SandBase vs StackOne

SandBase 45

Standard keys (sk- and 64 hex characters) act for one organisation with no user-selectable scopes, can carry an expiry and a spending limit, are shown once and are revoked permanently in the console. CLI Login keys from the browser approval (device secret plus PKCE S256) are scoped to mcp:invoke and answer 403 insufficient_scope outside it. No OAuth for the MCP server and no API for managing keys. Above plain revocable keys, below OpenRouter's 25 with OAuth PKCE and a management API (22). The OpenAPI file's generateContent operation 'also accepts x-goog-api-key and the key query parameter for Google SDK compatibility', noting headers are safer, and all four Gemini operations list a GoogleQueryApiKey scheme, read on 8 November 2026. A secret in a URL query string is a documented option, so 10 off (12 of 30). Per-key spending limits and expiry, the organisation's funding boundary and a monthly limit on auto top-up bound spend, and an agent can't lift a key's limit by topping up. No read-only key, per-period budget, per-run cap, allowlist of tools or providers or approval step before a paid run. Monid earned 16 with per-period budgets, a per-run cap and read-only scopes, which SandBase lacks (12 of 20). Runs return scraped pages and social posts from third parties, and neither the skill nor the docs read say to treat them as untrusted. Monid took 3 with none (3 of 15). Request history lists each request's status and cost, sandbase_runs and account history return runs with cost, GET /v1/tasks/{task_id}/cost gives a task's cost, and billing records export as CSV. No key-level audit (created by, last used) was found. Monid earned 13 with key usage records (12 of 15). security.txt answered a client error. SECURITY.md in sandbaseai/sandbase names the SDKs, examples, catalogue and API as in scope for GitHub private vulnerability reporting with acknowledgement within 3 business days, and the CLI repository has its own. No bug bounty or certification found. Paid earned 6 for a reporting address without security.txt (6 of 20). 12+12+3+12+6 = 45.

StackOne 71

OAuth per user with one-hour access tokens, a 90-day grant and revocation, and project API keys with scopes that can be disabled or deleted, would score 30. Ten off because session token URLs carry the access in the query string as a documented option, with a one-year default expiry (20). Connector profiles enable individual actions, users grant accounts and actions at consent, the Credentials scope is off by default, and Policies deny tools, mask fields and bound values on Team and Enterprise. Policies skip API-key calls, and no approval step at the gateway was found (16). Defender scans tool results and is on for new projects, in Monitor mode by default, which changes nothing. Large responses skip scanning by default (12). Action logs on every plan (one day on Starter), login security logs and Advanced Logs with credential masking. The Logs API, audit logs and SIEM export are Enterprise only on Gateway plans (11). SOC 2 Type II and HIPAA are stated on the pricing and contact pages, and the DPA promises breach notice within 48 hours. Since 26 October 2026 the Defender repository carries a SECURITY.md with private reporting, security@stackone.com and a three-business-day acknowledgement, which covers that package only. security.txt returned 404, no bounty or platform-wide disclosure policy was found, and the trust centre answered with a bot check (12).

SandBase 48

The editorial half. The catalogue service, routing, billing, API, MCP server, Agents runtime and sandboxes are closed; the CLI, bridge, skill, catalogue, examples and SDKs are Apache-2.0. The terms (14 October 2026) name AXIOMCLOUD PTE. LTD. under Singapore law and cover agents, scraping APIs, provider licences and billing, with no registration number or address on any page read. Paid, Nevermined and Monid earned 17 for closed platforms with open SDKs (17 of 30). The privacy policy (30 October 2026) names the company, lists the customer content it handles and says the information an operation needs goes to the selected provider. It states no retention periods ('We do not claim a universal retention duration'), says only that it 'does not grant SandBase an unrestricted right' to use private content, and asserts no transfer mechanism. It agrees with the terms but leaves retention and training open. OpenRouter earned 15 where the policies settled storage, and Monid 5 where they were silent on run data (12 of 30). No deprecation policy or dated notices. The terms promise notice of material changes and say that beta parts of the service 'may change, have quotas or be discontinued', and the pricing page promises notice before sandbox pricing changes (3 of 20). The policy names Cloudflare, Google and GitHub sign-in, Stripe, Airwallex, Google Analytics 4 and PostHog (United States), but not the hosting provider, other data locations or the model and data providers. Monid earned 6 and Nevermined 14 (9 of 20). 17+12+3+9 = 41. The provenance half is computed from the provenance block.

