Auggie CLI vs Traycer

Auggie CLI 38

Graded on the stable line, as the brief asks. 0.36.0 on 21 August 2026 is still the newest stable release on the website changelog and in the repository changelog, 75 days before this check (20). In the 90 days from 6 August 2026 the stable line has two dated releases, 0.35.0 on 13 August and 0.36.0 on 21 August. The 1.2.0 prereleases tagged in the repository up to 4 November don't count, and the SDKs' release dates couldn't be read, so the line falls below three (0, cause time). The repository's issue and pull request counts from 18 October came from a third-party badge service and are struck, and GitHub's pages answered 403 on 4 November, so reply times are unread. A support portal, a subreddit and a dated website changelog. Earlier partial value kept and flagged (6). TypeScript SDK 0.2.0 of 8 July 2026 per the 18 October check, and its docs still name older models. The Python SDK's version couldn't be read (8). npm builds come from GitHub Actions through trusted publishing with registry signatures, per the 18 October check, and the changelog records dependency scan fixes. No public CI for the CLI (4). 20+0+6+8+4 = 38.

Traycer 75

Commits on 6 November 2026 and host 1.5.3 (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current apps and CLI packages (15). CI with tests (10). 30 + 20 + 0 + 15 + 10 = 75.

Auggie CLI 43

Local-package reading, as for the other closed-source harnesses. The official npm package with macOS, Linux and WSL stated, but the README asks for Node 22 or later while the docs and the package engines say Node 20, so 2 are held back (18). No public CI or test suite, since the source isn't published. The repository holds docs, examples and issues, not the CLI (0). Open crash or regression issues couldn't be counted. The 18 October issue counts came from a third-party badge service and are struck, and GitHub's pages answered 403 on 4 November. Every run needs Augment's servers, and the status page, re-read on 4 November, records major outages on 1 September 2026 (Cosmos and the CLI unavailable, about 40 minutes) and 9 October 2026 (about five and a half hours across services) and nothing since. The earlier partial value is kept and flagged (5). A changelog by version with fixes and improvements in sections, dated release notes on the website, and a 1.x guide with a breaking-changes section, though the repository changelog carries no dates (10). The guide, re-read on 4 November, still calls the latest 0.x channel the current stable line for production, while 1.x is in preview. Judgement call (10). 18+0+5+10+10 = 43.

Traycer 65

Local software. Builds for macOS, Linux and Windows, and package-manager publishing workflows (20). test.yml, CodeQL, OpenSSF Scorecard and secret scanning run on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). CHANGELOG.md (15). Host 1.5.3 (15). 20 + 15 + 0 + 15 + 15 = 65.

Auggie CLI 20

Harness reading of the published rubric, scored on the Augment subscription the CLI needs. The self-hosted rule doesn't apply. No payment protocol (0). Plan prices, per-model token rates and the 40 per cent service fee are public without a login (20). No free tier was found on the pricing page. The terms mention trials by order (0). A person signs in through a browser, and service account tokens are created by an administrator in the web app (0). 0+20+0+0 = 20.

Traycer 30

Scored on the paid option, Traycer's own inference subscription, whose price wasn't read (0 of 20). No protocol (0). Bring-your-own-agent use is free (20). Accounts for sync and teams weren't checked, half (10). 0 + 0 + 20 + 10 = 30.

Auggie CLI 47

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines as for the other harnesses. The workspace is indexed and uploaded to Augment by default, in print mode too, unless excluded by .gitignore or .augmentignore. A telemetry endpoint is listed with no description or opt-out found. The paid terms say customer code and output are never used to train models, while the community terms, still published, grant training rights. Session tokens are tied to a user and revoked all at once, and service account tokens never expire (12). Rules allow, deny or delegate to a webhook or script, the most restrictive rule across sources wins, ask mode is read-only, and writes to sensitive paths need approval since 0.34.0. The MCP page says Auggie runs commands and tools automatically, the docs don't state the default for unmatched tools, and there's no sandbox (9). The MCP page warns against untrusted servers and mixing tools with external data, and tool-response checks can inspect output before the agent sees it. No network control was found (6). Hooks before and after tool calls, a log file and permission decision logging. Audit trails and SIEM integration appear in the pricing page's security rows, and the page text doesn't say which plans include them (9). A disclosure address and GitHub private reporting in SECURITY.md, SOC 2 Type II and ISO/IEC 42001 named. No security.txt and no bug bounty found. On 4 November osv.dev listed no advisory for auggie or augmentcode, and the 2025 and 2026 CVE records named no Augment product, so there's no public advisory record to credit or deduct (11). 12+9+6+9+11 = 47.

Traycer 42

Harness reading. Code is processed in memory and not used for training, but Privacy Mode is opt-in for individuals, prompts may be logged with it off, and Sentry and PostHog 'may be enabled in release builds' (10 of 30). No approval model described in the README (8 of 20). No prompt-injection guidance (5). No audit log found (5). SECURITY.md, CodeQL, Scorecard and secret scanning (14 of 20). 10 + 8 + 5 + 5 + 14 = 42.