Every product in the catalog, at each layer it works at and grouped by the form it comes in. A list, not a review: nothing is ranked, and a product missing from it was not evaluated and rejected. Nobody looked. Rendered 2026-10-28.
What people use to work with agents
52 products, 3 also work here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Antigravity | Google's command center for driving several local coding agents at once, whose Remote Control reaches machines the buyer already owns rather than compute Google supplies. | No item found on the vendor's pages. |
desktop app, command-line tool | read 2026-09-23 |
| Claude Desktop | Anthropic's desktop app for macOS, Windows and Linux (beta), for chat, with Claude Code and Cowork inside it on paid plans and with desktop extensions for local files and tools. | Not checked yet. | desktop app | read 2026-10-22 |
| LM Studio | A closed desktop application that downloads and serves models on a workstation, with its command-line tool published separately as a public repository. | Not checked yet. | desktop app, command-line tool, model server | read 2026-09-03 |
| nimbalyst | A free, MIT-licensed desktop application for macOS, Windows and Linux that wraps coding agents like Claude Code and Codex in a visual workspace. | You run it, so you answer these. | desktop app | read 2026-10-14 |
| void | An open-source AI editor forked from VS Code that sends model calls directly to the provider or a local model. | You run it, so you answer these. | desktop app | read 2026-10-22 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Amp | A coding agent with an interactive mode in the CLI, on the web and on macOS and iOS, and an unattended cloud mode called Orbs that keeps working after the person who started it stops watching. | SOC 2 Type IIUnverified after 2026-12-26 |
command-line tool, hosted or cloud agent, desktop app | read 2026-09-23 |
| Claude Code | A coding agent from Anthropic, run in a terminal or an editor, that holds the conversation, chooses which tools to call, runs commands and manages its own context until the work is done or it stops to ask. | Claude Code and Claude Code plugin marketplaces SOC 2 (marked †, explained in the key) Type II ISO 27001:2022 (marked †, explained in the key) ISO 42001:2023 (marked †, explained in the key) HIPAA BAA* (only on Enterprise. only under Claude Code with ZDR enabled, on a qualified account) DPA (marked †, explained in the key)Restrictions below.Unverified after 2026-12-23 |
command-line tool, editor extension, desktop app, hosted or cloud agent | read 2026-09-03 |
Restriction, Claude Code and Claude Code plugin marketplaces: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: the Claude API arrangement known as HIPAA readiness does not cover Claude Code. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. On Commercial, Anthropic's support page: the Claude Code tool is not considered an Eligible Service when using a HIPAA-ready API organization. support.claude.com, How to access Covered Models under the BAA, in a list, read 2026-09-24. | ||||
| Factory (Droid CLI) | A hosted multi-agent software-delivery platform where an agent its maker calls a Droid takes a task from the terminal, an IDE, a browser or Slack and returns a code change to review. | Factory (Droid CLI) |
command-line tool, desktop app, hosted or cloud agent, hosted or cloud agent | read 2026-09-23 |
| Warp | A terminal application, rebuilt around agents, that can drive one or more coding agents against a task queue and, per its own newer positioning, automate work across the software development lifecycle. | SOC 2 Type IIUnverified after 2027-01-19 |
command-line tool, desktop app, hosted or cloud agent | read 2026-09-24 |
| Aider | A terminal coding agent that edits files in a local git repository and commits its own changes, driven from the command line with the user's own model key. | You run it, so you answer these. | command-line tool | read 2026-09-24 |
| Continue | An open-source coding assistant for IDEs and a CLI whose model providers you configure, with a provider overview that lists Ollama for local models beside hosted providers. Status: no longer actively maintained; repository read-only. | You run it, so you answer these. | command-line tool, editor extension | read 2026-10-20 |
| crush | A coding agent for the terminal from Charm. | You run it, so you answer these. | command-line tool | read 2026-10-22 |
| Gemini CLI | A terminal agent installed from npm or a package manager, holding the loop and calling tools, extensible over MCP. | You run it, so you answer these. | command-line tool | read 2026-09-03 |
| goose | An open-source, model-agnostic agent that installs, executes, edits and tests code, extensible through MCP. | You run it, so you answer these. | command-line tool, desktop app | read 2026-09-24 |
| little-coder | A CLI you install globally through npm, bun or a curl script that runs the pi agent with a fixed set of bundled extensions and skill files, optimized for small local models like Qwen3.6-35B-A3B. | You run it, so you answer these. | command-line tool | read 2026-10-14 |
| mistral-vibe | A minimal command-line coding agent published by Mistral. | You run it, so you answer these. | command-line tool | read 2026-10-22 |
| OpenCode | A terminal coding agent that holds the loop, chooses tools, and manages context, published as a public repository with readable source code. | You run it, so you answer these. | command-line tool, desktop app | read 2026-09-03 |
| qwen-code | An open-source coding agent you run in a terminal. | You run it, so you answer these. | command-line tool | read 2026-10-22 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Amazon Q Developer | An AWS coding assistant available as an editor plugin, command-line interface, and hosted service. | editor extension, command-line tool, hosted or cloud agent | read 2026-09-03 | |
| Cursor | A code editor that is also an agent harness, so it sits on the boundary between the editor a person works in and the harness that holds an agent's loop. | Cursor and Cursor Cloud Agents SOC 2 (marked †, explained in the key) Type II ISO 27001:2022 (marked †, explained in the key) ISO 42001:2023 (marked †, explained in the key) HIPAA BAA* (only on Enterprise. only under Privacy Mode enabled and locked organization-wide. marked †, explained in the key) DPA (marked †, explained in the key)A restriction below.Unverified after 2026-12-26 |
editor, command-line tool, hosted or cloud agent | read 2026-09-03 |
Restriction, Cursor and Cursor Cloud Agents: zero retention (on Custom API keys (BYOK)). Cursor's help page: the Zero Data Retention policy is not in effect if you utilize your own API keys. cursor.com, Does Cursor's Zero Data Retention policy apply when using my own API keys? Read 2026-10-21. | ||||
| Devin | A hosted agent that takes a task -- a ticket, a Slack mention, an on-call page -- clones the target repository, plans the change and carries it out, then works review feedback and CI results on the pull request until it is approved and merged. | Devin Cloud and Devin Desktop SOC 2 (marked †, explained in the key) Type II DPA (marked †, explained in the key)Unverified after 2027-01-19 |
editor, hosted or cloud agent, command-line tool | read 2026-09-23 |
| Gemini Code Assist | Google's editor-side coding assistant, sold to organizations rather than to the browser user of Google Gemini, the chat assistant. | SOC 2 ISO 27001 HIPAA BAA DPA (marked †, explained in the key)Unverified after 2026-12-26 |
editor extension, hosted or cloud agent | read 2026-09-03 |
| GitHub Copilot | Several products under one name: an inline completion extension, a chat surface, a CLI, and Copilot cloud agent, a hosted agent that can be assigned a whole task. | GitHub Copilot and Copilot cloud agent SOC 2 Type II ISO 42001:2023Unverified after 2026-12-26 |
editor extension, command-line tool, desktop app, hosted or cloud agent | read 2026-09-23 |
| Kiro | An editor that owns the editing surface and frames its workflow around specs rather than chat. | Kiro Kiro from AWSNo item found on the vendor's pages. |
