AP
Agent Provider Depot
Opinionated picks for agents
OpenAPI

What Depot refuses to say

17 rules, as of 2026-10-19. Each one names what Depot says instead and where the rule is enforced in code. JSON · Methodology · Corrections log

  1. no_invented_values

    Refuses to say: A price, score, quota, license, incident, statistic, user count, testimonial or URL that Depot did not source.

    Example: A provider page with no sourced price does not get an estimated $/1M.

    Says instead: null with a machine reason code (e.g. no_matching_sourced_price, no_url_in_score_sources).

    Enforced by: scripts/validate-data.mjs, src/lib/quote.ts, src/lib/agentNative/bundle.ts

  2. no_unit_blending

    Refuses to say: A blended input+output price, or a price converted between units (GPU-hours, minutes, browser-hours, emails, characters into $/1M tokens).

    Example: agent-sandbox compares usd_per_vcpu_hour only; a token budget is never applied to it.

    Says instead: The job's single native unit, or cheapestReason no_comparable_unit_for_job / budget_unit_differs_from_job_unit.

    Enforced by: src/lib/priceComparison.mjs, src/lib/jobPrice.ts, src/lib/agentNative/bundle.ts

  3. plan_is_not_unit_price

    Refuses to say: That a monthly plan is a unit price, or that an overage rate is the base price.

    Example: A $20/month plan is not ranked against a per-1k-emails rate.

    Says instead: plan_not_a_unit_price; overage rows are labelled as overage in the SKU qualifier.

    Enforced by: src/lib/pricingContract.ts, CHANGELOG.md 0.2.26

  4. free_by_listed_job_only

    Refuses to say: That a free row helps a job its row does not list.

    Example: rag-memory has no free row listing it, so bundle returns jobsWithoutFree: ["rag-memory"] instead of borrowing a vector-DB row.

    Says instead: freeMatch: none with a gap code.

    Enforced by: src/lib/freeResources.ts, src/lib/agentNative/bundle.ts

  5. picks_are_editorial

    Refuses to say: That a Depot Pick is a benchmark result or the argmax of its scores.

    Example: supabase-pgvector can have a higher job-weighted overall than the managed-vector pick qdrant without being the pick.

    Says instead: scores.kind curated_estimate, the rationale, and when not to use the pick.

    Enforced by: src/lib/decide.ts, /api/methodology

  6. no_score_mutation_from_submissions

    Refuses to say: That feedback, insights, benchmark runs, receipts or provider corrections changed a score or a pick.

    Example: POST /api/feedback answers scoresMutated:false, picksMutated:false.

    Says instead: Outcome counts with explicit n, labelled as claims; score changes only through an owner-approved edit.

    Enforced by: src/app/api/feedback/route.ts, src/lib/receipts.ts, src/lib/outcomes.ts, src/lib/corrections.ts, scripts/review-correction.mjs

  7. no_fake_social_proof

    Refuses to say: "Used by N teams", "most popular this week", or any count Depot did not observe.

    Example: No usage-ranked list exists: Depot has no traffic log it could honestly rank by.

    Says instead: The real n with its provenance, or nothing. Seed examples bundled with the catalog are labelled seed_editorial and excluded from every count.

    Enforced by: src/lib/outcomes.ts, src/app/insights/page.tsx, src/app/contributors/page.tsx

  8. no_unlicensed_third_party_indexes

    Refuses to say: Artificial Analysis indexes, Arena Elo or OpenRouter throughput numbers as Depot data.

    Example: Leaderboard sorts by third-party indexes are listed as unavailableFilters.

    Says instead: A pointer to the source via /api/canonical.

    Enforced by: src/app/api/canonical/route.ts, src/app/api/leaderboards/route.ts

  9. no_meaningless_comparison

    Refuses to say: A head-to-head between two providers that do not share the job and a sourced price unit.

    Example: /jtbds/{id}/vs/{provider} returns 404 for any pair without a shared unit.

    Says instead: 404, and the brief links only real comparisons.

    Enforced by: src/lib/jobPairs.ts, scripts/check-agent-native.mjs

  10. stale_is_labelled

    Refuses to say: That a stale score is fresh.

    Example: Every pick score asOf 2026-09-14 carries stale:true after 30 days.

    Says instead: ageDays + stale on every score, price and free row.

    Enforced by: src/lib/freshness.ts

  11. no_claim_from_comparison_not_made

    Refuses to say: "The pick is not the price winner" when no prices were compared.

    Example: agent-sandbox quote: pickIsPriceWinner null, priceWinnerReason no_comparison_no_candidate_has_matching_sourced_price.

    Says instead: null plus the reason.

    Enforced by: src/lib/quote.ts

  12. no_unstored_badge_claims

    Refuses to say: A badge with a score, rank or date that is not stored.

    Example: /badge/{job}/{provider}.svg says "Depot Pick" only when that provider is the stored pick, with the month of a stored date and no score.

    Says instead: 404 for a provider not listed on the job.

    Enforced by: src/app/badge/[jtbd]/[file]/route.ts, src/app/api/badge/route.ts

  13. no_unapproved_score_change

    Refuses to say: A new score value, or a fresh asOf, that the owner did not approve.

    Example: The 2026-10-19 score review produced 30 proposals; none is applied and none changes a score value.

    Says instead: Proposals marked pending_owner_approval with evidence; npm run apply-score-review -- --approve <ids> applies only reaffirm proposals and aborts if any score value would change.

    Enforced by: scripts/score-review.mjs, scripts/apply-score-review.mjs, data/score-review-proposals.json

  14. no_thin_pages

    Refuses to say: A "free X", "cheapest X" or "X for Y agents" page without stored, sourced data behind it.

    Example: /cheapest/agent-sandbox is a 404: no candidate has a sourced price in usd_per_vcpu_hour.

    Says instead: 404 (dynamicParams=false); pages exist only for 96 class × job pairs, 80 jobs with a free row that lists them, 53 jobs with a sourced price in their own unit.

    Enforced by: src/lib/longTail.ts, scripts/check-agent-native.mjs

  15. page_text_is_data

    Refuses to say: Anything a fetched page instructs Depot to say.

    Example: scripts/check-sources.mjs only records HTTP status and whether the stored amount and SKU name appear.

