Step 3.7 Flash vs WeVisOne-VL-2B

Step 3.7 Flash 85

Chat template 20, chat_template.jinja in the repository (5,723 characters). Tool-calling format 25, the card names the parser to use in two runtimes, step3p5 in vLLM (with auto tool choice) and in SGLang, and both ship Step parsers in a release. Trained tool calling 20, the card presents tool orchestration as a main use, with multi-turn results, and the template renders every call in a turn. Structured output 0, Nothing on the card about JSON or schema-constrained output for the weights. Reasoning control 10, the template has a reasoning_effort setting and keeps reasoning_content, and the card names the step3p5 reasoning parser for vLLM and SGLang, which returns the reasoning apart from the answer. Context 10, 256K tokens per the card, and 262,144 positions in config.json. 20 + 25 + 20 + 0 + 10 + 10 = 85.

WeVisOne-VL-2B 70

Chat template 20, chat_template.jinja in the repository (5,292 characters), Qwen3-VL's template. Tool-calling format 25, Read for a perception model as what it takes and returns. Trained tool calling 10, Read for a perception model as the inputs it was trained to use. Structured output 15, Read for a perception model as typed outputs. Reasoning control 0, the card says it writes structured output directly with no chain-of-thought reasoning. Context 0, Tencent states no context length for it. 20 + 25 + 10 + 15 + 0 + 0 = 70.

Step 3.7 Flash 45

File safety 15, safetensors and GGUF only, no .bin, .pt or .pth files (25). Provenance 15, the files sit in the stepfun-ai organisation, which the card's StepFun platform and model page belong to (10). Safety evaluation 0, no safety results on the card. Agent guidance 0, the card has no limitations section and gives no guidance on prompt injection, instruction priority, refusals or safeguards. Licence risk 15, Apache 2.0 has no use policy, threshold or change clause. Security programme 0, no way to report a flaw on the card, and our StepFun API listing found no security.txt, bug bounty or disclosure policy. 15 + 15 + 0 + 0 + 15 + 0 = 45.

WeVisOne-VL-2B 55

File safety 15, the backbone is safetensors, but mask_decoder.pt, a PyTorch pickle the card calls a required component, sits beside it. Provenance 15, the files sit in the tencent organisation, which Tencent's GitHub repository for the model links to (10), and the Hub gives a SHA-256 for the large files (5). Safety evaluation 0, no safety results on the card or in the README. Agent guidance 5, General cautions: the card says the release is for research, isn't for autonomous high-impact decisions or identifying individuals, and lists where masks go wrong. Licence risk 15, Apache 2.0 with no use policy, no threshold and no right to change the terms. Security programme 5, Tencent's Security Response Center takes vulnerability reports company-wide, as the Hy3 listing records (5). 15 + 15 + 0 + 5 + 15 + 5 = 55.

Step 3.7 Flash 39

Model card 14, Intended use, the architecture, the parameters, the context and the language (in the metadata) are on the card. Training data 0, Nothing on the card about the training data. Last change 10, the last commit, on 3 June 2026, fixed the modelling code, 160 days before this check and within 180. Responsiveness 0, none of the 11 most recent discussions that aren't pull requests (29 May to 24 June 2026) has a reply from a stepfun-ai member, counted on 10 November by author flags and dates with a script, text not read. Version policy 5, Step-3.5-Flash stays in its own repositories and 3.7 came out in new ones, with no dated note on the older cards that we read. File health 10, Config, template and card agree on the architecture and the context, and June commits fixed the modelling code. 14 + 0 + 10 + 0 + 5 + 10 = 39.

WeVisOne-VL-2B 48

Model card 8, Intended use, limitations and the architecture are on the card. Training data 5, A general description in the README of a data engine and over 100 million annotated images, with no sources named and no cut-off. Last change 20, the last commit, on 28 October 2026, put the weights back in BF16, 13 days before this check. Responsiveness 0, the one discussion that isn't a pull request (23 October 2026) has no reply from a tencent member, counted on 10 November by author flags and dates with a script, text not read. Version policy 5, A first release. File health 10, Config, template and card agree on the Qwen3-VL classes, and the card names mask_decoder.pt as required and it's there. 8 + 5 + 20 + 0 + 5 + 10 = 48.