editor, command-line tool, hosted or cloud agent | read 2026-09-03 |
| Sourcegraph Cody | A coding assistant that pulls context from Sourcegraph's code-search index across local and remote repositories, available as extensions for VS Code, JetBrains and Visual Studio, a web app, and a CLI. | Sourcegraph CodySOC 2 (marked †, explained in the key) ISO 27001:2022 (marked †, explained in the key)Unverified after 2027-01-19 SourcegraphSOC 2 (marked †, explained in the key) ISO 27001:2022 (marked †, explained in the key)Unverified after 2027-01-19 |
editor extension, command-line tool, hosted or cloud agent | read 2026-09-24 |
| Cline | A coding agent shipped as several front ends onto one core: a VS Code and JetBrains extension, an installable CLI, a desktop app and an SDK. | You run it, so you answer these. | editor extension, command-line tool, desktop app | read 2026-09-24 |
| JetBrains Junie | JetBrains' coding agent, which its product page says works with any model the user chooses and runs from a terminal, from GitHub issues and pull requests, or from GitLab CI/CD. | Not checked yet. | editor extension, command-line tool | read 2026-10-23 |
| Kilo Code | An open-source coding agent with its own default provider that, per its provider docs, also takes a user's own keys, local models through Ollama, and gateways. | You run it, so you answer these. | editor extension, command-line tool, hosted or cloud agent | read 2026-10-20 |
| Trae | An AI code editor, TraeCode, and a separate work assistant, TraeWork, from one vendor. | Not checked yet. | editor, desktop app, hosted or cloud agent | read 2026-10-22 |
| twinny | An IDE extension for VS Code that connects to a local or hosted model server for code completion, chat and inline editing, plus an optional self-hosted gateway server for team management. | You run it, so you answer these. | editor extension, server you run | read 2026-10-14 |
| Zed | A native code editor with built-in real-time collaboration and an agent panel that can plan and execute multi-file edits. | You run it, so you answer these. | editor | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| OpenHands | An open-source coding agent that plans and executes multi-step changes using terminal, browser, and code-editing tools, available for local or self-hosted deployment. | OpenHands CloudNo item found on the vendor's pages.Unverified after 2026-12-29 The software itself: you run it, so you answer these. |
server you run, hosted or cloud agent | read 2026-09-24 |
| dify | A server you run, or a hosted tier, that puts a builder over a workflow engine, a retrieval-augmented generation pipeline and model management. | You run it, so you answer these. | server you run, hosted or cloud agent | read 2026-09-03 |
| langflow | A server you run with a visual authoring surface that exposes every workflow as an API and an MCP server, so other programs and agents can call it. | You run it, so you answer these. | server you run | read 2026-09-03 |
| LibreChat | A self-hosted chat interface that takes Ollama and OpenAI-compatible endpoints as configured endpoints. | You run it, so you answer these. | server you run | read 2026-10-20 |
| n8n | A server you run, or a hosted tier, with a visual canvas over an orchestration engine and a connector catalog. | You run it, so you answer these. | server you run, hosted or cloud agent | read 2026-09-03 |
| Open WebUI | A self-hosted web interface that connects to Ollama, hosted providers or compatible servers. | You run it, so you answer these. | server you run | read 2026-10-20 |
| tabby | An open-source coding assistant whose self-hosted server provides completion, chat and an answer engine to editor extensions. | You run it, so you answer these. | server you run, editor extension | read 2026-10-22 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| ChatGPT | A hosted general-purpose assistant available in a browser, desktop application, and mobile clients. | ISO 42001:2023* (only on ChatGPT Edu, ChatGPT Enterprise. marked †, explained in the key) Government* (only on ChatGPT Enterprise. only under OpenAI's FedRAMP 20x Services and Features card: only the ChatGPT features and API endpoints it lists as Class C (Moderate)) FedRAMP 20x Moderate DPA (marked †, explained in the key)Unverified after 2026-12-29 |
hosted or cloud agent, desktop app | read 2026-09-23 |
| Google Gemini | Google's hosted chat assistant, one of three separately named products Google ships under the Gemini name. | Google GeminiNo item found on the vendor's pages.Unverified after 2026-12-26 GeminiNo item found on the vendor's pages.Unverified after 2026-12-26 |
hosted or cloud agent | read 2026-09-03 |
| Jules | A hosted agent that clones a GitHub repository into a Cloud VM, plans and makes a change, and opens a pull request for review. | No item found on the vendor's pages.Unverified after 2026-12-26 |
hosted or cloud agent | read 2026-09-23 |
| Microsoft Copilot Studio | A hosted builder for agents, licensed inside Microsoft 365 rather than bought separately, whose orchestration engine is the separate open-source microsoft/agent-framework project. | hosted or cloud agent | read 2026-09-03 | |
| Relevance AI | A hosted builder aimed at business functions rather than engineering. | SOC 2 Type IIUnverified after 2026-12-26 |
hosted or cloud agent | read 2026-09-06 |
| Replit Agent | A hosted, browser-based agent that plans, writes, tests and deploys a full application from a natural-language description, with Replit supplying the compute, deployment and hosting end to end. | No item found on the vendor's pages.Unverified after 2027-01-19 |
hosted or cloud agent | read 2026-09-24 |
| Stack AI | A hosted drag-and-drop builder aimed at enterprise deployment. | hosted or cloud agent, server you run | read 2026-09-08 | |
| v0 | Vercel's hosted builder for full-stack web applications generates UI and backend code from natural language and deploys it directly onto Vercel's platform. | SOC 2 (marked †, explained in the key) Type II, period stated as 2025-07-01 to 2026-06-30 ISO 27001:2022 (marked †, explained in the key) HIPAA* (only on Enterprise. marked †, explained in the key) GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 |
hosted or cloud agent | read 2026-09-24 |
| Bolt | A hosted, browser-based builder that generates and runs a full-stack web application from a prompt by executing the generated code in the browser. | Not checked yet. | hosted or cloud agent | read 2026-09-24 |
| Lovable | A hosted full-stack app builder that generates real, exportable code from natural-language prompts, with documentation describing enterprise governance features alongside the consumer-facing build flow. | Not checked yet. | hosted or cloud agent | read 2026-09-24 |
| MonkeyCode | An open-source AI development platform, offered as a hosted service or a self-hosted server, with cloud development environments, model management and project requirement management for engineering teams. | You run it, so you answer these. | hosted or cloud agent, server you run | read 2026-10-14 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Codex | A coding agent installed as a local binary, with an IDE extension and a cloud surface named separately by the same README. | Codex cloud DPA (marked †, explained in the key)Unverified after 2026-12-29 |
command-line tool, editor extension, desktop app, hosted or cloud agent | read 2026-09-03 |
| Vellum (assistant) | A product whose own page on 2026-09-03 describes a personal AI assistant with persistent memory and says nothing about evaluation or test banks. | HIPAAUnverified after 2027-01-19 |
desktop app, hosted or cloud agent | read 2026-09-03 |
| Perplexity app (Personal Computer and Portable Computer) | Perplexity's desktop app, whose Mac hybrid mode offers local models downloaded in the app beside cloud models. | Not checked yet. | desktop app, hosted or cloud agent | read 2026-10-20 |
hermes-agent (listed under Agent frameworks and runtimes), letta-code (listed under Agent frameworks and runtimes), ruflo (listed under Agent frameworks and runtimes)
