SandBase vs Smithery

SandBase 81

Read on the MCP tools, with the HTTP API where a line covers it. Seven tools (sandbase_discover, sandbase_inspect, sandbase_run, sandbase_run_get, sandbase_runs, sandbase_account, sandbase_run_cancel) with one-line descriptions, from the bridge's built-in copy and the skill, which agree; the live tools/list wasn't read. Ten or fewer compact tools (25). sandbase_discover filters by query, type and vendor with a limit, sandbase_run_get pages a run's output by cursor and limit, sandbase_runs by limit and offset, account history by page up to 100, and Agents lists by cursor. Other output sizing depends on each provider's parameters, and the skill sends large results to the CLI's -o file. Monid took 18 with more filters and no paging of run output (18 of 20). Bridge errors are isError results naming the cause and the next step (sign in again, top up, raise the key's spending limit, wait 10 to 30 seconds), and a 402 separates a key's spending limit from an empty balance. The API's platform errors are a bare string with no code or retryable flag (16 of 20). Idempotency keys on Agents writes, session events, cancel and Agent Service runs (sandbase_run_cancel requires one, and the CLI generates one for service runs), and the bridge refuses to resend a run once it may have reached the server, but POST /v1/run and sandbase_run take no key and no tool carries readOnlyHint or destructiveHint. Smithery earned 10 with idempotent upserts and safe client retries (10 of 20). A run needs only a tool name and arguments. SDKs for Python, TypeScript and Go sit in sandbaseai/sandbase at 0.1.0, installed from GitHub and on no package registry, and the OpenAI, Anthropic and E2B SDKs work by changing the base URL. Monid took 8 with the CLI alone (12 of 15). 25+18+16+10+12 = 81.

Smithery 0

Nothing callable remains, so context cost, pagination, errors, retries and defaults can't be assessed (0). Smithery's notice says the CLI and SDKs stop working with the service.

SandBase 76

A public OpenAPI 3.1 file at www.sandbase.ai/openapi.json (SandBase API 1.0.0, server https://api.sandbase.ai), linked from llms.txt, covers the OpenAI, Anthropic and Gemini compatible routes, /v1/run, the data API passthrough, uploads, assets, models, account, webhooks, Agents and Sessions. Our reader stopped at about 110,000 characters, before components, so the security schemes and error schemas weren't read, and the hosted MCP tool list wasn't read; the bridge's built-in definitions give JSON Schema for all seven tools. Missing routes and unread MCP tools took 22 for Monid and Nevermined (22 of 25). llms.txt, llms-full.txt, Markdown docs and a 'For AI agents' section (10). The skill says when to use SandBase and when not to (the user's own tools and built-in search first), and the bridge's descriptions say 'Always inspect before running', but each tool description is one line and the live server's text is unread. Monid took 15 with its MCP text unread (15 of 20). The bridge schemas have required fields, additionalProperties: false and an enum on discover's type, but limit has no bounds and sandbase_run takes arguments as a free object typed only through inspect. Monid's untyped run body took 11 (11 of 15). Examples in curl and SDKs throughout, and an errors guide with a status table and recommended actions, but no list of named codes, and core platform errors can be a flat {"error": "..."} string. Monid earned 14 with a 19-value code field (11 of 15). Path versioning under /v1 and dated CLI tags, but no changelog for the API, the MCP server or the platform. Paid earned 7 for versioning with no API changelog (7 of 15). 22+10+15+11+11+7 = 76.

Smithery 8

What's left is the record. The docs, /docs/llms.txt and the OpenAPI file answered 404 on 4 November 2026, so the contract, agent docs, descriptions, typed inputs and examples score 0. The client and CLI changelogs stay public and dated in their repositories (@smithery/api 0.68.0, dated 18 July 2026 in its changelog and released on 20 July; CLI 1.2.0 on 31 May 2026), and the shutdown notice names the date and what stops, but it carries no publication date. The versioning line keeps its earlier partial (8), flagged in the open questions.

SandBase 63

Hosted lines, graded on the HTTP API and the remote MCP server at api.sandbase.ai/v1/mcp, the surfaces an agent calls. status.sandbase.ai is a live Better Stack page with a 90-day view of the website, the API, the docs and the blog, and no component for the MCP path or sandbox.sandbase.ai. Monid earned 15 for a live Better Stack page that didn't monitor its MCP host (15 of 20). Read on 8 November 2026, it showed all services operational, the API at 99.957 per cent over 30 days and 99.983 per cent over 90, and 'No incidents reported' for September, October and November 2026. That is under 20 minutes of API downtime in the last 30 days and no outage of an hour, so minor incidents at most (20). The rate-limits page says requests a minute are assigned per organisation over a one-minute sliding window, shared by its keys, with a video concurrency limit, and publishes no numbers. Paid and Monid earned 7 for limits described without numbers (7 of 15). A 429 carries {"error":"organization rate limit exceeded"}, Retry-After is 'not guaranteed' and honoured when present, and the docs give exponential backoff with jitter and say not to retry a state-changing request without documented idempotency. Idempotency-Key is taken on Agents writes, session events and cancel, not on POST /v1/run, which spends money. Monid earned 11 on the same pattern (11 of 15). No SLA, and the terms promise no uptime, response time or availability (0). No beta or preview label on the API or the MCP server (10). 15+20+7+11+0+10 = 63.

