TradingAgents vs AI SDK

TradingAgents 52

Read with the local-software lines, because the owner runs it. Python 3.11 or later is stated and CI tests 3.11 to 3.14, but the project publishes no PyPI package. No workflow uploads one, and the README installs from a clone or Docker Compose. From 0.7.0 a release workflow builds a wheel and source archive from each tag and attaches them to the GitHub release (12 of 20). Public CI on every push and pull request runs the test suite (about 1,009 test functions at v0.7.1) on four Python versions and once in America/New_York, a clean-install import check and Ruff. The 25 October check read the pass state from shields.io, a third-party copy of GitHub data this run doesn't use, so that reading is struck, and the pass state on main is unread (15, as berth and agentvfs). Issue counts came from the same source and are struck too. On the clone, 0.7.1 (27 October) fixes 22 numbered issues, 17 of them above #1518, the newest fixed in 0.7.0 on 16 October, and credits 15 outside contributors; open crash or regression issues and reply times are unread (15, as berth on the same pattern). The changelog follows Keep a Changelog and Semantic Versioning and lists breaking changes under "Upgrading from", but 0.5.1, a patch release, moved import paths and removed classes (10 of 15). Version 0.7.1 with no stability statement (0). 12+15+15+10+0 = 52.

AI SDK 93

Official npm packages, with ai 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.

TradingAgents 61

Framework reading. No API reference or docs site. Typed interfaces exist in the source, Pydantic models for the research manager's, trader's and portfolio manager's outputs and Annotated signatures on the twelve data tools, with no py.typed marker (10 of 25). The README and changelog are Markdown in the repository; no llms.txt (4 of 10). The README states limits plainly, that runs vary, which statements past-dated runs withhold and why, and that it is a research tool, not advice (15 of 20). Configuration is a plain dict of string keys, though environment overrides are coerced to the default's type and fail loudly on a bad value (8 of 15). Runnable Python and CLI examples throughout the README; the vendor error hierarchy is documented only in source docstrings (9 of 15). Dated changelog for every release from 0.1.0 with upgrade notes (15).

AI SDK 100

Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).

TradingAgents 61

Framework reading, scored on what an outside agent needs to call it. No MCP client or server, so it can't be attached as tools; a run is four lines of Python (TradingAgentsGraph(config=...).propagate(ticker, date)) or one headless CLI command with flags (10 of 25). Analyst selection, debate and risk rounds (default 1), max_tool_rounds (20), max_recur_limit (100), article limits and --no-html size a run (14 of 20). A typed vendor error hierarchy separates unavailable from absent data, the headless CLI names the missing flag before a run starts, and an unparseable decision returns REVIEW rather than Hold (15 of 20). Checkpoint resume is opt-in, a backtest rerun with the same run_id skips finished cells, and settlement writes each decision once; nothing writes to an outside system (15 of 20). Sensible defaults, but the default provider is OpenAI's GPT-6 models with a key, and Python only (7 of 15).

AI SDK 95

An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).

TradingAgents 62

Framework reading. 30 for what leaves the machine and how credentials are held, 20 for least privilege and approvals, 15 for prompt injection, 15 for audit and 20 for the security programme. Keys are read from the environment, and the package loads the nearest .env on import by walking up from the working directory. The ChatGPT sign-in uses PKCE and dynamic client registration, keeps tokens in a 0600 file and revokes them on logout. The only calls of its own are the interactive CLI's daily release and notice check, with no run data, off without a terminal or with TRADINGAGENTS_NO_UPDATE_CHECK=1. SEC EDGAR gets a placeholder contact address unless one is set (24 of 30). It places no orders and holds no broker credentials, the data tools only read, and every ticker is validated before it is used in a file path. No approval hooks, which nothing in it needs (14 of 20). News, Reddit and StockTwits text goes into prompts. The source names prompt injection as the reason for path validation, but no guidance on injection was found in the README (5 of 15). Saved reports record the run's settings and each agent's report, the memory log keeps every decision, and debug=True streams the graph (11 of 15). Security reports go to GitHub private vulnerability reporting per the issue template, and the changelog has Security sections for a langchain-core patch and a dependency removed over CVE-2026-22218. No SECURITY.md, no security.txt on tauric.ai (404 on 2 November), no bounty, and the repository's advisories page wasn't read (8 of 20). 24+14+5+11+8 = 62.

AI SDK 90

No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.

TradingAgents 68

The editorial half. Apache 2.0 (30). Local software. The README says where the memory log, checkpoints, cache, reports and ChatGPT sign-in file live, and names each data source and model provider a run calls. tauric.ai's privacy policy (effective 31 October 2026, re-read on 2 November) covers its hosted services, not the framework, and gives no retention periods (18 of 30). "Upgrading from" notes in a dated changelog list what was removed or moved, with no written deprecation policy, and 0.5.1 removed APIs without a deprecation period (8 of 20). The update check is disclosed in the README and changelog with an opt-out, and the code says what it sends; the README doesn't name api.tauric.ai (17 of 20).

AI SDK 89

Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).

TradingAgents 78

0.7.1 on 27 October 2026 (30). Seven releases in the 90 days to 2 November, 0.4.0 (31 August), 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0 and 0.7.1 (20). The earlier issue and pull request counts came from shields.io and are struck. On the clone, fixes cite issue numbers and each release credits the people who reported or fixed them (15 outside contributors in 0.7.1), but 251 of the 258 commits since 4 August are by one maintainer's accounts and reply times couldn't be read (13 of 25, as pipecat on clone evidence). No PyPI package; versions ship as GitHub releases with a wheel since 0.7.0 (8 of 15). CI with tests, lint and a clean-install check; dependencies set lower bounds only and no Dependabot configuration is in the repository (7 of 10). 30+20+13+8+7 = 78.

AI SDK 97

7.0.163 on 2026-11-05 (30). 226 stable npm releases of ai across the 7.x, 6.x and 5.x lines in the 90 days to 6 November, 70 of them since 6 October (20). 47 of the 50 newest issues commented and 32 closed, with triage automation and backport workflows (22). ai and the provider packages are current, and 6.x and 5.x still get patches (15). Dependabot configured and CI passing on main (10). 30+20+22+15+10 = 97.