Tools that review pull requests and code changes
4 products
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| CodeRabbit | A hosted AI code review service that comments on pull requests, proposes fixes for users to commit, and orders the review queue by risk and reviewer capacity. | Not checked yet. | hosted service | read 2026-10-22 |
| Greptile | An AI agent that builds a graph index of your codebase to review pull requests with full context, available as a cloud service or self-hosted through Docker or Kubernetes. | Not checked yet. | hosted service, server you run | read 2026-10-14 |
| Qodo | A hosted AI code review service that checks each pull request against rules derived from your codebase and review history, and checks changes across repositories. | Not checked yet. | hosted service | read 2026-10-22 |
| Sourcery | A hosted AI code review service for GitHub or GitLab that summarizes pull requests, comments on problems, suggests fixes, and can approve low-risk changes automatically. | Not checked yet. | hosted service | read 2026-10-22 |
What runs multi-step work and picks up after a failure
21 products, 13 also work here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| hermes-agent | A Python-based agent you install with a terminal script or download as a desktop app, with a command-line interface, a messaging gateway for platforms like Telegram and Discord, and a learning loop that creates and improves skills from experience. | You run it, so you answer these. | command-line tool, desktop app | read 2026-10-14 |
| letta-code | An npm package you install globally to run a CLI, plus a desktop application for macOS, Windows and Linux, both an interface for stateful agents that keep memory and identity and learn and adapt over time. | You run it, so you answer these. | command-line tool, desktop app, hosted service | read 2026-10-14 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| paperclip | A Node.js server and React UI, installed with an npm CLI and run locally or through Docker, that orchestrates a team of AI agents into a company with org charts, budgets and governance. | You run it, so you answer these. | server you run, command-line tool | read 2026-10-14 |
| temporal | A server you run plus per-language client SDKs, where workflow code runs in your own process and the server holds its durable state and replays it. | You run it, so you answer these. | server you run, library, hosted service | read 2026-09-03 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Amazon Bedrock AgentCore | A family of modular, independently usable managed AWS services for running agents built with any open-source framework and any foundation model, in or outside Bedrock, covering a serverless runtime, a tool gateway, agent identity and a code sandbox. | hosted service | read 2026-09-24 | |
| Anthropic API | Anthropic's own hosted API for the Claude models, separate from Claude Code, Cowork, or a Claude model reached through a cloud platform such as Bedrock, Microsoft Foundry or Google Cloud's Agent Platform. | Anthropic API Claude APISOC 2 Type II ISO 27001 ISO 42001 HIPAA BAA* (only on Commercial, Enterprise. only under the Claude API arrangement Anthropic calls HIPAA readiness) DPA (marked †, explained in the key)A restriction below.Unverified after 2026-12-23 Claude Managed Agents SOC 2 (marked †, explained in the key) Type II ISO 27001:2022 (marked †, explained in the key) ISO 42001:2023 (marked †, explained in the key) DPA (marked †, explained in the key)Restrictions below.Unverified after 2026-12-23 |
hosted service, server you run | read 2026-09-24 |
Restriction, Anthropic API: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude via Anthropic's API", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. Restriction, Claude Managed Agents: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: its feature-eligibility table marks Claude Managed Agents as not eligible for HIPAA readiness. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "HIPAA eligible", read 2026-09-24. Also: Anthropic's page: transcripts remain until removed, and this applies to every Managed Agents feature, such as sandboxes that run on your own infrastructure. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "Details", read 2026-09-24. Restriction, Claude Managed Agents: zero retention. Anthropic's page: its feature-eligibility table marks Claude Managed Agents as not eligible for zero data retention (ZDR). platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "ZDR eligible", read 2026-09-24. Also: Anthropic's page: in its table of which Claude API features are eligible for ZDR and HIPAA readiness, the Claude Managed Agents row says sessions are stateful, with transcripts kept until the customer deletes them, and that this holds for every Managed Agents sub-feature, "Self-hosted sandboxes" included. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "Details", read 2026-09-24. Anthropic's data retention page: session transcripts for Claude Managed Agents are kept until you delete them. platform.claude.com, Zero data retention (ZDR) › What ZDR does not cover, read 2026-09-24. | ||||
| Augment Code (Cosmos) | A platform, branded Cosmos, that its maker positions around organizational scale and that connects agents across code review, test coverage, incident investigation, ticket-to-PR work, large projects and security remediation. | Not checked yet. | hosted service, editor extension, command-line tool | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Claude Agent SDK | A harness you import into your own program, so the party driving it is that program rather than a person typing. | library | read 2026-09-08 | |
| adk-python | A code-first Python toolkit from Google for constructing, checking and shipping agents, whose docs list an evaluation workflow of test files, a CLI and a web UI for reviewing runs. | You run it, so you answer these. | library | read 2026-09-24 |
| AG2 | A multi-agent conversation framework whose GitHub description calls it formerly AutoGen, now developed under its own AG2 organization. | You run it, so you answer these. | library | read 2026-09-24 |
| crewAI | A Python library you import, providing role-based agents with a declared crew and an event-driven Flows API. | You run it, so you answer these. | library | read 2026-09-03 |
| langchain | An open-source Python library you import to build agents and LLM-powered applications, providing a standard interface for models, embeddings and tools. | You run it, so you answer these. | library | read 2026-10-14 |
| langgraph | A Python or TypeScript library you import into your own process, where a graph is declared in advance and a model decides what happens inside each node. | You run it, so you answer these. | library, hosted service | read 2026-09-03 |
| LlamaIndex | A framework whose GitHub description presents it as a document processing platform for AI and does not mention agents. | You run it, so you answer these. | library | read 2026-09-24 |
| mastra | A TypeScript framework you import, shipped as one bundle rather than assembled parts and deployable as a standalone server. | You run it, so you answer these. | library, server you run | read 2026-09-03 |
| microsoft/agent-framework | A library you import, in .NET and Python, that is the engine underneath Copilot Studio's own agents. | You run it, so you answer these. | library | read 2026-09-03 |
| openai-agents-python | A lightweight Python framework for building multi-agent workflows, including agents, handoffs between them, and guardrails, that is provider-agnostic. | You run it, so you answer these. | library | read 2026-09-24 |
