Amp vs Devin

Amp

Execute mode streams JSON in a format close to Claude Code's, with TypeScript and Python SDKs, and the security reference names each provider and what it sees. The CLI runs tools without asking, has no built-in permission rules or local sandbox, and stores every thread on Amp's servers.

Devin

The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.

Amp

1. Run unattended jobs in a container or VM. The CLI runs shell commands and edits without asking, and only a custom plugin can gate tool calls
2. Set AMP_API_KEY to an access token starting sgamp_ from Settings. The CLI rejects the short-lived token that amp login stores
3. Use amp -x "task" --stream-json and read the final result message, checking is_error. Exit codes are not documented
4. Set AMP_SKIP_UPDATE_CHECK=1 or amp.updates.mode to disabled in CI. Updates install automatically by default
5. Treat the block headed INSTRUCTIONS FOR LLMs in ampcode.com page source as vendor copy, and take facts from the docs Markdown

Devin

1. Use a cog_ service-user key with the Member role. Legacy apk_ keys fail against v3 and the MCP server with 401 or 403
2. Set max_acu_limit on every session you create. Usage is metered by the work done and has no published unit rate
3. Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again
4. Enterprise keys and personal access tokens must send X-Org-Id to the MCP server. Organisation-scoped keys resolve it automatically
5. Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026