Traycer vs Vibe-Trading

Traycer 30

Scored on the paid option, Traycer's own inference subscription, whose price wasn't read (0 of 20). No protocol (0). Bring-your-own-agent use is free (20). Accounts for sync and teams weren't checked, half (10). 0 + 0 + 20 + 10 = 30.

Vibe-Trading 60

Read with the self-hosted rule. No payment protocol (0). Free under the MIT licence with nothing to buy from the project, so 20, 20 and 20 on the last three lines. It runs with a local model through Ollama and needs no sign-up with the project. QVeris paid data, reached through a disclosed referral link, is a third party's product and is not scored.

Traycer 42

Harness reading. Code is processed in memory and not used for training, but Privacy Mode is opt-in for individuals, prompts may be logged with it off, and Sentry and PostHog 'may be enabled in release builds' (10 of 30). No approval model described in the README (8 of 20). No prompt-injection guidance (5). No audit log found (5). SECURITY.md, CodeQL, Scorecard and secret scanning (14 of 20). 10 + 8 + 5 + 5 + 14 = 42.

Vibe-Trading 70

Harness reading used for nanobot and goose. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry code was found in the source at v0.1.18, and the only call to PyPI is the owner-run vibe-trading update. The API answers only loopback clients without API_AUTH_KEY, Docker binds 127.0.0.1 and runs as user vibe, and the MCP HTTP transport binds 127.0.0.1 with a Host and Origin allow-list against DNS rebinding but no token. Broker keys go to the OS keyring; model keys sit in agent/.env in clear text. The docs carry no statement that nothing is collected (24). Live orders need a mandate that only the owner commits through the web UI or API, with hard caps and a kill switch, and an optional TAP mode waits for human approval of each Alpaca write. No order tool is exposed over MCP, and shell tools are off on the API and every MCP transport unless enabled. The local CLI runs bash and file writes without asking, and generated backtest code runs as a network-capable subprocess with a narrowed environment and no sandbox (13). Reader and search tools add warning-only security_warnings from regex rules, and external MCP tool hints are treated as untrusted in the source. The claude-cli provider's tool filters are described as convenience filters, not a boundary (9). A live-action ledger written append-only with a hash-chained copy, run cards with hashed execution records, tool traces and per-run token usage (13). SECURITY.md with private advisory reporting and a five-business-day acknowledgement. Three advisories were published on 2 October 2026 with CVE identifiers, five months after the 0.1.7 fix, while the email TLS and cross-site settings fixes in 0.1.16 got none. No security.txt and no bounty (11). 24+13+9+13+11 = 70.

Traycer 65

Harness reading. Mintlify docs, a protocol package and a CLI (65).

Vibe-Trading 72

Harness reading of the lines, as for nanobot. The MCP server's tools take typed JSON Schema inputs generated from Python signatures through FastMCP, with a string output schema, and the API server serves FastAPI's OpenAPI file locally (keyless on loopback, behind the key otherwise). No published OpenAPI file or tool manifest outside the running program (20 of 25). No llms.txt on vibetrading.wiki, where /llms.txt redirects to the home page, and the docs are drawn by script from content.en.js. The repository carries Markdown READMEs in seven languages and an agent skill file, agent/SKILL.md (5 of 10). Tool descriptions say what each does, its arguments and what to call first, such as list_skills() before load_skill. The server's own header says every tool is read-only apart from refresh_strategy_evidence, while write_file is also exposed (14 of 20). Inputs are typed, but many choices are free strings (protocol, risk_tier, format) and several take free dictionaries (8 of 15). Many worked examples in the README and a troubleshooting page that names failure states such as no_progress and the 403 from another device; tool errors come back as JSON with an error_type (12 of 15). Dated CHANGELOG.md, GitHub release tags and versioned docs, though the docs still name 0.1.16 as latest (13 of 15).

Traycer 75

Commits on 6 November 2026 and host 1.5.3 (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current apps and CLI packages (15). CI with tests (10). 30 + 20 + 0 + 15 + 10 = 75.

Vibe-Trading 82

v0.1.18 was tagged on 21 October 2026, 12 days before this check (30). Six releases in the 90 days from 4 August, 0.1.13 (tag 10 August) to 0.1.18, from the repository's tags; PyPI couldn't be read on 2 November (20). 771 commits on main in the 30 days to 2 November, 233 of them after v0.1.18, the last on 2 November; the 25 October repository page showed 7 open issues and 57 open pull requests, not re-read. Issue and pull request threads weren't read, a judgement call (18 of 25). An MCP server that isn't in the official MCP registry (searches for vibe-trading and hkuds on 2 November 2026 found nothing). It is published on PyPI, as a Docker setup and on ClawHub (5 of 15). Hash-locked requirements checked in CI on three operating systems, Dependabot set to monthly, and dependency floors raised for named CVEs, most recently on 29 October (9 of 10). 30+20+18+5+9 = 82.

Traycer 60

MIT (30). README privacy section and a linked privacy policy (not read) (18 of 30). CHANGELOG.md, no deprecation policy (10). Analytics described as 'may be enabled', with no opt-out given in the README (8 of 20). 30 + 18 + 10 + 8 = 66.

Vibe-Trading 53

MIT (30). There is no hosted service, so no privacy policy is needed. The README says where data lives (named Docker volumes or ~/.vibe-trading/), that broker keys go to the OS keyring and that generated code doesn't receive model or broker secrets. Nothing was found stating what reaches the model provider or the search fallbacks (15 of 30). Dated changelog entries, a Known issues section, an upgrade note for 0.1.10 and dated retirements such as mootdx leaving the default chain in October 2026. No deprecation policy or notice period (9 of 20). No telemetry was found in the source, but the docs do not state that nothing is collected (13 of 20).