| Pydantic AI | A typed Python agent framework from the team behind Pydantic, positioned around type safety across models, tools and structured output rather than a particular orchestration topology. | You run it, so you answer these. | library | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Azure AI Foundry / Azure OpenAI | Microsoft's platform for deploying first-party and third-party models, including Anthropic's Claude family and OpenAI's models, inside an Azure tenant. | Azure AI Foundry / Azure OpenAI Microsoft Foundry from MicrosoftISO 27001 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HITRUST (marked †, explained in the key) GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 Claude in Microsoft Foundry, hosted on Anthropic from AnthropicSOC 2 Type II ISO 27001 ISO 42001Restrictions below.Unverified after 2026-12-23 Claude in Microsoft Foundry, hosted on Azure from AnthropicRestrictions below.Unverified after 2026-12-23 Azure from MicrosoftISO 27001 HIPAA BAA HITRUST (marked †, explained in the key) Government FedRAMP High GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 Microsoft Foundry Agent Service Microsoft Foundry Agent ServiceISO 27001 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HITRUST (marked †, explained in the key) GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 AzureISO 27001 HIPAA BAA HITRUST (marked †, explained in the key) Government FedRAMP High GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 |
gateway | read 2026-09-24 |
Restriction, Azure AI Foundry / Azure OpenAI: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: HIPAA readiness is not offered on Claude Platform on AWS or on Microsoft Foundry. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. Also: From the vendor's table, not a reviewed summary: HIPAA, marked by the maker, kind of evidence not stated. Anthropic's table marks this row and column "✅" (the symbol the cell shows). trust.anthropic.com, above the page's first section heading, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Anthropic", column "HIPAA", read 2026-09-27. Anthropic's page: HIPAA readiness is not offered on Claude Platform on AWS or on Microsoft Foundry. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. Also: Anthropic's page: its trust-center table shows HIPAA for Claude in Microsoft Foundry, hosted on Azure, as in process, marked Q4 2026. trust.anthropic.com, above the page's first section heading, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Azure", column "HIPAA", read 2026-09-27. Restriction, Azure AI Foundry / Azure OpenAI: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Anthropic", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Azure", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. | ||||
| Google Vertex AI / Gemini Enterprise Agent Platform | Google's renamed Vertex AI platform, with the studio, the API, the model garden and the rest of the naming table under it renamed to match. | Google Vertex AI / Gemini Enterprise Agent Platform Gemini Enterprise Agent Platform from GoogleSOC 2 ISO 27001 HIPAA* (only under requests to a locational endpoint. marked †, explained in the key) GDPR* (only under requests to a locational endpoint. marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-23 Claude on Google Cloud's Vertex AI from AnthropicSOC 2* (only under the condition noted under this row's items) Type II ISO 27001* (only under the condition noted under this row's items) ISO 42001* (only under the condition noted under this row's items)Applies to every item above: Anthropic's footnote on this row: its marks cover only the model and the containers Anthropic supplies to partners.A restriction below.Unverified after 2026-12-23 Google Cloud from GoogleSOC 2 ISO 27001 Government FedRAMP High DPA (marked †, explained in the key)Unverified after 2027-01-19 Vertex AI Agent Engine (Gemini Enterprise Agent Platform) Gemini Enterprise Agent PlatformSOC 2 ISO 27001 HIPAA* (only under requests to a locational endpoint. marked †, explained in the key) GDPR* (only under requests to a locational endpoint. marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-23 Google CloudSOC 2 ISO 27001 Government FedRAMP High DPA (marked †, explained in the key)Unverified after 2027-01-19 |
gateway | read 2026-09-24 |
Restriction, Google Vertex AI / Gemini Enterprise Agent Platform: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude on Google Cloud's Vertex AI *", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. | ||||
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| ruflo | A TypeScript CLI and IDE plugin system you install through npm or npx to extend Claude Code and Codex. | You run it, so you answer these. | plugin or content pack, command-line tool | read 2026-10-14 |
Amp (listed under Coding agents and assistants), Codex (listed under Coding agents and assistants), Cursor (listed under Coding agents and assistants), Devin (listed under Coding agents and assistants), Factory (Droid CLI) (listed under Coding agents and assistants), GitHub Copilot (listed under Coding agents and assistants), Jules (listed under Coding agents and assistants), Kiro (listed under Coding agents and assistants), Perplexity (listed under Model access and routing), browser-use (listed under Company knowledge for agents), MonkeyCode (listed under Coding agents and assistants), nimbalyst (listed under Coding agents and assistants), plano (listed under Model access and routing)
A safe place for each run, not someone's laptop
5 products, 10 also work here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| coder/coder | A self-hosted control plane that provisions workspaces from Terraform templates you write and supplies the machine and its isolation, while the agent that runs there is installed separately. | You run it, so you answer these. | server you run | read 2026-09-03 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Daytona | A hosted sandbox cloud for agent-run code, giving disposable, isolated workspaces on demand rather than a template-defined workspace a person provisions once. | SOC 2 Type II, period stated as 2025-12-16 to 2026-03-15 ISO 27001 (marked †, explained in the key)Unverified after 2027-01-19 |
hosted service, library | read 2026-09-24 |
| E2B | A hosted cloud of disposable Firecracker microVMs, one per sandbox, reached through an SDK call, giving an agent an isolated machine to run code, browse and use tools in. | SOC 2 Type II HIPAA BAA* (only on Enterprise. marked †, explained in the key) DPAUnverified after 2027-01-19 |
hosted service, library | read 2026-10-24 |
| GitHub Codespaces | A vendor-hosted workspace defined by a file in the repository, so workspaces start from one template without the team running its own infrastructure. | No item found on the vendor's pages.Unverified after 2026-12-26 |
hosted service | read 2026-09-08 |
| Runloop | A hosted sandbox cloud for agents with persistent workspaces, which its maker markets for autonomous-agent workloads, model evaluation and agentic commerce. | SOC 2Unverified after 2026-12-26 |
hosted service, library | read 2026-09-24 |
Amp (listed under Coding agents and assistants), Anthropic API (listed under Model access and routing), Codex (listed under Coding agents and assistants), Cursor (listed under Coding agents and assistants), Devin (listed under Coding agents and assistants), Factory (Droid CLI) (listed under Coding agents and assistants), GitHub Copilot (listed under Coding agents and assistants), Jules (listed under Coding agents and assistants), Kiro (listed under Coding agents and assistants), MonkeyCode (listed under Coding agents and assistants)
Where agents get facts and reach your systems
18 products, 8 also work here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Factory (Droid CLI) | A hosted multi-agent software-delivery platform where an agent its maker calls a Droid takes a task from the terminal, an IDE, a browser or Slack and returns a code change to review. | Factory (Droid CLI) |
command-line tool, desktop app, hosted or cloud agent, hosted or cloud agent | read 2026-09-23 |
| claude-mem | A CLI tool and plugin you install into IDEs like Claude Code or OpenCode, which captures session observations, compresses them and stores them in a local SQLite database. | You run it, so you answer these. | command-line tool, plugin or content pack | read 2026-10-14 |
