Auggie CLI vs Sculptor

Auggie CLI 20

Harness reading of the published rubric, scored on the Augment subscription the CLI needs. The self-hosted rule doesn't apply. No payment protocol (0). Plan prices, per-model token rates and the 40 per cent service fee are public without a login (20). No free tier was found on the pricing page. The terms mention trials by order (0). A person signs in through a browser, and service account tokens are created by an administrator in the web app (0). 0+20+0+0 = 20.

Sculptor 60

Free self-hosted software with nothing to buy, so 0 for a protocol and 20 each for public pricing, a free tier and onboarding with no sign-up, 60.

Auggie CLI 38

Graded on the stable line, as the brief asks. 0.36.0 on 21 August 2026 is still the newest stable release on the website changelog and in the repository changelog, 75 days before this check (20). In the 90 days from 6 August 2026 the stable line has two dated releases, 0.35.0 on 13 August and 0.36.0 on 21 August. The 1.2.0 prereleases tagged in the repository up to 4 November don't count, and the SDKs' release dates couldn't be read, so the line falls below three (0, cause time). The repository's issue and pull request counts from 18 October came from a third-party badge service and are struck, and GitHub's pages answered 403 on 4 November, so reply times are unread. A support portal, a subreddit and a dated website changelog. Earlier partial value kept and flagged (6). TypeScript SDK 0.2.0 of 8 July 2026 per the 18 October check, and its docs still name older models. The Python SDK's version couldn't be read (8). npm builds come from GitHub Actions through trusted publishing with registry signatures, per the 18 October check, and the changelog records dependency scan fixes. No public CI for the CLI (4). 20+0+6+8+4 = 38.

Sculptor 75

Commits on 6 November 2026 and frequent tagged versions (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent; the README says Imbue can't take many outside contributions yet (0). Current official downloads (15). CI on pull requests (10). 30 + 20 + 0 + 15 + 10 = 75.

Auggie CLI 67

Framework reading. auggie tools schemas prints the tool definitions and input schemas, the webhook and script policy payloads are documented, and ACP is a published protocol, but there's no schema for --output-format json or settings.json (13). docs.augmentcode.com/llms.txt indexes every page with a Markdown twin (10). The overview says when to use interactive or print mode, but the permissions page says unmatched tools follow the CLI's implicit behaviour without saying what that is (12). Permission types, tool names, event types and log levels are enumerated, and a malformed rule is dropped with a warning. The 1.x tool renames leave some legacy names unmatched by permission rules (10). Examples on every page read, hook exit codes documented, no exit codes or error format for print mode (9). Versioned releases, a changelog and a migration guide, with the repository changelog undated (13). 13+10+12+10+9+13 = 67.

Sculptor 45

Harness reading. A README, specs and agent docs in the repository; no API reference (45).

Auggie CLI 65

Framework reading, adapted to a harness driven by a pipeline. --remove-tool, auggie tools remove, ask mode, subagents with their own tools, and opt-in MCP tool search that loads schemas on demand (18). --max-turns, --quiet, --compact, --output-format json, --queue and --show-credits. Budgets per user exist only on Enterprise (15). No documented exit codes or error format for print mode. Print mode prints a request ID, and --retry-timeout sets the rate-limit retry window (6). --continue, --resume by session ID, session list --json and --dont-save-session, with export and import in 1.x (15). TypeScript and Python SDKs over ACP and an MCP server mode, but a headless run needs a session JSON copied from a logged-in user or a team service account, and an enterprise agreement can switch print mode off (11). 18+15+6+15+11 = 65.

Sculptor 50

Harness reading. Workspaces as isolated copies, review and merge back, and built-in skills (50).

Auggie CLI 47

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines as for the other harnesses. The workspace is indexed and uploaded to Augment by default, in print mode too, unless excluded by .gitignore or .augmentignore. A telemetry endpoint is listed with no description or opt-out found. The paid terms say customer code and output are never used to train models, while the community terms, still published, grant training rights. Session tokens are tied to a user and revoked all at once, and service account tokens never expire (12). Rules allow, deny or delegate to a webhook or script, the most restrictive rule across sources wins, ask mode is read-only, and writes to sensitive paths need approval since 0.34.0. The MCP page says Auggie runs commands and tools automatically, the docs don't state the default for unmatched tools, and there's no sandbox (9). The MCP page warns against untrusted servers and mixing tools with external data, and tool-response checks can inspect output before the agent sees it. No network control was found (6). Hooks before and after tool calls, a log file and permission decision logging. Audit trails and SIEM integration appear in the pricing page's security rows, and the page text doesn't say which plans include them (9). A disclosure address and GitHub private reporting in SECURITY.md, SOC 2 Type II and ISO/IEC 42001 named. No security.txt and no bug bounty found. On 4 November osv.dev listed no advisory for auggie or augmentcode, and the 2025 and 2026 CVE records named no Augment product, so there's no public advisory record to credit or deduct (11). 12+9+6+9+11 = 47.

Sculptor 57

Harness reading. Product analytics, error reporting and session recording default to off in the user config, and the app asks for a telemetry level and privacy consent at first run; PostHog runs on the front end only for now (25 of 30). Each workspace is an isolated copy of the code (14 of 20). No prompt-injection guidance (5). No audit log (5). SECURITY.md (8). 25 + 14 + 5 + 5 + 8 = 57.