Keep your traces. Add security and compliance.
Comet Opik is a great open-source LLM tracing + evaluation platform. EvalGuard imports your Opik traces and spans — model, provider, token usage, cost, and feedback scores all carry over — and puts a 300+-plugin red-team platform, a real-time input + output firewall, a BYOK gateway, and a SOC 2 evidence engine on the same data. No sign-up needed to run your first import.
Honest positioning
Where Opik stops, EvalGuard keeps going
Opik is a first-class open-source tracing + eval tool — clean SDK, native cost tracking, self-hostable. EvalGuard overlaps on tracing and evals, then extends into the hosted security platform, runtime firewall, AI gateway, and compliance work you'd otherwise buy separately.
| Capability | Comet Opik | EvalGuard |
|---|---|---|
| Open-source LLM tracing + spans | Yes | Yes — OTLP + OpenInference ingestion, governed |
| Evaluation + feedback scores | Yes | Yes — 200+ scorers (LLM-as-judge, pairwise, rubric) |
| Native cost / token tracking | Yes | Yes — per-org cost ledger + budgets |
| Open source & self-hosting | Yes | Yes — Apache-2.0 core, self-host available |
| Red-team & security scans | Not offered | Yes — 300+ attack plugins |
| Runtime LLM firewall / guardrails | Yes — Opik Guardrails, fail-closed (topic, PII, prompt-injection, LLM-judge, custom classifier); Python SDK only, off by default | Yes — real-time input + output firewall, on by default, every SDK |
| AI gateway / BYOK proxy | Yes — LLM gateway + provider-key custody (their docs call it beta) | Yes — BYOK gateway, 15 proxied providers, similarity response cache, firewall on the same hop |
| SOC 2 evidence automation | Not a documented product feature | Yes — live evidence engine + audit log |
Comet Opik claims on this page were verified against their source — github.com/comet-ml/opik @ 081f2df6 (2026-08-05) — on 2026-08-10. The one “Not offered” row was settled by searching that repository — including blobs absent from the sparse working tree — for any attack-generation module; Opik ships detectors, not an attack library. Capabilities move; check their current docs before you decide. “SOC 2 evidence automation” describes a product capability, not any vendor’s own certification status.
Opik's guardrails are real and fail closed — the SDK raises even when the guardrail service is unreachable. The differences worth weighing are reach, not existence: enforcement lives in their Python SDK (their own gateway runs no guardrail checks), the service ships disabled by default, and it is absent from their Helm chart.
Migration path
Bring your traces in one command
Everything stays local until you choose to run it — we never touch your Opik project. Export your traces, then convert them to neutral-shape spans with the EvalGuard CLI.
# Python: traces = client.search_traces(project_name='...', truncate=False)
# json.dump([t.dict() for t in traces], open('opik-traces.json','w'))npx @evalguard/cli import:traces --from opik opik-traces.json --output spans.jsonnpx @evalguard/cli init --template security-scan # scaffolds a scan config
npx @evalguard/cli scan:local <that-config> # no API key neededModel, provider, token usage, cost, and every feedback_score map over natively — a failed check stays a normal run, only a real error is flagged. Then layer on red team, a runtime firewall, and a SOC 2 evidence engine.
Want a hand with the migration?
Send us your Opik export and we'll help you map it and validate the first import. Free.