| codebase-memory-mcp | A native executable that, its maker states, indexes a codebase into a local knowledge graph by parsing its syntax tree and exposes it to agents as MCP tools, semantic search among them. | You run it, so you answer these. | command-line tool | read 2026-09-25 |
| context-hub | A curated set of reference documentation for third-party SDKs and APIs, reached through a CLI or an MCP server, with documents curated by pull request and an annotation and feedback loop its README describes. | You run it, so you answer these. | command-line tool, server you run | read 2026-09-09 |
| graphify | A Python CLI that parses a codebase into a local knowledge graph with tree-sitter, plus a hosted service that keeps the graph live across repositories. | You run it, so you answer these. | command-line tool, plugin or content pack, hosted service | read 2026-10-14 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| context7 | An MCP server that supplies up-to-date library documentation to a coding agent. | You run it, so you answer these. | server you run, hosted service | read 2026-09-09 |
| github-mcp-server | An official server that connects AI tools to GitHub, exposing tools to read repositories, manage issues and PRs, and automate workflows through natural language. | You run it, so you answer these. | server you run, command-line tool, hosted service | read 2026-10-14 |
| OpenMetadata | A self-hostable platform that ingests technical metadata, lineage, ownership, usage, glossaries and data quality signals from connectors into a unified knowledge graph, then exposes that graph to humans and agents. | You run it, so you answer these. | server you run | read 2026-09-25 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Atlan | A hosted service that connects to an organization's business systems and builds what it calls an Enterprise Data Graph of metadata, lineage, glossary, quality signals and business semantics, queryable by people and agents through chat tools, MCP, APIs and SQL. | SOC 2 ISO 27001:2022 ISO 27701:2019 ISO 42001:2023Unverified after 2026-12-26 |
hosted service | read 2026-09-25 |
| DeepWiki | A hosted service from Cognition, the maker of Devin, that generates conversational, browsable documentation for any public GitHub repository, which a team can point an agent at for context. | SOC 2 (marked †, explained in the key) Type II DPA (marked †, explained in the key)Unverified after 2027-01-19 |
hosted service | read 2026-09-24 |
| Glean | A hosted service that indexes an organization's own SaaS sources. | SOC 2 ISO 27001:2022 ISO 42001:2023Unverified after 2026-12-27 |
hosted service | read 2026-09-03 |
| HipAI | A hosted service that ingests customer data to build a context graph, allowing agents to query entities and relationships without manual schema design or ETL pipelines. | No item found on the vendor's pages.Unverified after 2027-01-19 |
hosted service | read 2026-09-24 |
| Lore | A hosted service that ingests a project's documents and makes them queryable, with citations, by any MCP-compatible AI tool. | No item found on the vendor's pages. |
hosted service, command-line tool | read 2026-09-25 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| cognee | An open-source Python library and CLI that builds persistent knowledge graphs and vector memory for AI agents, with operations to remember, recall, improve and forget content. | Cognee Cloud (Cognee from Cognee)No item found on the vendor's pages.Unverified after 2027-01-19 Cognee Cloud (Cognee Cloud from Cognee)No item found on the vendor's pages. The software itself: you run it, so you answer these. |
library, command-line tool, server you run, hosted service, plugin or content pack | read 2026-10-14 |
| browser-use | A Python library, a CLI and a hosted cloud service for having an agent control a browser to perform web tasks. | You run it, so you answer these. | library, command-line tool, hosted service | read 2026-10-14 |
| chrome-devtools-mcp | An npm package you run as an MCP server or CLI that controls a live Chrome browser through Puppeteer, exposing DevTools capabilities like performance tracing, network analysis and screenshots to coding agents. | You run it, so you answer these. | library, command-line tool | read 2026-10-14 |
| firecrawl | An open-source tool whose search, scrape and crawl endpoints return web pages as clean markdown, structured JSON or screenshots for an LLM, with an interact endpoint for operating a page, also available as a hosted service. | You run it, so you answer these. | library, command-line tool, hosted service, server you run | read 2026-10-14 |
| mem0 | A Python library and CLI that gives AI agents persistent, personalized memory by extracting, storing and retrieving facts from conversations. | You run it, so you answer these. | library, server you run, hosted service, command-line tool | read 2026-10-14 |
Perplexity (listed under Model access and routing), ECC (listed under Skills and specs), Greptile (listed under Code review), hermes-agent (listed under Agent frameworks and runtimes), langchain (listed under Agent frameworks and runtimes), letta-code (listed under Agent frameworks and runtimes), ruflo (listed under Agent frameworks and runtimes), twinny (listed under Coding agents and assistants)
The instructions agents follow
14 products, 1 also works here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| ECC | An open-source toolkit of skills, agents, hooks and security scanning for coding agents, which installs as a native plugin in harnesses like Claude Code and Codex or runs as a hosted GitHub App for repository analysis. | You run it, so you answer these. | command-line tool, plugin or content pack, hosted service | read 2026-10-14 |
| spec-kit | A CLI that writes a scaffold of prompts and templates into a repository for use with many coding agents, producing files a harness reads later. | You run it, so you answer these. | command-line tool, plugin or content pack | read 2026-09-03 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| jax | A Python library for array computation and program transformation, with automatic differentiation and compilation to accelerators. | You run it, so you answer these. | library | read 2026-09-03 |
| ml-explore/mlx | An array framework targeting Apple silicon's unified memory, usable at build time and on the device at once. | You run it, so you answer these. | library | read 2026-09-03 |
| MLX-LM server | A Python package built over MLX that covers text generation and fine-tuning of language models on Apple silicon. | You run it, so you answer these. | library, command-line tool, model server | read 2026-09-03 |
| pytorch | A Python package with compiled kernels underneath, used to define and train models rather than to serve them. | You run it, so you answer these. | library | read 2026-09-03 |
| tensorflow | A framework you import, with a large surrounding ecosystem of tools and libraries. | You run it, so you answer these. | library | read 2026-09-03 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| agent-skills | A plugin repository of 25 skill directories named for lifecycle phases such as planning, TDD, code review, debugging, security and shipping. | You run it, so you answer these. | plugin or content pack | read 2026-09-03 |
| agentskills | A specification for the frontmatter fields of a skill file, plus a validator. | You run it, so you answer these. | plugin or content pack, validator | read 2026-09-10 |
| anthropics/skills | A repository of skill directories for harnesses that implement the Agent Skills standard. | You run it, so you answer these. | plugin or content pack | read 2026-09-03 |
| awesome-claude-skills | Both a list and an implementation: 864 skill files, 832 of them in one automation directory per service and 32 elsewhere. | You run it, so you answer these. | plugin or content pack | read 2026-09-03 |
| gstack | A set of Markdown slash commands for Claude Code that provides specialized roles for product, engineering, design, code, and security reviews, as well as QA and release tasks. | You run it, so you answer these. | plugin or content pack | read 2026-10-02 |
