- When compliance is mandatory
- If procurement requires SOC 2 Type II, ISO 27001 evidence, SSO/SCIM, and a published trust center, MiroFish lacks sufficient public documentation.
- When forecast accuracy must be provable
- If statistical validation, backtesting, and published error metrics are required, alternatives with documented methodologies should be considered.
- When operational or security risk is unacceptable
- CVEs affect versions up to 0.1.2 of the open-source repository; self-hosting without hardening introduces risk.
- When domain ambiguity is unacceptable
- Multiple MiroFish-branded domains with differing pricing and positioning increase the risk of procurement and support issues.
- Current limitations acknowledged in vendor materials
- mirofish.my includes a caution that forecasts are exploratory and should be reviewed before use in operational, financial, or policy decisions.
- Roadmap visibility
- No clearly documented public roadmap was found in surfaced sources.
- Scale constraints
- The vendor claim of "1M+ agents" is promotional and practical scale will be constrained by compute cost and latency.
- Security and compliance gaps
- No public SOC 2 or ISO attestations were found. Public CVEs exist for the open-source project up to version 0.1.2.
- API and integration constraints
- Public documentation on hosted-product integrations is limited.