Smithery 0

Shut down, so nothing is left to be reliable. Smithery's notice says the Smithery API, Connect, Toolbox, accounts and API keys stopped working on 31 October 2026, and smithery.ai stays only as a public directory of MCP servers with no API (0 on every line). status.smithery.ai on Better Stack still lists smithery.ai, the Smithery API and the Smithery Gateway at 100 per cent uptime on 4 November 2026, and its history (September to November 2026) shows no incidents. That page describes a surface the vendor says is closed, so it earns nothing. We sent no request to the API to test it.

SandBase 68

Read for a hosted service with an open CLI and SDKs. sandbaseai/cli tagged v0.3.9 on 7 November 2026, npm @sandbaseai/cli 0.3.8 was published on 25 October, and the catalogue repository refreshed on 8 November (30). Tags v0.1.14 to v0.1.17 on 15 and 19 August, v0.3.0 to v0.3.6 on 11 and 12 October, v0.3.8 on 24 October and v0.3.9 on 7 November (20). The platform is closed and GitHub's API refused the graders, so issue queues are unread and the 0 to 15 scale for closed services applies. No public changelog for the API or MCP server, support by GitHub Discussions, issue forms and Discord (untested), and every merged pull request came from a sandbaseai branch, with commits from two people under three account names. Paid earned 5 with a support channel and no changelog, and Monid 6 with merged outside pull requests (5 of 15). The official MCP registry couldn't be read (the fetch needed an approval that didn't come), so presence there scores absent although server.json declares io.github.sandbaseai/cli. Official SDKs in Python, TypeScript and Go exist only in the GitHub repository at 0.1.0, a week old, and the TypeScript README says to copy the file until the npm package is published (5 of 15). CI runs lint, tests, a build and a package audit that rejects lifecycle scripts, with a lockfile and three runtime dependencies, and npm publishing is configured with provenance. CI results weren't read (8 of 10). 30+20+5+5+8 = 68.

Smithery 10

The newest release is @smithery/api 0.68.0, released on 20 July 2026, 107 days before this check (10). No release since 6 August, so 0 on the 90-day line. The notice says the CLI and SDKs are deprecated, and the repositories have no commit after 20 July (typescript-api) and 31 May (cli), so no current official SDK (0). Support is now a migration contact on the notice, with no product channel left (0). No package health to judge for deprecated clients (0).

SandBase 45

Standard keys (sk- and 64 hex characters) act for one organisation with no user-selectable scopes, can carry an expiry and a spending limit, are shown once and are revoked permanently in the console. CLI Login keys from the browser approval (device secret plus PKCE S256) are scoped to mcp:invoke and answer 403 insufficient_scope outside it. No OAuth for the MCP server and no API for managing keys. Above plain revocable keys, below OpenRouter's 25 with OAuth PKCE and a management API (22). The OpenAPI file's generateContent operation 'also accepts x-goog-api-key and the key query parameter for Google SDK compatibility', noting headers are safer, and all four Gemini operations list a GoogleQueryApiKey scheme, read on 8 November 2026. A secret in a URL query string is a documented option, so 10 off (12 of 30). Per-key spending limits and expiry, the organisation's funding boundary and a monthly limit on auto top-up bound spend, and an agent can't lift a key's limit by topping up. No read-only key, per-period budget, per-run cap, allowlist of tools or providers or approval step before a paid run. Monid earned 16 with per-period budgets, a per-run cap and read-only scopes, which SandBase lacks (12 of 20). Runs return scraped pages and social posts from third parties, and neither the skill nor the docs read say to treat them as untrusted. Monid took 3 with none (3 of 15). Request history lists each request's status and cost, sandbase_runs and account history return runs with cost, GET /v1/tasks/{task_id}/cost gives a task's cost, and billing records export as CSV. No key-level audit (created by, last used) was found. Monid earned 13 with key usage records (12 of 15). security.txt answered a client error. SECURITY.md in sandbaseai/sandbase names the SDKs, examples, catalogue and API as in scope for GitHub private vulnerability reporting with acknowledgement within 3 business days, and the CLI repository has its own. No bug bounty or certification found. Paid earned 6 for a reporting address without security.txt (6 of 20). 12+12+3+12+6 = 45.

Smithery 0

No live surface to secure. Accounts, API keys and Connect closed on 31 October 2026, per Smithery's notice (0). What happened to the end-user credentials Smithery stored for connections is not stated on any page we read, and is an open question.

SandBase 40

No x402, MPP or L402 on the home page, pricing, billing, llms.txt or the OpenAPI paths; the balance is funded through Stripe or Airwallex checkout (0). Prices per million tokens, per image, per seconds of video or per call on public pages without a login, such as anthropic/claude-sonnet-5.5 at $1.70 in and $8.50 out per million tokens, and inspect returns each price before a run (20). Every organisation gets 100 free calls a day on eligible data APIs, which a zero-balance organisation can still use per the skill, and Start is $0. No card requirement was found on the pricing page or the billing guide, which asks for a saved card only for auto top-up. Nevermined earned 20 for a free plan with no card requirement found (20). A person approves a browser sign-in, through the CLI's flow or the console, before any key exists, and no keyless or programmatic route was found (0). 0+20+20+0 = 40.

Smithery 0

Nothing to buy. Smithery's notice says paid subscriptions are cancelled and every charge since 5 August 2026 refunded, and the pricing page answered 404 on 4 November 2026. There was never a machine payment protocol (0 on every line).