| mattpocock/skills | A Claude Code plugin of 37 skill directories grouped into engineering, productivity, misc and in-progress. | You run it, so you answer these. | plugin or content pack | read 2026-09-03 |
| superpowers | A methodology shipped as files, 14 skill directories plus hooks, scripts and tests, with a separate plugin manifest for each of eight harnesses. | You run it, so you answer these. | plugin or content pack | read 2026-09-03 |
caveman (listed under Model access and routing)
One way in to many model providers
18 products, 1 also works here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Anthropic API | Anthropic's own hosted API for the Claude models, separate from Claude Code, Cowork, or a Claude model reached through a cloud platform such as Bedrock, Microsoft Foundry or Google Cloud's Agent Platform. | Anthropic API Claude APISOC 2 Type II ISO 27001 ISO 42001 HIPAA BAA* (only on Commercial, Enterprise. only under the Claude API arrangement Anthropic calls HIPAA readiness) DPA (marked †, explained in the key)A restriction below.Unverified after 2026-12-23 Claude Managed Agents SOC 2 (marked †, explained in the key) Type II ISO 27001:2022 (marked †, explained in the key) ISO 42001:2023 (marked †, explained in the key) DPA (marked †, explained in the key)Restrictions below.Unverified after 2026-12-23 |
hosted service, server you run | read 2026-09-24 |
Restriction, Anthropic API: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude via Anthropic's API", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. Restriction, Claude Managed Agents: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: its feature-eligibility table marks Claude Managed Agents as not eligible for HIPAA readiness. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "HIPAA eligible", read 2026-09-24. Also: Anthropic's page: transcripts remain until removed, and this applies to every Managed Agents feature, such as sandboxes that run on your own infrastructure. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "Details", read 2026-09-24. Restriction, Claude Managed Agents: zero retention. Anthropic's page: its feature-eligibility table marks Claude Managed Agents as not eligible for zero data retention (ZDR). platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "ZDR eligible", read 2026-09-24. Also: Anthropic's page: in its table of which Claude API features are eligible for ZDR and HIPAA readiness, the Claude Managed Agents row says sessions are stateful, with transcripts kept until the customer deletes them, and that this holds for every Managed Agents sub-feature, "Self-hosted sandboxes" included. platform.claude.com, Feature eligibility, table "Feature eligibility", row "Claude Managed Agents", column "Details", read 2026-09-24. Anthropic's data retention page: session transcripts for Claude Managed Agents are kept until you delete them. platform.claude.com, Zero data retention (ZDR) › What ZDR does not cover, read 2026-09-24. | ||||
| OpenAI API | OpenAI's own hosted API for its models. | ISO 27001:2022 ISO 27701:2019 HIPAA BAA* (only on “Private Retention with PSP”) Government* (only under OpenAI's FedRAMP 20x Services and Features card: only the ChatGPT features and API endpoints it lists as Class C (Moderate)) FedRAMP 20x Moderate DPA (marked †, explained in the key)Unverified after 2026-12-29 |
hosted service | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| AWS Bedrock | A managed API in front of many vendors' models, where the buyer gets an endpoint and a bill and both the routing and the serving happen behind it. | Amazon Bedrock from AWSSOC 2 (marked †, explained in the key) ISO 27001:2022 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HIPAA GDPR DPA (marked †, explained in the key)Unverified after 2026-12-23 Claude in Amazon Bedrock from AnthropicSOC 2* (only under the condition noted under this row's items) Type II ISO 27001* (only under the condition noted under this row's items) ISO 42001* (only under the condition noted under this row's items)Applies to every item above: Anthropic's footnote on this row: its marks cover only the model and the containers Anthropic supplies to partners.A restriction below.Unverified after 2026-12-23 |
gateway | read 2026-09-03 |
Restriction, Claude in Amazon Bedrock from Anthropic: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude in Amazon Bedrock *", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. | ||||
| Azure AI Foundry / Azure OpenAI | Microsoft's platform for deploying first-party and third-party models, including Anthropic's Claude family and OpenAI's models, inside an Azure tenant. | Azure AI Foundry / Azure OpenAI Microsoft Foundry from MicrosoftISO 27001 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HITRUST (marked †, explained in the key) GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 Claude in Microsoft Foundry, hosted on Anthropic from AnthropicSOC 2 Type II ISO 27001 ISO 42001Restrictions below.Unverified after 2026-12-23 Claude in Microsoft Foundry, hosted on Azure from AnthropicRestrictions below.Unverified after 2026-12-23 Azure from MicrosoftISO 27001 HIPAA BAA HITRUST (marked †, explained in the key) Government FedRAMP High GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 Microsoft Foundry Agent Service Microsoft Foundry Agent ServiceISO 27001 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HITRUST (marked †, explained in the key) GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 AzureISO 27001 HIPAA BAA HITRUST (marked †, explained in the key) Government FedRAMP High GDPR (marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-26 |
gateway | read 2026-09-24 |
Restriction, Azure AI Foundry / Azure OpenAI: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: HIPAA readiness is not offered on Claude Platform on AWS or on Microsoft Foundry. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. Also: From the vendor's table, not a reviewed summary: HIPAA, marked by the maker, kind of evidence not stated. Anthropic's table marks this row and column "✅" (the symbol the cell shows). trust.anthropic.com, above the page's first section heading, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Anthropic", column "HIPAA", read 2026-09-27. Anthropic's page: HIPAA readiness is not offered on Claude Platform on AWS or on Microsoft Foundry. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. Also: Anthropic's page: its trust-center table shows HIPAA for Claude in Microsoft Foundry, hosted on Azure, as in process, marked Q4 2026. trust.anthropic.com, above the page's first section heading, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Azure", column "HIPAA", read 2026-09-27. Restriction, Azure AI Foundry / Azure OpenAI: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Anthropic", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude in Microsoft Foundry, hosted on Azure", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. | ||||
| Cloudflare AI Gateway | A gateway feature of Cloudflare's edge platform that adds usage analytics, response caching, rate limiting and automatic model fallback in front of one or more model providers. | SOC 2 (marked †, explained in the key) Type II ISO 27001 (marked †, explained in the key) ISO 27701 (marked †, explained in the key)Unverified after 2027-01-19 |
gateway | read 2026-09-24 |
| Google Vertex AI / Gemini Enterprise Agent Platform | Google's renamed Vertex AI platform, with the studio, the API, the model garden and the rest of the naming table under it renamed to match. | Google Vertex AI / Gemini Enterprise Agent Platform Gemini Enterprise Agent Platform from GoogleSOC 2 ISO 27001 HIPAA* (only under requests to a locational endpoint. marked †, explained in the key) GDPR* (only under requests to a locational endpoint. marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-23 Claude on Google Cloud's Vertex AI from AnthropicSOC 2* (only under the condition noted under this row's items) Type II ISO 27001* (only under the condition noted under this row's items) ISO 42001* (only under the condition noted under this row's items)Applies to every item above: Anthropic's footnote on this row: its marks cover only the model and the containers Anthropic supplies to partners.A restriction below.Unverified after 2026-12-23 Google Cloud from GoogleSOC 2 ISO 27001 Government FedRAMP High DPA (marked †, explained in the key)Unverified after 2027-01-19 Vertex AI Agent Engine (Gemini Enterprise Agent Platform) Gemini Enterprise Agent PlatformSOC 2 ISO 27001 HIPAA* (only under requests to a locational endpoint. marked †, explained in the key) GDPR* (only under requests to a locational endpoint. marked †, explained in the key) DPA (marked †, explained in the key)Unverified after 2026-12-23 Google CloudSOC 2 ISO 27001 Government FedRAMP High DPA (marked †, explained in the key)Unverified after 2027-01-19 |
