AXLR vs HarnessRouter

AXLR 70

Read as a local package, as claude-code, goose, opencode and openhands were. Release archives for Linux, macOS and Windows on amd64 and arm64 with a .sha256 beside each, a GHCR image, an OCI Helm chart and source builds with Go 1.26, all stated in the docs; no Homebrew, npm or apt route (20). CI on main runs vet, race tests and a coverage gate above 80 per cent for both modules, with the sandbox tests required under bubblewrap, and the last ten runs on main to 1 November 2026 all passed; the release workflow tests on six native runners (25). 10 open issues, all opened by the founder on 19 and 21 October 2026 as trackers for service work (work modes, plugins, the sandbox setting, cost limits), none from an outside user and none a crash report, 0 open pull requests and about 100 merged; with 0 stars there is nobody else to report, so the handling of outside reports is untested (20). Tags are semver 0.x and the docs date each behaviour change inline ("until 14 October 2026…"), but the 21 releases have empty notes, there is no CHANGELOG.md, and the product contract records one retirement (the seven 1.0 skill definitions on 5 October 2026) without a notice period (5). Pre-1.0, which the README calls an evolving project (0). 20+25+20+5+0 = 70.

HarnessRouter 35

Hosted reading, for HarnessRouter Cloud at api.harnessrouter.ai. No status page (status.harnessrouter.ai doesn't resolve and harnessrouter.ai/status answers 404), so 0 for the page and 5 for an unreadable incident record. No request rate limit with numbers was found. The pricing page states one task at a time on Free, unlimited concurrency on plans with brief queueing and a 30-minute or 1-hour task limit on Free, so 5 of 15. 429 is in the error table as rate_limited with Retry-After (UHP Errors §3), quota_exhausted is marked not worth retrying, and every task call takes an Idempotency-Key with a rule to recover the session rather than resend after a dropped stream (15). Terms §5.4 give no service level outside a signed order form (0). The task API isn't labelled beta, while tracing and agent memory are, and the protocol is a draft standard (10). 35 in all.

AXLR 60

No payment protocol (0). Free and Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines by the self-hosted rule, since the docs say what you pay your model provider, the free route needs no card, and it runs local models with no signup at all, the JSON worker without any model. 0+20+20+20 = 60.

HarnessRouter 25

Published rubric, for the hosted service. No machine payment protocol (0). Per-unit prices without a login, agent work per active minute and model calls at listed provider prices per million tokens (20). The Free plan needs no card, but it only configures agents, and running a task draws on card-funded credit, so 5 of 20. A person signs up in a browser and creates the key in the console (0). 25 in all. Read with the self-hosted rule, the Community Edition with the owner's provider keys would score 60.

AXLR 55

Apache-2.0 with a NOTICE (30). No privacy policy or terms on underpassai.com or axlr.underpassai.com; the docs' 'Where data goes' and 'Diagnostics and privacy' sections say that model requests go to OpenRouter, the local server or the native API, that Jev sends text to TypeSafe only when on, that sessions live under $XDG_STATE_HOME/axlr, that payload capture is off by default and redacted when on, and that traces are deleted after 30 days; nothing covers the engine downloads' or the catalog registry's handling of a client's requests (15). No deprecation policy; pre-1.0 changes are dated inline in the docs and the product contract records the 5 October 2026 retirement of the first skill catalogue after the fact (6). No telemetry to disclose, and the docs say in two places what leaves the machine and how to stop payload capture, though no single page says there is no telemetry (17). 30+15+6+17 = 68.

HarnessRouter 73

Editorial half. The server, specification, schema and conformance suite are Apache-2.0. The Cloud's own billing and deployment wasn't confirmed to match the open code, and the Agent Skill has a custom licence for some guides (25 of 30). The privacy policy, DPA, subprocessor list and a retention page agree. Customer content isn't used for training without an opt-in, and periods are stated (tasks deleted at once, agents and files after 30 days, backups within 14 days, credentials within 90, free-plan task records 7 days). The privacy policy gives no periods of its own (24 of 30). UHP's versioning page says how a field is deprecated and that the previous version SHOULD be supported for six months. No dated product deprecation notices found (14 of 20). Subprocessors listed with purpose and location (Azure, Stripe, Vercel, Supabase, all United States), but the routing and inference gateway provider is named only on request (15 of 20). 78 in all.

AXLR 83

Harness reading of the framework line, scored on what a program driving it has to supply. Six local tools plus the host's bookkeeping tools; work modes and an execution policy hide the tools a run may not use, axlr_catalog searches the catalog instead of loading it, forged tools keep the request prefix for the prompt cache, and a context cap of 75,000 prompt tokens opens a successor session (20). local_read, local_search and local_list page with offset, next_offset and max_bytes; StreamEvents takes after, max_events (1 to 256) and wait_ms; a budget per execution in seconds, requests, tool calls and dollars; 32 tool calls a turn and max_session_usd (20). The --exec run ends in one result line with a status, the pending call, every call's outcome and the usage, and exits 0, 3 or 1; service errors carry codes an agent can act on; a budget stop says which limit (budget: requests 20 reached) and leaves the session resumable (16). Idempotency-Key on every turn, approval and direct call with cross-transport replay, expected_revision on decisions, expected_sha256 on worker writes, and an interrupted effectful call left uncertain for an operator rather than retried (19). One command runs a task, but the first launch needs an OpenRouter key or a local server, the service needs a CA, a principals file and remote KMP and MADE before a first session, and the only SDK is the Go library (8). 20+20+16+19+8 = 83.

HarnessRouter 73

API reading. Sessions, turns and files are separate reads, and list endpoints take limit and cursor, but there's no field selection on a response (15 of 25). Cursor paging on session and memory lists with a bounded limit, and few filters found (14 of 20). One error envelope with type, code, param and detail, a closed code set, a retry rule per code and a 422 that lists every failed field without echoing the body (18 of 20). Idempotency-Key on task creation, reuse only for the same request, recover from the session after a drop, and an explicit cancel because closing the stream doesn't stop work (18 of 20). Only input is required to run a task, and budgets default to 400 steps, 7,200 seconds and $10. No official SDK, only the OpenAI Responses shape, clients generated from the OpenAPI file and an Agent Skill (8 of 15). 73 in all.

AXLR 79

v0.15.0 on 2026-10-25, with commits on main to 2026-11-01 (30). 21 releases between 4 and 25 October 2026 (20). One maintainer (368 of 399 commits, the rest by two agent accounts), 10 open issues that are his own trackers with no comments, about 100 merged pull requests and no outside report to measure a reply against (15). Not in the MCP registry; the Go module and a proto to generate clients from are the only client code, beside the GHCR image and Helm chart (5). Go 1.26 toolchain pinned, release actions pinned by commit SHA, a go-licenses check that the third-party bundle matches the dependency graph, and CI passing on main (9). 30+20+15+5+9 = 79.

HarnessRouter 72

Open-source reading of the repository behind the hosted service. Last tag v0.34.2 on 16 October 2026 (30). 202 tags between 15 August and 16 October (20). GitHub's issue pages and API refused this session, so open issues and reply times are unchecked. Pull requests from at least ten outside authors were merged in the 30 days to 17 October, by the git history (15 of 25). No official SDK and no MCP server to register (0). A tests workflow runs every suite on each pull request and push to main, with a release workflow and a Docker image, but whether the default branch passes is unchecked (7 of 10). 72 in all.