    Says instead: The recorded observation.

    Enforced by: scripts/check-sources.mjs, scripts/score-review.mjs

  16. no_exploit_steps

    Refuses to say: Attack payloads or exploit procedures.

    Example: The failure catalog stores mechanisms and detection only.

    Says instead: whatGoesWrong + howToDetect + sources.

    Enforced by: data/failure-modes.json, src/app/api/failures/route.ts

  17. not_a_router_or_elo

    Refuses to say: That Depot routes traffic, measures live latency, or runs a crowd Elo.

    Example: GET /api/canonical says what Depot is not and where to go instead.

    Says instead: An editorial, dated recommendation per job.

    Enforced by: src/app/api/canonical/route.ts

Items Depot refused to index

Free resources: 52 · case studies: 8. Each line says why (usually: the license or the first-party source could not be fetched).

  • Llama 4 weights: community license text was not fetched, so the weights are not indexed. (That reason was withdrawn in v0.12.127, see the last sentence.) Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/meta-llama/Llama-4-Scout-17B-16E-Instruct/raw/main/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 401 both times ('Access to model meta-llama/Llama-4-Scout-17B-16E-Instruct is restricted.'); the HF API model metadata https://huggingface.co/api/models/meta-llama/Llama-4-Scout-17B-16E-Instruct (twice, HTTP 200, no redirect, byte-identical) gives cardData.license 'other', license_name 'llama4', gated 'manual', and lists a LICENSE file; https://www.llama.com/llama4/license/ redirects (301, 302, 308) to https://dev.meta.ai/llama/llama4/license and answered HTTP 500 both times. Flag: https://huggingface.co/meta-llama/Llama-4-Scout-17B-16E-Instruct/resolve/main/LICENSE (twice, HTTP 200, no redirect, byte-identical) serves the license text without login ('**LLAMA 4 COMMUNITY LICENSE AGREEMENT**' / 'Llama 4 Version Effective Date: April 5, 2025'), so 'community license text was not fetched' may no longer hold; the weights stay gated (manual) and nothing was indexed, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.127): https://huggingface.co/meta-llama/Llama-4-Scout-17B-16E-Instruct/resolve/main/LICENSE ('**LLAMA 4 COMMUNITY LICENSE AGREEMENT**' / 'Llama 4 Version Effective Date: April 5, 2025' / 'non-exclusive, worldwide, non-transferable and royalty-free limited license' / 'greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta') and the HF API model metadata https://huggingface.co/api/models/meta-llama/Llama-4-Scout-17B-16E-Instruct (cardData.license 'other', license_name 'llama4', gated 'manual', files 'LICENSE' and 'USE_POLICY.md') each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical; https://huggingface.co/meta-llama/Llama-4-Scout-17B-16E-Instruct/resolve/main/config.json answered HTTP 401 both times ('Access to model meta-llama/Llama-4-Scout-17B-16E-Instruct is restricted.'). The license text has now been fetched, so the 'community license text was not fetched' reason is withdrawn. Still not indexed: the model files stay gated (manual approval), and a Llama 4 row would be a new index addition (kind, jtbdIds, whatYouGet, plus the license's 700-million-monthly-active-users clause and its USE_POLICY.md, which was not fetched), not a correction of this entry, and is left for a separate reviewed addition. Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Gemma 4: the Gemma Terms page says it uses a different license. That license was not copied. Re-checked 2026-10-25 (v0.12.124): https://ai.google.dev/gemma/terms fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect; not byte-identical only because of inline script values, tag-stripped text identical: 'The terms below apply to Gemma models listed in the Appendix at bottom of this page.' / 'For Gemma 4 terms, see the Gemma 4 license' / 'Last updated 2026-04-01 UTC'; that link is href '/gemma/apache_2', and https://ai.google.dev/gemma/apache_2 (twice, HTTP 200, no redirect, tag-stripped text identical) is titled 'Apache License 2.0' (recorded, not copied into a row). Verdict unchanged.
  • OpenRouter RPM/RPD: the official limits page rendered template placeholders, not numbers. (That reading was superseded in v0.12.128: the page's markdown view states the numbers, which the openrouter-free-variants row has stored since v0.12.105; see the last sentence.) Third-party 20/50 tables were refused. Re-checked 2026-10-25 (v0.12.122): https://openrouter.ai/docs/api_reference/limits fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, same length; not byte-identical only because of per-request Cloudflare challenge values in an inline script, tag-stripped text identical: 'Free usage limits : If you’re using a free model variant' / 'Credits purchased (all time) Requests per minute Requests per day Less than At least'; the rendered table cells are empty and the page's MDX source fills them from FREE_MODEL_CREDITS_THRESHOLD, FREE_MODEL_RATE_LIMIT_RPM, FREE_MODEL_NO_CREDITS_RPD and FREE_MODEL_HAS_CREDITS_RPD. Flag: an inline script on the same page also defines 'const FREE_MODEL_RATE_LIMIT_RPM=20;const FREE_MODEL_NO_CREDITS_RPD=50;const FREE_MODEL_HAS_CREDITS_RPD=1e3;const FREE_MODEL_CREDITS_THRESHOLD=10;' (another module defines them as undefined), so the official page source may now carry the numbers even though the rendered cells stay empty; no RPM/RPD value stored, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.128): https://openrouter.ai/docs/api_reference/limits (HTTP 200, no redirect; not byte-identical only because of per-request Cloudflare challenge values in an inline script, tag-stripped text identical; page metadata dateModified 2026-10-10T16:11:54.155Z) and its markdown view https://openrouter.ai/docs/api_reference/limits.md (HTTP 200, no redirect, byte-identical) each fetched twice (~10 s apart, plain curl, no login); https://openrouter.ai/docs/api/reference/limits answers HTTP 308 to the first. The inline-script constants are page source, not docs text, and are not used as a source. The docs text in the markdown view states the numbers: '1. **Free usage limits**: If you're using a free model variant (with an ID ending in `:free`), the following limits apply:' / '| Credits purchased (all time) | Requests per minute | Requests per day |' / '| Less than 10 | 20 | 50 |' / '| At least 10 | 20 | 1000 |' / 'purchase at least 10 credits to raise your daily limit'. These match the limits the openrouter-free-variants row already stores (requestsPerMinute 20, requestsPerDayCreditsPurchasedLessThan10 50, requestsPerDayCreditsPurchasedAtLeast10 1000; stored in v0.12.105 from the same markdown view; row unchanged), so no new value is stored; the one-credit grace is still only the unrendered placeholder '{FREE_MODEL_CREDITS_THRESHOLD - 1}' and is still not stored, and third-party tables are still not copied. Verdict: superseded by the openrouter-free-variants row's limits (official docs text, not page-script constants); this entry no longer refuses OpenRouter's free-model RPM/RPD and is kept as history (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Gemini API RPM/TPM/RPD: the rate-limits page says to view them in AI Studio and does not publish a free-tier number. Re-checked 2026-10-25 (v0.12.122): https://ai.google.dev/gemini-api/docs/rate-limits fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, same length; not byte-identical only because of per-request script nonce and loader in an inline script, tag-stripped text identical: 'Last updated 2026-10-15 UTC.' / 'View your active rate limits in AI Studio' / 'Rate limits depend on a variety of factors (such as your usage tier) and can be viewed in Google AI Studio.'; the spend and billing-cap tables list the Free tier as 'N/A' and no free-tier RPM/TPM/RPD number is published. Verdict unchanged.