gateway | read 2026-09-24 |
Restriction, Google Vertex AI / Gemini Enterprise Agent Platform: Government at FedRAMP High, DoD IL4 and DoD IL5. From the vendor's table, not a reviewed summary: Anthropic's table excludes this row and column; its mark reads "N/A" (the symbol the cell shows). trust.anthropic.com, table "Welcome to the Anthropic Trust Center", row "Claude on Google Cloud's Vertex AI *", columns "FedRAMP High", "DoD IL4" and "DoD IL5", read 2026-09-27. | ||||
| Martian | A company whose homepage, read 2026-09-06, leads with AI interpretability research and says nothing about model routing. | MartianNo item found on the vendor's pages. Martian GatewayNo item found on the vendor's pages.Unverified after 2027-01-19 |
gateway | read 2026-09-06 |
| OpenRouter | A hosted gateway in front of many vendors' models, reached through one endpoint and one bill. | SOC 2 Type IIUnverified after 2026-12-26 |
gateway | read 2026-09-06 |
| Perplexity | An API platform that puts several vendors' models behind one key and adds web search to them, with a hosted MCP server and a command-line tool for coding agents. | Perplexity APISOC 2 (marked †, explained in the key) ISO 27001:2022 (marked †, explained in the key) Government (marked †, explained in the key) FedRAMP 20x LowUnverified after 2026-12-28 |
gateway, command-line tool | read 2026-09-29 |
| Portkey | A hosted gateway whose distinguishing claim is what it records about each call rather than what it routes. | gateway | read 2026-09-06 | |
| bifrost | A server you run through Docker or NPX that exposes a single OpenAI-compatible API for 10,000+ models, plus a Go SDK you import for direct integration. | You run it, so you answer these. | gateway, library | read 2026-10-14 |
| caveman | A repository of three parts, per its README: a skill telling a coding agent to write tersely, a local proxy shrinking tool output, logs and diffs before they reach the model provider, and middleware for an application's model calls. | You run it, so you answer these. | library, plugin or content pack, gateway | read 2026-10-02 |
| Kong/kong | A general-purpose, open-source API gateway, Apache-2.0 licensed, that includes AI Gateway capabilities such as semantic caching, multi-LLM routing, prompt guardrails and MCP-related routing as plugins on its runtime. | You run it, so you answer these. | gateway | read 2026-09-24 |
| LiteLLM | A Python SDK and a proxy server in one repository, the proxy giving applications one OpenAI-shaped address, one set of keys and one budget in front of many model providers. | You run it, so you answer these. | library, gateway | read 2026-09-03 |
| Not Diamond | A router that chooses which model answers, sold on cost against frontier quality. | Not checked yet. | gateway | read 2026-09-06 |
| plano | A proxy server and data plane for agentic apps, distributed as a CLI tool you install and a server you run, that centralizes agent routing, orchestration, guardrails and observability to decouple application code from infrastructure plumbing. | You run it, so you answer these. | gateway, command-line tool | read 2026-10-14 |
| Portkey-AI/gateway | A lightweight, open-source gateway server that sits between an application and 1,600+ LLM providers to offer unified routing, caching and guardrails, run locally or through Docker, with per-language client SDKs you import. | You run it, so you answer these. | gateway, library | read 2026-10-14 |
| tyk | A Go-based server you run, or use as a hosted service, that sits in front of your APIs and AI models and provides authentication, rate limiting and analytics for REST, GraphQL, gRPC, TCP and MCP. | You run it, so you answer these. | gateway | read 2026-10-14 |
twinny (listed under Coding agents and assistants)
Running models yourself, or buying inference
18 products
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| OpenLLM | A Python library and CLI you install that runs open-source LLMs as OpenAI-compatible API endpoints. | You run it, so you answer these. | command-line tool, library | read 2026-10-14 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Amazon SageMaker | A managed hosting and tooling service with notebooks, training jobs and inference endpoints. | SOC 2 (marked †, explained in the key) ISO 27001:2022 (marked †, explained in the key) HIPAA BAA (marked †, explained in the key) HIPAA* (only under SageMaker AI other than Studio Lab, Ground Truth Plus, Public Workforce and Vendor Workforce) GDPR DPA (marked †, explained in the key)Unverified after 2026-12-23 |
model server | read 2026-09-03 |
| Baseten | A hosted platform for deploying and scaling open-source and custom models in production. | SOC 2 ISO 27001:2022Unverified after 2026-12-26 |
model server | read 2026-09-24 |
| Modal | A general-purpose serverless platform for running arbitrary code on CPU or GPU at scale, used for model serving and batch inference, that also offers sandboxed execution. | No item found on the vendor's pages. |
model server, library | read 2026-09-24 |
| Together AI | A hosted inference API for open-weight models, with serving, fine-tuning and, per its own marketing, training infrastructure for teams that do not want to run vLLM or similar themselves. | SOC 2 Type II ISO 27001:2022 DPAUnverified after 2026-12-26 |
model server | read 2026-09-24 |
| Atomic-Chat | A desktop and mobile app that runs open-weight models on the device and starts agent tools against them. | You run it, so you answer these. | desktop app, model server | read 2026-10-22 |
| BentoML | A Python library and CLI for building and serving AI models, which packages code and dependencies into a self-contained Bento artifact and generates Docker images. | You run it, so you answer these. | library, command-line tool, model server | read 2026-10-14 |
| Fireworks AI | A hosted platform for fine-tuning and serving open models, which its maker positions around turning them into a buyer's own specialized models. | Not checked yet. | model server | read 2026-09-24 |
| foundry-local | Microsoft's runtime for running models on a user's device, packaged with an SDK, a catalog of optimized models and automatic hardware acceleration, so an application runs offline without an Azure subscription. | You run it, so you answer these. | library, model server | read 2026-10-22 |
| Groq | A hosted inference platform built on Groq's own custom chips (LPUs), marketed on inference speed. | Not checked yet. | model server | read 2026-09-24 |
| llama.cpp server | A C/C++ inference engine whose bundled HTTP server, llama-server, loads a local model file and answers over HTTP. | You run it, so you answer these. | model server, command-line tool | read 2026-10-21 |
| LM Studio | A closed desktop application that downloads and serves models on a workstation, with its command-line tool published separately as a public repository. | Not checked yet. | desktop app, command-line tool, model server | read 2026-09-03 |
| MLX-LM server | A Python package built over MLX that covers text generation and fine-tuning of language models on Apple silicon. | You run it, so you answer these. | library, command-line tool, model server | read 2026-09-03 |
| model-runner | A Docker feature that downloads models and serves them on OpenAI-compatible and Ollama-compatible APIs using llama.cpp, vLLM, or Diffusers, and connects to coding tools such as Cline, Continue, Cursor, and Aider. | You run it, so you answer these. | model server | read 2026-10-22 |