StackOne 70

The editorial half. Closed service under SaaS terms that name StackOne Technologies Limited, with the Agent SDKs and Defender under Apache-2.0 (17). The DPA of 15 January 2025 promises deletion within 30 days of termination and breach notice within 48 hours, and the AI Services Addendum says AI providers may not train on customer data. The privacy policy of December 2023 says data is stored in the EEA while projects can be created in a US region, and it gives 30 and 90 day retention periods side by side. The SaaS terms let StackOne use anonymised usage data to improve the Service (18). No deprecation policy for the API was found. Preview functions can be withdrawn at any time, and the Starter plan can change with 30 days' notice on a reasonable-efforts basis. Connector versions can be pinned (5). Three hosting regions are named with their data centres. The sub-processor list is on the trust centre, which we could not read. The DPA gives 14 days to object to a new sub-processor (10).

SandBase 63

Hosted lines, graded on the HTTP API and the remote MCP server at api.sandbase.ai/v1/mcp, the surfaces an agent calls. status.sandbase.ai is a live Better Stack page with a 90-day view of the website, the API, the docs and the blog, and no component for the MCP path or sandbox.sandbase.ai. Monid earned 15 for a live Better Stack page that didn't monitor its MCP host (15 of 20). Read on 8 November 2026, it showed all services operational, the API at 99.957 per cent over 30 days and 99.983 per cent over 90, and 'No incidents reported' for September, October and November 2026. That is under 20 minutes of API downtime in the last 30 days and no outage of an hour, so minor incidents at most (20). The rate-limits page says requests a minute are assigned per organisation over a one-minute sliding window, shared by its keys, with a video concurrency limit, and publishes no numbers. Paid and Monid earned 7 for limits described without numbers (7 of 15). A 429 carries {"error":"organization rate limit exceeded"}, Retry-After is 'not guaranteed' and honoured when present, and the docs give exponential backoff with jitter and say not to retry a state-changing request without documented idempotency. Idempotency-Key is taken on Agents writes, session events and cancel, not on POST /v1/run, which spends money. Monid earned 11 on the same pattern (11 of 15). No SLA, and the terms promise no uptime, response time or availability (0). No beta or preview label on the API or the MCP server (10). 15+20+7+11+0+10 = 63.

StackOne 80

Read with the hosted lines. status.stackone.com on incident.io lists the Web Dashboard, the API in three regions and the Connectors Hub (20). Its feed, read on 1 November 2026, lists one incident in the last 90 days, increased API error rates in EU-WEST-1 on 13 August, affecting the EU API and the dashboard. One region is partial, so minor incidents only (20). API keys are limited to 1,000 requests a minute (15). 429 responses carry Retry-After in seconds, and StackOne retries a provider's 429 up to five times within a 60-second request lifetime before returning 429 or 408. No idempotency key or retry guidance for writes was found (10). The pricing page lists an uptime SLA on Enterprise with no figure, and the Starter plan has none (5). MCP and the RPC endpoint carry no beta label. A2A is in open beta (10).