  • Mistral free-mode monthly amount: the docs point at an account Limits page and do not publish a number. Re-checked 2026-10-25 (v0.12.122): https://docs.mistral.ai/admin/billing-usage/usage-limits fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Free mode lets you create API keys and use included monthly usage within the limits shown on the Limits page.'; no monthly amount is published on the page. Verdict unchanged.
  • Jina token balance, including any 10 million token grant: not on the fetched embeddings page. Re-checked 2026-10-25 (v0.12.122): https://jina.ai/embeddings/ fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Is there a free trial available for new users?' / 'New users get an auto-generated API key with free tokens usable across any of our models.'; no token amount is stated for the free key ('10 million' and '10,000,000' not on the page, case-insensitive). Verdict unchanged.
  • Groq devRows: labeled Developer plan in the page payload. Not stored as free. Re-checked 2026-10-25 (v0.12.122): https://console.groq.com/docs/rate-limits fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: page payload keys 'freeRows' and 'devRows' (one each); 'Free Plan Limits Developer Plan Limits' / 'Note that the limits shown below are the base limits for the Developer plan'. Verdict unchanged.
  • Workers AI models that require a paid billing method: listed in the neurons note, not as free SKUs. Re-checked 2026-10-25 (v0.12.122): https://developers.cloudflare.com/workers-ai/platform/pricing/ fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Last updated Oct 20, 2026' / 'Some models require a paid billing method.' / 'You can access these models with either the Workers Paid plan or prepaid AI Gateway credits'; the page lists the same 8 models as the cloudflare-workers-ai-neurons note. Verdict unchanged.
  • Hugging Face PRO and Team credits: paid-plan credits. Re-checked 2026-10-25 (v0.12.122): https://huggingface.co/docs/inference-providers/pricing fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, same length; not byte-identical only because of per-request request id in an inline script, tag-stripped text identical: 'PRO users and Team or Enterprise organizations receive monthly credits to use with Inference Providers.' / 'Free Users None - yes (credits purchase required)'. Verdict unchanged.
  • Hugging Face Inference Providers monthly credits for free accounts (former row huggingface-inference-monthly-credits, removed in 0.12.106): https://huggingface.co/docs/inference-providers/pricing fetched twice 2026-10-25 lists 'Free Users None - yes (credits purchase required)' and says 'Free users can use Inference Providers by purchasing credits, or by upgrading to PRO'. The earlier '$0.10, subject to change' figure is no longer on the page, so no free monthly credit is indexed. Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/docs/inference-providers/pricing fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, same length; not byte-identical only because of the per-request request id in an inline script, tag-stripped text identical: 'Free Users None - yes (credits purchase required)' / 'Free users can use Inference Providers by purchasing credits, or by upgrading to PRO'; no '$0.10' and no 'subject to change' (case-insensitive). Verdict unchanged.
  • Cerebras as an always-free tier: the docs say there is not one. Re-checked 2026-10-25 (v0.12.122): https://inference-docs.cerebras.ai/support/rate-limits fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Is there a permanently free tier? No.' / 'Cerebras doesn’t currently offer a no-cost tier that renews automatically or a per-model always-free allowance.'. Verdict unchanged.
  • Signup credits for OpenAI, Anthropic, Together, Fireworks, SambaNova, Deepgram, Modal, and E2B hosted time: a numeric always-free quota was not on a page fetched for this index. Not re-fetched 2026-10-25 (v0.12.124): this entry names no source page (no provider page URL was recorded for any of the eight providers), so no page was re-fetched and it is not marked re-checked; a re-check needs a named official page per provider. Verdict unchanged.
  • pgvector was not linked to supabase-pgvector. OpenRouter prices were not copied onto labs. Re-checked 2026-10-25 (v0.12.122) against Depot's own data (policy entry, no external source page): the pgvector row in data/free-resources.json still has providerId null; no row in data/pricing-rows.json (945 rows) cites an openrouter.ai sourceUrl under a providerId other than openrouter. Verdict unchanged.
  • EUR free tiers were not converted to USD. Re-checked 2026-10-25 (v0.12.122) against Depot's own data (policy entry, no external source page): none of the 149 rows in data/free-resources.json contains 'EUR' or '€', so no EUR amount was converted to USD. Verdict unchanged.
  • CAPTCHA farms, spam infrastructure, and cracked keys were not indexed. Re-checked 2026-10-25 (v0.12.122) against Depot's own data (policy entry, no external source page): none of the 149 rows in data/free-resources.json matches 'captcha', 'spam' or 'cracked' (case-insensitive). Verdict unchanged.
  • Depot picks and price-sort keys were not changed. Free is not a score boost. Re-checked 2026-10-25 (v0.12.122) against Depot's own data (policy entry, no external source page): top-level doesNotChangeDepotPicks and doesNotBoostScores are still true, and the v0.12.122 GET /api/actionable before/after sweep over all 174 jobs is byte-identical (0 picks changed). Verdict unchanged.