| Ollama (app and cloud models) | A local server and command-line interface that pulls packaged models and serves them on a workstation. | You run it, so you answer these. | desktop app, command-line tool, model server | read 2026-09-03 |
| oMLX | A server for Apple Silicon Macs that loads local models from a folder and answers over HTTP with an OpenAI-style API and an Anthropic Messages endpoint. | You run it, so you answer these. | desktop app, model server | read 2026-10-21 |
| sglang | A serving framework for large language and multimodal models that you run on your own machines. | You run it, so you answer these. | model server | read 2026-10-22 |
| vLLM | A Python library and server process that holds model weights in GPU memory and answers completion calls over an OpenAI-shaped API. | You run it, so you answer these. | model server, library | read 2026-09-03 |
Tracing, scoring and test runs
7 products
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| promptfoo | A config-driven CLI for testing prompts and agents against case sets, comparing model outputs, and red-teaming for vulnerabilities. | You run it, so you answer these. | command-line tool, library | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Galileo | A hosted observability and evaluation platform marketed at enterprise scale, which frames itself around guarding a GenAI application in production as much as scoring it offline. | No item found on the vendor's pages. |
hosted service | read 2026-09-24 |
| Braintrust | A hosted platform for running production agents under observation, which captures traces from live traffic, scores recorded runs against a dataset and flags a regression before it reaches a user. | Not checked yet. | hosted service | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| langfuse | An open-source platform that combines tracing, dataset-based evaluation and prompt versioning, with a hosted cloud tier. | Langfuse CloudSOC 2 Type II ISO 27001 HIPAA* (only under Langfuse Cloud's HIPAA data region) GDPR DPAUnverified after 2026-12-26 The software itself: you run it, so you answer these. |
library, server you run, hosted service | read 2026-09-24 |
| Arize-ai/phoenix | An open-source tracing and evaluation library that instruments applications via OpenTelemetry to capture traces and runs LLM-graded and code-graded evaluations against recorded runs or curated datasets. | You run it, so you answer these. | library, server you run | read 2026-09-24 |
| deepeval | An evaluation framework for large language models from Confident AI, per its GitHub description. | You run it, so you answer these. | library | read 2026-09-24 |
| wandb/weave | Weights & Biases' toolkit for tracing and evaluating LLM applications, built on the same company's established experiment-tracking product for traditional ML training. | You run it, so you answer these. | library | read 2026-09-24 |
Which agents and tools exist, and which version
7 products
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| mcp-gateway-registry | An MCP gateway and registry: one governed address that agents discover MCP servers from once those servers are scattered. | You run it, so you answer these. | server you run | read 2026-09-09 |
| MCPJungle | A self-hosted server, plus a CLI to register upstream MCP servers, that aggregates their tools, prompts and resources into one MCP endpoint supporting Streamable HTTP and STDIO transports. | You run it, so you answer these. | server you run, command-line tool | read 2026-10-14 |
| mlflow | A server plus client libraries that record runs, parameters, artifacts and registered model versions, with a model registry for versioning. | You run it, so you answer these. | server you run, library, hosted service | read 2026-09-03 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| LangSmith Context Hub | A hosted registry, versioned and tagged by environment, for the prompts and contexts an agent loads. | SOC 2 Type II, period stated as 2025-07-01 to 2026-06-30 ISO 27001:2022Unverified after 2026-12-26 |
hosted service | read 2026-09-06 |
| Microsoft Agent 365 | A hosted place to register and manage agents. | hosted service | read 2026-09-08 | |
| Smithery | A hosted directory of MCP servers that, its maker states, handles authentication, credentials and sessions, so an agent can call a listed tool without the team handling them itself. | Not checked yet. | hosted service | read 2026-09-24 |
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| modelcontextprotocol/registry | A registry service for MCP servers developed by volunteers under the GitHub organization that maintains the Model Context Protocol specification. | You run it, so you answer these. | library, hosted service | read 2026-09-24 |
Getting skills and tools onto people's machines
1 product, 1 also works here
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| Claude Code | A coding agent from Anthropic, run in a terminal or an editor, that holds the conversation, chooses which tools to call, runs commands and manages its own context until the work is done or it stops to ask. | Claude Code and Claude Code plugin marketplaces SOC 2 (marked †, explained in the key) Type II ISO 27001:2022 (marked †, explained in the key) ISO 42001:2023 (marked †, explained in the key) HIPAA BAA* (only on Enterprise. only under Claude Code with ZDR enabled, on a qualified account) DPA (marked †, explained in the key)Restrictions below.Unverified after 2026-12-23 |
command-line tool, editor extension, desktop app, hosted or cloud agent | read 2026-09-03 |
Restriction, Claude Code and Claude Code plugin marketplaces: HIPAA (under the Claude API arrangement Anthropic calls HIPAA readiness). Anthropic's page: the Claude API arrangement known as HIPAA readiness does not cover Claude Code. platform.claude.com, HIPAA readiness › What HIPAA readiness does not cover, read 2026-10-21. On Commercial, Anthropic's support page: the Claude Code tool is not considered an Eligible Service when using a HIPAA-ready API organization. support.claude.com, How to access Covered Models under the BAA, in a list, read 2026-09-24. | ||||
ECC (listed under Skills and specs)
Credentials agents use without holding them
1 product
| Tool | What it is | Compliance | Forms | Read |
|---|---|---|---|---|
| infisical | A self-hosted service with a managed tier that holds secrets and brokers credentials on outbound calls, so an agent holds a placeholder and never the real value. | You run it, so you answer these. | server you run, hosted service | read 2026-09-03 |
Not a compliance determination. Each item repeats what the vendor's own page says, and links to it. Check that page, and your own agreement, before relying on it.
A product resting on several items of the record passes the filter when they carry the checked items between them. Only a product whose pages were checked, and that lacks a checked item, disappears; a product marked “Not checked yet” stays on screen whatever is checked. The tile counts above do not change with the filter.
Forms: Desktop app, Command-line tool, Editor, editor extension, Server you run, Hosted or cloud agent, hosted service, Library, Model server, Gateway, Plugin or content pack, validator
Our reading as of the dates on each product's page; confirm on the vendor's page before relying on it.
Some lines here restate, in the catalog's own words, pages licensed under Creative Commons Attribution 4.0 International: Google Cloud documentation (license stated on this cloud.google.com page, read 2026-09-26, and this docs.cloud.google.com page, read 2026-09-24) and docs.github.com, by GitHub, Inc. (license stated on this github.com page, read 2026-09-27). Each license applies as its page states it. Our lines are summaries, not the publishers' text, and the publishers do not endorse them.
Our reading of vendors' pages, as of the dates shown. Confirm on the vendor's page before relying on any line that cites it. To report an error write to report@crinaro.ai