SandBase 68

Read for a hosted service with an open CLI and SDKs. sandbaseai/cli tagged v0.3.9 on 7 November 2026, npm @sandbaseai/cli 0.3.8 was published on 25 October, and the catalogue repository refreshed on 8 November (30). Tags v0.1.14 to v0.1.17 on 15 and 19 August, v0.3.0 to v0.3.6 on 11 and 12 October, v0.3.8 on 24 October and v0.3.9 on 7 November (20). The platform is closed and GitHub's API refused the graders, so issue queues are unread and the 0 to 15 scale for closed services applies. No public changelog for the API or MCP server, support by GitHub Discussions, issue forms and Discord (untested), and every merged pull request came from a sandbaseai branch, with commits from two people under three account names. Paid earned 5 with a support channel and no changelog, and Monid 6 with merged outside pull requests (5 of 15). The official MCP registry couldn't be read (the fetch needed an approval that didn't come), so presence there scores absent although server.json declares io.github.sandbaseai/cli. Official SDKs in Python, TypeScript and Go exist only in the GitHub repository at 0.1.0, a week old, and the TypeScript README says to copy the file until the npm package is published (5 of 15). CI runs lint, tests, a build and a package audit that rejects lifecycle scripts, with a lockfile and three runtime dependencies, and npm publishing is configured with provenance. CI results weren't read (8 of 10). 30+20+5+5+8 = 68.

StackOne 84

Changelog entries up to 29 October 2026 and @stackone/ai v3.1.0 and stackone-ai (Python) v3.0.0 on 29 October (30). Dated changelog entries from 3 August to 29 October, Node SDK 3.0.0 and 3.1.0, Python SDK 3.0.0 and Defender 0.9.0 to 0.9.4 in the last 90 days (20). A closed service with a dated changelog and in-app chat and email support. GitHub issues were not readable on 1 November, so the 9 October reading of 7 open issues stands (11). com.stackone/mcp is in the official MCP registry under the vendor's domain namespace, version 1.0.1 of 17 August 2026 (15). The SDK repositories carry CI workflows, lockfiles and release automation, and the CI state wasn't read (8).

SandBase 81

Read on the MCP tools, with the HTTP API where a line covers it. Seven tools (sandbase_discover, sandbase_inspect, sandbase_run, sandbase_run_get, sandbase_runs, sandbase_account, sandbase_run_cancel) with one-line descriptions, from the bridge's built-in copy and the skill, which agree; the live tools/list wasn't read. Ten or fewer compact tools (25). sandbase_discover filters by query, type and vendor with a limit, sandbase_run_get pages a run's output by cursor and limit, sandbase_runs by limit and offset, account history by page up to 100, and Agents lists by cursor. Other output sizing depends on each provider's parameters, and the skill sends large results to the CLI's -o file. Monid took 18 with more filters and no paging of run output (18 of 20). Bridge errors are isError results naming the cause and the next step (sign in again, top up, raise the key's spending limit, wait 10 to 30 seconds), and a 402 separates a key's spending limit from an empty balance. The API's platform errors are a bare string with no code or retryable flag (16 of 20). Idempotency keys on Agents writes, session events, cancel and Agent Service runs (sandbase_run_cancel requires one, and the CLI generates one for service runs), and the bridge refuses to resend a run once it may have reached the server, but POST /v1/run and sandbase_run take no key and no tool carries readOnlyHint or destructiveHint. Smithery earned 10 with idempotent upserts and safe client retries (10 of 20). A run needs only a tool name and arguments. SDKs for Python, TypeScript and Go sit in sandbaseai/sandbase at 0.1.0, installed from GitHub and on no package registry, and the OpenAI, Anthropic and E2B SDKs work by changing the base URL. Monid took 8 with the CLI alone (12 of 15). 25+18+16+10+12 = 81.

StackOne 75

The catalogue is large, and individual mode registers one tool per enabled action, which scores 5. Ten back for the two-tool search and execute mode (on by default at the OAuth consent screen), per-action grants and connector profile scoping (15). List endpoints take page and page_size with a total, filters and field expansion, tool search takes top_k, and Deep Query returns counts or chosen fields. Offset paging can skip or repeat records, as the docs warn (16). Errors carry statusCode, errorCode, details.statusReasons and provider errors, with documented causes for 400, 401, 406, 412 and the JSON-RPC codes (17). Every tool carries readOnlyHint and destructiveHint since July 2026. idempotentHint is set only by hand and tool calls take no idempotency key (14). Agent SDKs for TypeScript and Python and API clients in five languages. The mandatory Accept header and Basic auth encoding are extra steps (13).