  • Llama 3.1 and Llama 3.2: the model API card names llama3.1 or llama3.2, but the repos are gated and the LICENSE file returned 401, so the license text was not fetched. (That reason was withdrawn in v0.12.127, see the last sentence.) Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct/raw/main/LICENSE and https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct/raw/main/LICENSE.txt each fetched twice (~10 s apart, plain curl, no login), HTTP 401 both times (401 re-confirmed: 'Access to model meta-llama/Llama-3.1-8B-Instruct is restricted.'); the HF API model metadata (https://huggingface.co/api/models/meta-llama/Llama-3.1-8B-Instruct and https://huggingface.co/api/models/meta-llama/Llama-3.2-3B-Instruct, twice each, HTTP 200, no redirect, byte-identical) gives cardData.license 'llama3.1' and 'llama3.2', gated 'manual'; https://www.llama.com/llama3_1/license/ and https://www.llama.com/llama3_2/license/ redirect (301, 302, 308) to dev.meta.ai and answered HTTP 404 both times. Flag: the same files under /resolve/main/ (https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct/resolve/main/LICENSE and https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct/resolve/main/LICENSE.txt, twice each, HTTP 200, no redirect, byte-identical) serve the license text without login ('LLAMA 3.1 COMMUNITY LICENSE AGREEMENT' / 'Llama 3.1 Version Release Date: July 23, 2024'; 'LLAMA 3.2 COMMUNITY LICENSE AGREEMENT' / 'Llama 3.2 Version Release Date: September 25, 2024'), so 'the license text was not fetched' may no longer hold; the weights stay gated (manual) and nothing was indexed, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.127): https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct/resolve/main/LICENSE ('LLAMA 3.1 COMMUNITY LICENSE AGREEMENT' / 'Llama 3.1 Version Release Date: July 23, 2024' / 'non-exclusive, worldwide, non-transferable and royalty-free limited license' / 'greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta'), https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct/resolve/main/LICENSE.txt ('LLAMA 3.2 COMMUNITY LICENSE AGREEMENT' / 'Llama 3.2 Version Release Date: September 25, 2024', same two clauses) and the HF API model metadata (cardData.license 'llama3.1' and 'llama3.2', gated 'manual', files LICENSE or LICENSE.txt and USE_POLICY.md) each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical; https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct/resolve/main/config.json and https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct/resolve/main/config.json answered HTTP 401 both times ('Access to model meta-llama/Llama-3.1-8B-Instruct is restricted.'). The license texts have now been fetched, so the 'license text was not fetched' reason is withdrawn. Still not indexed: the model files stay gated (manual approval), and a Llama 3.1 or 3.2 row would be a new index addition (kind, jtbdIds, whatYouGet, plus the license's 700-million-monthly-active-users clause and its USE_POLICY.md, which was not fetched), not a correction of this entry, and is left for a separate reviewed addition. Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Gemma 2 and Gemma 3: the model API card names license gemma, the repos are gated, and LICENSE returned 401. (That reading was withdrawn in v0.12.127: there is no LICENSE file, and Gemma 2 and 3 are indexed under the gemma-terms-of-use row; see the last sentence.) Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/google/gemma-2-9b-it/raw/main/LICENSE and https://huggingface.co/google/gemma-3-4b-it/raw/main/LICENSE each fetched twice (~10 s apart, plain curl, no login), HTTP 401 both times (401 re-confirmed: 'Access to model google/gemma-3-4b-it is restricted.'); the HF API model metadata (https://huggingface.co/api/models/google/gemma-2-9b-it and https://huggingface.co/api/models/google/gemma-3-4b-it, twice each, HTTP 200, no redirect; not byte-identical only because the spaces list came back in a different order, same set, everything else identical) gives cardData.license 'gemma', gated 'manual'. Flag: neither repo lists a LICENSE file in the API siblings and /resolve/main/LICENSE answers HTTP 404 'Entry not found' both times, so the 401 is the gate, not a hidden LICENSE; the license is the Gemma Terms of Use, which the separate gemma-terms-of-use row already indexes for Gemma 2 and 3, so this entry may be stale, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.127): https://huggingface.co/google/gemma-2-9b-it/resolve/main/LICENSE and https://huggingface.co/google/gemma-3-4b-it/resolve/main/LICENSE each fetched twice (~10 s apart, plain curl, no login), HTTP 404 both times ('Entry not found'); the HF API model metadata (twice each, HTTP 200, no redirect; gemma-3-4b-it differs only in the order of the spaces list) gives cardData.license 'gemma', gated 'manual' and lists no LICENSE file; the model cards https://huggingface.co/google/gemma-2-9b-it/resolve/main/README.md and https://huggingface.co/google/gemma-3-4b-it/resolve/main/README.md (twice each, HTTP 200, no redirect, byte-identical) say 'license: gemma' and define '[terms]: https://ai.google.dev/gemma/terms'; https://ai.google.dev/gemma/terms (twice, HTTP 200, no redirect; tag-stripped text identical) says 'The terms below apply to Gemma models listed in the Appendix at bottom of this page.' and its Appendix lists 'Gemma 1 Gemma 1.1 Gemma 2 Gemma 3 Gemma 3n'. The 401 was the access gate, not a hidden LICENSE file, and the license is the Gemma Terms of Use, which the gemma-terms-of-use row already indexes for Gemma 2 and 3 (its whatYouGet names them; that row is unchanged). Verdict: superseded by the gemma-terms-of-use row; this entry no longer refuses Gemma 2 or 3 and is kept as history (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • FLUX.1-dev LICENSE.md returned 401 (that reason was replaced in v0.12.127, see the last sentence). Only FLUX.1-schnell is indexed, from the card license field. Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/black-forest-labs/FLUX.1-dev/raw/main/LICENSE.md fetched twice (~10 s apart, plain curl, no login), HTTP 401 both times (401 re-confirmed: 'Access to model black-forest-labs/FLUX.1-dev is restricted.'); the HF API model metadata https://huggingface.co/api/models/black-forest-labs/FLUX.1-dev (twice, HTTP 200, no redirect, byte-identical) gives cardData.license 'other', license_name 'flux-1-dev-non-commercial-license', license_link 'LICENSE.md', gated 'auto'. Flag: https://huggingface.co/black-forest-labs/FLUX.1-dev/resolve/main/LICENSE.md (twice, HTTP 200, no redirect, byte-identical) serves the license text without login ('FLUX.1 [dev] Non-Commercial License v1.1.1' / 'non-commercial and non-production use'), so 'returned 401' no longer holds on that path; nothing was indexed, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.127): https://huggingface.co/black-forest-labs/FLUX.1-dev/resolve/main/LICENSE.md and the HF API model metadata https://huggingface.co/api/models/black-forest-labs/FLUX.1-dev each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: the license is the 'FLUX.1 [dev] Non-Commercial License v1.1.1', which makes the model 'freely available for your non-commercial and non-production use' and grants a license 'solely for your Non-Commercial Purposes' (metadata license_name 'flux-1-dev-non-commercial-license', gated 'auto'); https://huggingface.co/black-forest-labs/FLUX.1-dev/resolve/main/model_index.json answered HTTP 401 both times ('Access to model black-forest-labs/FLUX.1-dev is restricted.'). The license text has now been fetched, so the 'LICENSE.md returned 401' reason is withdrawn; the replacement reason is the license itself: it allows non-commercial and non-production use only, and the free index does not list a non-commercial license as a free or oss resource. Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Qwen2.5-VL-3B uses a Qwen Research LICENSE. The grant was not fully copied, so that checkpoint is not indexed. The 7B card says apache-2.0 and is a separate row. Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/Qwen/Qwen2.5-VL-3B-Instruct/raw/main/README.md and https://huggingface.co/Qwen/Qwen2.5-VL-3B-Instruct/raw/main/LICENSE each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'license_name: qwen-research' / 'Qwen RESEARCH LICENSE AGREEMENT Release Date: September 19, 2024'; the HF API model metadata https://huggingface.co/api/models/Qwen/Qwen2.5-VL-3B-Instruct (twice, HTTP 200, byte-identical) gives license_name 'qwen-research', gated false; https://huggingface.co/Qwen/Qwen2.5-VL-7B-Instruct/raw/main/README.md (twice, HTTP 200, byte-identical) still says 'license: apache-2.0'. The grant was not copied. Verdict unchanged.
  • GPQA dataset README returned 401 (that reason was replaced in v0.12.127, see the last sentence). The GitHub code LICENSE is MIT and was not applied to the gated dataset. Re-checked 2026-10-25 (v0.12.124): https://huggingface.co/datasets/Idavidrein/gpqa/raw/main/README.md and https://huggingface.co/datasets/Idavidrein/gpqa/resolve/main/license.txt each fetched twice (~10 s apart, plain curl, no login), HTTP 401 both times (401 re-confirmed: 'Access to dataset Idavidrein/gpqa is restricted.'); https://raw.githubusercontent.com/idavidrein/gpqa/main/LICENSE (twice, HTTP 200, no redirect, byte-identical) is 'MIT License' / 'Copyright (c) 2022 I. David Rein'. Flag: https://huggingface.co/datasets/Idavidrein/gpqa/resolve/main/README.md (twice, HTTP 200, no redirect, byte-identical) serves the card without login with front matter 'license: cc-by-4.0' and a gate prompt 'You agree to NOT reveal examples from this dataset in plain text or images online', and the HF API https://huggingface.co/api/datasets/Idavidrein/gpqa (twice, HTTP 200, byte-identical) gives cardData.license 'cc-by-4.0', gated 'auto'; so 'README returned 401' no longer holds on that path; no license applied and nothing indexed, pending review. Verdict unchanged. Flag resolved 2026-10-26 (v0.12.127): https://huggingface.co/datasets/Idavidrein/gpqa/resolve/main/README.md and the HF API https://huggingface.co/api/datasets/Idavidrein/gpqa each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: the card says 'license: cc-by-4.0' and '- **License:** CC BY 4.0', and its access gate asks 'You agree to NOT reveal examples from this dataset in plain text or images online' with 'I accept these terms: checkbox'; the API gives cardData.license 'cc-by-4.0', gated 'auto', and lists a 'license.txt' file; https://huggingface.co/datasets/Idavidrein/gpqa/resolve/main/license.txt and https://huggingface.co/datasets/Idavidrein/gpqa/resolve/main/gpqa_main.csv answered HTTP 401 both times ('Access to dataset Idavidrein/gpqa is restricted.'). The 'README returned 401' reason is withdrawn (the card is readable on /resolve/main/). The card's CC BY 4.0 is not applied to the gated dataset: the dataset's own license.txt is still behind the gate and was not read, so Depot cannot confirm it matches the card, and access first requires accepting the extra no-reveal term. Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Weaviate LICENSE says source is BSD-3-Clause or the Weaviate License depending on path. Not indexed as one free license. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/weaviate/weaviate/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'variously licensed under the BSD-3-Clause License, or the Weaviate License' / 'Within the "wl" directory'. License split confirmed. Verdict unchanged.
  • AutoGPT splits MIT and Polyform Shield. Not indexed as one license. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/Significant-Gravitas/AutoGPT/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Everything inside the autogpt_platform folder is under the Polyform Shield License.' / 'Everything outside the autogpt_platform folder is under the MIT License.'. License split confirmed. Verdict unchanged.
  • InternLM2.5 card says license other and no license text was fetched. Re-checked 2026-10-25 (v0.12.121): https://huggingface.co/internlm/internlm2_5-7b-chat/raw/main/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'license: other'; the card's 'Open Source License' section summarizes terms and points to an application form for commercial use; no license text was fetched. Verdict unchanged.
  • LLaVA 1.5 card says license llama2. That license text was not fetched. Re-checked 2026-10-25 (v0.12.121): https://huggingface.co/llava-hf/llava-1.5-7b-hf/raw/main/README.md and https://huggingface.co/liuhaotian/llava-v1.5-7b/raw/main/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'license: llama2' / 'Llama 2 is licensed under the LLAMA 2 Community License'; that license text was not fetched. Verdict unchanged.
  • XTTS-v2 card points at the Coqui public model license. That license page was not fetched. Re-checked 2026-10-25 (v0.12.121): https://huggingface.co/coqui/XTTS-v2/raw/main/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'license_name: coqui-public-model-license' / 'license_link: https://coqui.ai/cpml'; the license page was not fetched. Verdict unchanged.
  • Daytona LICENSE path returned 404. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/daytonaio/daytona/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 404 both times (404 re-confirmed); GitHub API https://api.github.com/repos/daytonaio/daytona reports the repository archived, with only README.md and assets at its root. Verdict unchanged.
