Agent Zero vs mini-swe-agent

Agent Zero

Self-hosted under the MIT licence, with nine releases in the 90 days to 12 October 2026 and breaking changes listed in the release notes. The agent runs shell commands in its container with no approval step, the web interface has no login by default, and five CVEs from the past year have no published GitHub advisory.

mini-swe-agent

A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

Agent Zero

1. Set a UI login and password in Settings before publishing the port or opening a tunnel. The default has none
2. Fill allowed_users, allowed_numbers or sender_whitelist before enabling a channel. An empty list accepts every sender
3. Enable the Infection Check plugin when the agent reads mail, web pages or MCP results. It ships disabled
4. Run v2.12 or later. It fixes a Telegram webhook authentication bypass and a WhatsApp media path traversal
5. Call POST /api_message with the X-API-KEY header. The token changes when the UI login or password changes

mini-swe-agent

1. Run with -y --exit-immediately for unattended use. Without --exit-immediately it waits for input when the agent finishes
2. Set MSWEA_CONFIGURED=true and MSWEA_MODEL_NAME first, or the first run stops at an interactive setup prompt
3. Read info.exit_status in the -o trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use -c mini.yaml -c environment.environment_class=docker -c environment.image=<image>. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command