:write, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and overmind://activity returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.

W&B Weave 63

Forge API keys in headers only, shown once, revocable by deletion and rotated by replacement. Service account keys are limited to a team or an organisation, and admins can enforce organisation-scoped keys. Keys have no per-permission scopes, and no expiry setting was found (22 of 30). Project roles and restricted projects, and the MCP server has a read-only mode that drops its write tools. No read-only API key (10 of 20). Traces hold whatever the application logged. PII redaction is documented, and no prompt-injection guidance for agents reading traces was found (4 of 15). Audit logs through an API, on Multi-tenant Cloud for Enterprise plans only (10 of 15). SOC 2 Type II, ISO 27001, 27017 and 27018, a private HackerOne bounty by invitation and a reporting address. No security.txt, and reporters must sign an NDA. OSV's only advisory for weave is GHSA-r49h-6qxq-624f (CVE-2024-7340, High, fixed in 0.50.8, July 2024), outside the 12 months (17 of 20).

Overmind 65

Platform under AGPL-3.0 and SDK and CLI under MIT, both OSI licences, with a paid commercial licence as an option and a licensing page that says which code is which (30). The privacy policy of 3 October 2026 gives retention (subscription plus 30 days, deletion within 90 days, logs 365 days, backups 7 days), AWS eu-west-1 hosting and OAuth token lifetimes. The terms of 1 March 2026 still describe an earlier security product, say data stays in UK and EU data centres while the privacy policy names model, training and inference providers without locations, and incorporate a DPA that isn't published. The two documents agree on retention but not on the product (15). The terms promise 90 days' written notice before withdrawing a capability and 30 days' notice of material changes. No dated deprecation notices were found (8). SDK analytics are an opt-in extra with three documented off switches. The hosted MCP server reports to PostHog with payloads dropped, which the docs don't mention, and no named sub-processor list was found beyond AWS, though the docs name Modal, OpenRouter, Clerk and Stripe (12). 30+15+8+12 = 65.

W&B Weave 72

The SDKs are Apache-2.0 on GitHub. Since 13 October 2026 (commit ada0360f, released in v0.53.13) the trace server implementation is no longer in wandb/weave; the commit says it is now in wandb/core, which isn't public. The hosted service is proprietary under the Master Service Agreement, and self-managed deployment goes through an account representative. Closed platform with open SDKs, read as langsmith and braintrust (18 of 30). MSA, DPA, privacy policy and sub-processor list are all public, per the 8 October check. The MSA lets W&B use Customer Data to improve its services, develop new products and run AI functions, no retention period for trace data was found, and the documents name three entities, Weights and Biases, LLC, CoreWeave, Inc. and the Forge brand (18 of 30). SDK release notes flag deprecated methods. No dated deprecation policy for the Service API, and no end date for Weave now that Agent Lens is named its successor (8 of 20). Nine sub-processors and one affiliate are listed with locations and 10 days' notice of changes (18 of 20). 18 + 18 + 8 + 18 = 62.

Overmind 76

About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, preview_rows bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and evidence_resource links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable request_key on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass project_id on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.

W&B Weave 71

/calls/stream_query takes a columns list, and the MCP server's trace tool has schema, summary and full detail levels with a 30,000 token response budget (20 of 25). limit, offset, filter, query and sort_by on call queries, plus count and stats endpoints (18). Errors are documented as 422 validation bodies only. A release note of 24 September says illegal query arguments now return 400 and not 403 (8). The SDK retries and has a write-ahead log, and batch upserts exist, but no idempotency keys are documented and the MCP source has no readOnlyHint or destructiveHint annotations (10). Python and TypeScript SDKs, and tracing starts with weave.init and one decorator (15).