  • Context7 and the remote-filesystem MCP search hit were not indexed. Context7's hosted MCP was not labeled free on the reading that it needs a key (that reason was replaced in v0.12.126, see the last sentence). Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/upstash/context7/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'API Key Recommended' / 'Get a free API key at [context7.com/dashboard](https://context7.com/dashboard) for higher rate limits.' / 'https://mcp.context7.com/mcp'. The remote-filesystem MCP search hit was not re-checked. Flag: the README now calls the key recommended for higher rate limits, not required, so 'needs a key' may no longer hold for the hosted MCP; not indexed, pending review. Verdict unchanged. Flag resolved 2026-10-25 (v0.12.126): https://raw.githubusercontent.com/upstash/context7/HEAD/README.md ('API Key Recommended' / 'Get a free API key at [context7.com/dashboard](https://context7.com/dashboard) for higher rate limits.' / 'pass your API key via the `Authorization: Bearer YOUR_API_KEY` header' / 'This repository hosts the MCP server’s source code. The supporting components — API backend, parsing engine, and crawling engine — are private and not part of this repository.'), https://raw.githubusercontent.com/upstash/context7/HEAD/LICENSE ('The MIT License (MIT)' / 'Copyright (c) 2021 Upstash, Inc.'), https://context7.com/docs/plans-pricing ('Most of Context7 is free.' / 'With a free account and an API key' / '1,000 API calls each month for the MCP server' / 'When a Free account uses all 1,000 calls, requests stop until the next month.'), https://context7.com/docs/resources/troubleshooting ('Sign up at context7.com/dashboard for higher rate limits') and https://context7.com/docs/resources/all-clients ('With API Key (Higher Rate Limits & Private Repos)'; its line 'It supports anonymous access and the CONTEXT7_API_KEY environment variable.' describes the pi extension, not https://mcp.context7.com/mcp) each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical. The official sources call the key recommended for higher rate limits and do not say a key is required, so the 'needs a key' reason is withdrawn; but the only free allowance they state (1,000 API calls each month) is for a free account with an API key, and they publish no keyless limit for https://mcp.context7.com/mcp. Still not indexed: a Context7 row (the MIT MCP server source or the hosted Free plan) would be a new index addition (kind, jtbdIds, whatYouGet), not a correction of this entry, and is left for a separate reviewed addition; the remote-filesystem MCP search hit was not re-checked. Wording fix 2026-10-26 (v0.12.133): the remote-filesystem MCP search hit was added to this entry in 0.3.0 (commit 81eb2cd) with no URL, product name or source page, and no Depot research file, data file or commit records one, so it cannot be re-checked as stored; 'was not re-checked' above means it could not be. It is kept only as history, makes no claim about any product or license, and would need a named official source before it could be re-checked or indexed; no URL is inferred (Depot data decision, approvalRef 'Ethan delegation 2026-10-21 19:41 ET t55u', decidedBy Agent Depo). Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • CLIP's Hugging Face card had no license field. The GitHub MIT license was not used as a substitute weights license. Re-checked 2026-10-25 (v0.12.121): https://huggingface.co/openai/clip-vit-base-patch32/raw/main/README.md and https://huggingface.co/openai/clip-vit-large-patch14/raw/main/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: neither card contains a license field (no 'license' string); 'Model Card: CLIP'. Verdict unchanged.
  • nektos/act: LICENSE (MIT) and README loaded on 2026-10-03. Not indexed. One OSS row for agent-ephemeral-ci, and that row is Dagger. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/nektos/act/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2019'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/nektos/act/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Run your [GitHub Actions](https://developer.github.com/actions/) locally!' / 'It uses the Docker API to either pull or build the necessary images'; no 'agent' or 'ephemeral' string. README part confirmed. Verdict unchanged.
  • Inngest server: LICENSE.md fetched 2026-10-03 is the Server Side Public License with a delayed Apache-2.0 publication. Not indexed as oss. The inngest-js LICENSE path returned 404. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/inngest/inngest/HEAD/LICENSE.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Server Side Public License, Version 1.0' / 'Apache 2.0 Future License' / 'Copyright © 2022 Inngest, Inc.'. License part confirmed. The inngest-js LICENSE path was not re-checked. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): this entry makes no README claim; https://raw.githubusercontent.com/inngest/inngest-js/HEAD/LICENSE and https://raw.githubusercontent.com/inngest/inngest-js/HEAD/LICENSE.md each fetched twice (~10 s apart, plain curl, no login), HTTP 404 both times (404 re-confirmed); GitHub API https://api.github.com/repos/inngest/inngest-js/contents/ (fetched twice, HTTP 200, byte-identical) lists no LICENSE file at the root, while the repo metadata at https://api.github.com/repos/inngest/inngest-js reports license spdx_id 'GPL-3.0' (not used; this entry's verdict is about the server). Verdict unchanged.
  • langgraph-deploy: LangGraph LICENSE is MIT. The README is the library. Its production-deployment link is LangSmith Deployment, not an open-source hosted runtime. Not given its own row. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/langchain-ai/langgraph/HEAD/LICENSE and https://raw.githubusercontent.com/langchain-ai/langgraph/HEAD/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2024 LangChain, Inc.'; README links '[LangSmith Deployment](https://docs.langchain.com/langsmith/deployments)'. Verdict unchanged.
  • Temporal server: LICENSE is MIT and the README says durable workflow execution with retries. Not indexed. The durable-agent-workflows row is LangGraph, whose README names agents, resume after failure, and human oversight. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/temporalio/temporal/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'The MIT License' / 'Copyright (c) 2025 Temporal Technologies Inc.'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/temporalio/temporal/HEAD/README.md and https://raw.githubusercontent.com/langchain-ai/langgraph/HEAD/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: Temporal 'Temporal is a durable execution platform' / 'automatically handles intermittent failures, and retries failed operations', no 'agent' string; LangGraph 'Low-level orchestration framework for building stateful agents.' / 'automatically resuming from exactly where they left off' / 'Seamlessly incorporate human oversight'. README part confirmed. Verdict unchanged.
  • Restate: LICENSE fetched 2026-10-03 is Business Source License 1.1. Not indexed as oss. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/restatedev/restate/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Business Source License 1.1' / 'Licensor: Restate Software, Inc., Restate GmbH'. License part confirmed. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): this entry makes no README claim (license-only verdict, LICENSE re-checked in v0.12.120); nothing further to re-fetch. Verdict unchanged.
  • Nango: LICENSE fetched 2026-10-03 is Elastic License 2.0. Not indexed as oss. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/NangoHQ/nango/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Elastic License 2.0 (ELv2)'. License part confirmed. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): this entry makes no README claim (license-only verdict, LICENSE re-checked in v0.12.120); nothing further to re-fetch. Verdict unchanged.
  • NATS server: Apache-2.0 LICENSE fetched. README describes a communications system and does not say queue, dead-letter, delayed HTTP, or agents. Not indexed. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/nats-io/nats-server/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Apache License Version 2.0, January 2004'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/nats-io/nats-server/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'simple, secure and performant communications system'; no 'queue', 'dead-letter', 'dead letter', 'delayed' or 'agent' string (case-insensitive). README part confirmed. Verdict unchanged.
  • BullMQ: MIT LICENSE fetched. README is a Redis queue. It does not say dead-letter queues or serverless HTTP callbacks. Not indexed. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/taskforcesh/bullmq/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2018 BullForce Labs AB and contributors.'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/taskforcesh/bullmq/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Redis-based distributed queue'; no 'dead-letter', 'dead letter', 'serverless', 'callback' or 'webhook' string (case-insensitive). README part confirmed. Verdict unchanged.
  • Cal.com README fetched 2026-10-03 (MIT LICENSE) is the Cal.diy human scheduling app. It walks through creating Google OAuth credentials. It does not say agents book meetings through a toolkit. Not indexed for calendar-scheduling-tools. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/calcom/cal.com/HEAD/LICENSE and https://raw.githubusercontent.com/calcom/cal.com/HEAD/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2020-present Cal.com, Inc.'; README 'Cal.diy is the open source community edition of Cal.com' / 'Obtaining the Google API Credentials'; no 'agent' string. Verdict unchanged.
  • LiteLLM README fetched 2026-10-03 says spend tracking and spend management. It does not say spend anomaly alerts. Not tagged to llm-cost-anomaly-alerts. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/BerriAI/litellm/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'spend tracking' / 'spend management'; no 'anomaly' or 'alert' string. Verdict unchanged.
  • GlitchTip: the GitHub org README is a profile stub and the GitHub glitchtip-backend LICENSE returned 404 (that reason was withdrawn in v0.12.125, see the last sentence). Not indexed. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/glitchtip/glitchtip-backend/HEAD/LICENSE and https://raw.githubusercontent.com/glitchtip/.github/HEAD/profile/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 404 both times; https://raw.githubusercontent.com/GlitchTip/GlitchTip/HEAD/README.md (the GitHub GlitchTip account's profile README) fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: still the default profile template ('Hi there'). Flag: https://glitchtip.com/ links https://gitlab.com/glitchtip, and https://gitlab.com/glitchtip/glitchtip-backend/-/raw/master/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2019 GlitchTip', so the 404 reason does not hold for the official GitLab repository; not indexed, pending review. Verdict unchanged. Flag resolved 2026-10-25 (v0.12.125): https://glitchtip.com/ (title 'Open Source Error Tracking | GlitchTip', meta description 'GlitchTip is an open source, Sentry API compatible error tracking platform.') links href 'https://gitlab.com/glitchtip'; https://gitlab.com/glitchtip/glitchtip-backend/-/raw/master/LICENSE ('MIT License' / 'Copyright (c) 2019 GlitchTip'), https://gitlab.com/glitchtip/glitchtip-frontend/-/raw/master/LICENSE ('MIT License' / 'Copyright (c) 2020 GlitchTip'), https://gitlab.com/glitchtip/glitchtip-backend/-/raw/master/README.md ('GlitchTip is an open source, Sentry API compatible error tracking platform.' / 'With our MIT license, you can use it for anything you'd like and even sell it.' / 'Self hosted GlitchTip will never report home.') and https://gitlab.com/glitchtip/glitchtip/-/raw/master/README.md ('This is a meta repo for general issue tracking, wiki, and deployment information.', linking the Django Backend and Angular Frontend repositories) each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical. The official GlitchTip repositories are on GitLab under the MIT License, so the GitHub 404 reason is withdrawn (it only ever applied to the GitHub paths). Still not indexed: a GlitchTip row would be a new index addition (kind, jtbdIds, whatYouGet), not a correction of this entry, and is left for a separate reviewed addition; the hosted plans on glitchtip.com (including its 'Free ($0)' Hobby & Trial plan) are not this entry. Verdict: not indexed, reason replaced (Depot data decision under Ethan delegation 2026-10-21 19:41 ET t55u).
  • Letta: README says the current source lives in letta-ai/letta-code. Not indexed from the letta repository. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/letta-ai/letta/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'The current source code lives in [`letta-ai/letta-code`](https://github.com/letta-ai/letta-code)'. Verdict unchanged.
  • faster-whisper: LICENSE fetched 2026-10-03 is MIT. README is CTranslate2 transcription of Whisper. speech-to-text and production-stt already have free rows. README does not describe a talking voice agent or STT+TTS orchestration. Not indexed. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/SYSTRAN/faster-whisper/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2023 SYSTRAN'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/SYSTRAN/faster-whisper/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Faster Whisper transcription with CTranslate2' / 'reimplementation of OpenAI's Whisper model using [CTranslate2]'; no 'agent', 'TTS' or 'text-to-speech' string (case-insensitive). README part confirmed. Verdict unchanged.
  • whisper.cpp: already indexed, LICENSE is MIT. README fetched 2026-10-03 is local Whisper ASR. Not tagged voice-agents or voice-agent-platform. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/ggml-org/whisper.cpp/HEAD/LICENSE and https://raw.githubusercontent.com/ggml-org/whisper.cpp/HEAD/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'MIT License' / 'Copyright (c) 2023-2026 The ggml authors'; README 'automatic speech recognition (ASR) model'; no 'agent' string. Verdict unchanged.
  • Piper: the indexed rhasspy row stays speech-synthesis and realtime-tts. OHF-Voice/piper1-gpl README is local neural TTS. LICENSE and LICENSE.md returned 404 (COPYING is GPL-3.0). Not a new row, and not tagged as a voice-agent platform. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/OHF-Voice/piper1-gpl/HEAD/LICENSE and https://raw.githubusercontent.com/OHF-Voice/piper1-gpl/HEAD/LICENSE.md fetched twice (~10 s apart, plain curl, no login), HTTP 404 both times (404 re-confirmed); https://raw.githubusercontent.com/OHF-Voice/piper1-gpl/HEAD/COPYING and https://raw.githubusercontent.com/OHF-Voice/piper1-gpl/HEAD/README.md each fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'GNU GENERAL PUBLIC LICENSE' / 'Version 3, 29 June 2007'; README 'A fast and local neural text-to-speech engine'; no 'agent' string. Verdict unchanged.
  • Kokoro: already indexed for speech-synthesis and realtime-tts. GitHub LICENSE refetched 2026-10-03 is Apache-2.0. README is a TTS inference library, not a voice-agent platform. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/hexgrad/kokoro/main/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Apache License Version 2.0, January 2004'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/hexgrad/kokoro/main/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'An inference library for [Kokoro-82M]' / 'open-weight TTS model with 82 million parameters'; no 'agent' string (case-insensitive). README part confirmed. Verdict unchanged.
  • Chroma: README hybrid and full-text search are described for Chroma Cloud, not the open-source client snippet. Not tagged hybrid-search-rag. The persistence line does not say agent memory across sessions. Not tagged rag-memory, rag-enterprise, or knowledge-graph-rag. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/chroma-core/chroma/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Chroma Cloud, powers serverless vector, hybrid, and full-text search' / 'Can add persistence easily!'; no 'session' or 'agent memory' string. Verdict unchanged.
  • Qdrant: tagged hybrid-search-rag only. README does not describe enterprise RAG with rerank and support, agent session memory, or a knowledge graph. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/qdrant/qdrant/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: '### Hybrid Search' / 'keyword precision'; no 'rerank', 'session', 'memory', 'knowledge graph' or 'enterprise' string. Verdict unchanged.
  • Unstructured: README says parsing, chunking, and embedding for vector databases. It does not say hybrid keyword plus vector search, an enterprise RAG stack, or a knowledge graph. Not retagged. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/Unstructured-IO/unstructured/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'open-source components for ingesting and pre-processing images and text documents'; no 'hybrid', 'knowledge graph' or 'enterprise' string. Wording note: the README no longer contains 'chunking', 'embedding' or 'vector database'; the reason for not retagging still holds. Verdict unchanged.
  • Playwright: README says the library can be used for web scraping scripts. It does not say it cleans pages into agent-ready text. web-scrape was not added. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/microsoft/playwright/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Use `playwright` as a library for browser automation scripts — web scraping'; no 'clean', 'agent-ready' or 'markdown' string. Verdict unchanged.
  • garak: LICENSE fetched 2026-10-03 is Apache-2.0. README is a red-teaming probe kit and names prompt injection as something it probes. adversarial-red-team-evals already has Promptfoo. README does not say it screens inputs as a firewall. Not indexed. Re-checked 2026-10-25 (v0.12.120): https://raw.githubusercontent.com/NVIDIA/garak/HEAD/LICENSE fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Apache License Version 2.0, January 2004'. License part confirmed; README not re-fetched. Verdict unchanged. Re-checked 2026-10-25 (v0.12.123): https://raw.githubusercontent.com/NVIDIA/garak/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Generative AI Red-teaming & Assessment Kit' / 'probes for hallucination, data leakage, prompt injection'; no 'firewall' or 'screen' string (case-insensitive). README part confirmed. Verdict unchanged.
  • Guardrails AI: already indexed for production-guardrail-evals. README says input and output guards for risks. It does not say prompt injection, a jailbreak firewall, or tool-use policies. Not retagged. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/guardrails-ai/guardrails/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: 'Guardrails runs Input/Output Guards in your application that detect, quantify and mitigate the presence of specific types of risks'; no 'prompt injection', 'jailbreak', 'firewall' or 'tool' string. Verdict unchanged.
  • LLM Guard Secrets scanner is listed as an input scanner. README does not say it stores, injects, or rotates agent credentials. Not tagged agent-secrets or secret-rotation-automation. Not tagged llm-input-guardrails or runtime-llm-firewall: the README does not describe a policy engine, tool-use policies, or an inline WAF. Re-checked 2026-10-25 (v0.12.121): https://raw.githubusercontent.com/protectai/llm-guard/HEAD/README.md fetched twice (~10 s apart, plain curl, no login), HTTP 200, no redirect, byte-identical: '### Prompt scanners' / 'Secrets](https://protectai.github.io/llm-guard/input_scanners/secrets/)'; no 'policy', 'firewall', 'WAF', 'rotat' or 'credential' string. Verdict unchanged.
  • Replit agent database story (July 2025): The Register URL returned HTTP 403 and no first-party engineering postmortem was fetched. Not indexed.
  • CanLII HTML for 2024 BCCRT 149 returned a client-side block. The Civil Resolution Tribunal document was fetched instead and is the indexed source.
  • Cursor agent best-practices post loaded and is a product guide, not a postmortem. Not indexed as an incident. The University of Chicago study it mentions was not fetched.
  • Cognition 'Introducing Devin' (published 2024-03-12) duplicates the SWE-bench technical report. The report is indexed; the launch post is not a second study.
  • Anthropic many-shot jailbreaking research page loaded. It is an attack writeup, so it is not indexed and no procedure is stored.
  • OWASP LLM01:2025 was fetched and is cited on the prompt-injection failure mode only. Attack examples from that page are not copied into a case study.
  • Calder Lab and similar unsourced production-metric blogs were not fetched and are not indexed.
  • Google Research abstract for Data Cascades in High-Stakes AI loaded on 2026-10-03 (the abstract says 92% prevalence). Not indexed for data-etl: it is an interview study of ML data practice, not a pipeline job failure. The indexed data-etl study is the dbt Cloud status page.