AXLR vs Qoder CLI

AXLR 60

No payment protocol (0). Free and Apache-2.0 with nothing to buy, so 20, 20 and 20 on the last three lines by the self-hosted rule, since the docs say what you pay your model provider, the free route needs no card, and it runs local models with no signup at all, the JSON worker without any model. 0+20+20+20 = 60.

Qoder CLI 35

Harness reading of the published rubric, scored on the Qoder subscription the CLI needs. No payment protocol (0). Plan prices, the Credit Pack price ($20 for 1,500 credits) and per-model credit factors are public in the docs without a login. qoder.com/pricing is disallowed by robots.txt and wasn't read (20). A Free plan with basic models for a limited number of messages and a 14-day Pro trial with 300 credits. We found no statement on whether a card is needed (15). A person signs in through a browser, and a PAT is created by hand at qoder.com/account/integrations (0). 0+20+15+0 = 35.

AXLR 70

Read as a local package, as claude-code, goose, opencode and openhands were. Release archives for Linux, macOS and Windows on amd64 and arm64 with a .sha256 beside each, a GHCR image, an OCI Helm chart and source builds with Go 1.26, all stated in the docs; no Homebrew, npm or apt route (20). CI on main runs vet, race tests and a coverage gate above 80 per cent for both modules, with the sandbox tests required under bubblewrap, and the last ten runs on main to 1 November 2026 all passed; the release workflow tests on six native runners (25). 10 open issues, all opened by the founder on 19 and 21 October 2026 as trackers for service work (work modes, plugins, the sandbox setting, cost limits), none from an outside user and none a crash report, 0 open pull requests and about 100 merged; with 0 stars there is nobody else to report, so the handling of outside reports is untested (20). Tags are semver 0.x and the docs date each behaviour change inline ("until 14 October 2026…"), but the 21 releases have empty notes, there is no CHANGELOG.md, and the product contract records one retirement (the seven 1.0 skill definitions on 5 October 2026) without a notice period (5). Pre-1.0, which the README calls an evolving project (0). 20+25+20+5+0 = 70.

Qoder CLI 51

Local-package reading, the same as the other closed-source harnesses. An install script for macOS, Linux and Windows on arm64 and amd64 that checks a SHA-256 from a manifest on the same download host, and an npm package with Node.js 20 or later stated (20). No public CI or test suite, since no source is published (0). We found no public issue tracker for the CLI. The forum's bug-reports category, shared by every Qoder product, had 116 new topics in the month to 18 October, and 15 of the 29 topics on its first page had no reply. A few named the CLI (8). Versions are semver-shaped and every release is dated in the release notes, but removals such as /goal take in 1.1.11 shipped in patch versions without a breaking-change label (8). 1.0.0 on 20 May 2026, now 1.1.73 (15). 20+0+8+8+15 = 51.

AXLR 62

Harness reading of the framework checklist, as for the other four harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry in the console source (the outbound hosts are openrouter.ai, api.anthropic.com, api.openai.com, a configured local server, api.github.com and github.com for engine downloads, and registry.underpassai.com for the signed catalog index) or in the docs; payload capture is off by default since 9 October 2026, traces omit prompts and credentials, model keys are never given to commands or plugins, and Jev sends requests and answers to TypeSafe only when on, which the setup assistant does when TYPESAFE_API_KEY is set, with a notice on stderr (27). Approval cards, a destructive list that always asks, four work modes, a policy level per execution, a bubblewrap or container sandbox with an enforced egress allow list, and a service that approves nothing but reads. Against that, the setup assistant writes autonomous: true, exec_sandbox is off by default, forged tools run with the person's rights, and the README says the console and worker are not sandboxes (13). Forged tools are refused when a file changes since the forge, a policy forbids calls outside the model, and the docs say MCP tools keep their own side effects, but no prompt-injection guidance was found and MCP results reach the model unmarked (6). The service keeps an event journal, audit records, a receipt with the SHA-256 of every call's arguments and outcome, and correlation ids on every event; the console keeps session records, a redacted app log and /session (14). No SECURITY.md, no security.txt on either host, no advisories, no bug bounty; release checksums and a minisign-signed catalog are integrity, not a programme (2). 27+13+6+14+2 = 62.

Qoder CLI 55

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Browser sign-in with background refresh, or a PAT created with chosen permissions and an expiry and revocable, plus scoped service accounts for organisations. Usage statistics and AI code statistics are on by default with documented opt-outs, and the privacy policy lets users turn off Share & Improve depending on the plan, without saying which plans or the default (18). Five permission modes, deny over ask over allow across seven rule layers, ask turned into deny in headless runs, a dont_ask mode, trusted directories, protected paths and an administrator switch that disables YOLO. No local sandbox is documented, and auto mode lets an AI classifier decide and approves read-only tools on any path (14). Workspace files can't add auto-mode rules, protected paths stop the agent changing shell startup files or .mcp.json without approval, and network paths always ask on Windows. A project's .qoder/settings.json is still one of the rule layers, and nothing contains a command once approved (9). The enterprise audit log records administrative and configuration events for administrators and says it leaves out prompts, terminal commands, MCP call parameters and CLI execution, and individuals have local session history only (5). qoder.com/enterprise says Qoder is certified to ISO/IEC 27001 and has completed a SOC 2 Type II audit. No security.txt, disclosure policy or bug bounty was found, and fixes appear as one-line release notes without advisories (9). 18+14+9+5+9 = 55.

AXLR 79

v0.15.0 on 2026-10-25, with commits on main to 2026-11-01 (30). 21 releases between 4 and 25 October 2026 (20). One maintainer (368 of 399 commits, the rest by two agent accounts), 10 open issues that are his own trackers with no comments, about 100 merged pull requests and no outside report to measure a reply against (15). Not in the MCP registry; the Go module and a proto to generate clients from are the only client code, beside the GHCR image and Helm chart (5). Go 1.26 toolchain pinned, release actions pinned by commit SHA, a go-licenses check that the third-party bundle matches the dependency graph, and CI passing on main (9). 30+20+15+5+9 = 79.

Qoder CLI 72

1.1.73 on 16 October 2026 (30). 74 dated CLI versions between 20 July and 16 October 2026 (20). No public issue tracker. A Discourse forum with bug-report and feature-request categories, where 15 of the 29 bug reports on the first page had no reply when read on 18 October (7). Current official SDKs, @qoder-ai/qoder-agent-sdk 1.0.53 on 15 October and qoder-agent-sdk 1.0.15 on PyPI on 23 September 2026 (12). No public CI. npm versions carry registry signatures and the install script checks a SHA-256 (3). 30+20+7+12+3 = 72.

AXLR 55

Apache-2.0 with a NOTICE (30). No privacy policy or terms on underpassai.com or axlr.underpassai.com; the docs' 'Where data goes' and 'Diagnostics and privacy' sections say that model requests go to OpenRouter, the local server or the native API, that Jev sends text to TypeSafe only when on, that sessions live under $XDG_STATE_HOME/axlr, that payload capture is off by default and redacted when on, and that traces are deleted after 30 days; nothing covers the engine downloads' or the catalog registry's handling of a client's requests (15). No deprecation policy; pre-1.0 changes are dated inline in the docs and the product contract records the 5 October 2026 retirement of the first skill catalogue after the fact (6). No telemetry to disclose, and the docs say in two places what leaves the machine and how to stop payload capture, though no single page says there is no telemetry (17). 30+15+6+17 = 68.

Qoder CLI 61

Proprietary, with clear terms from BRIGHT ZENITH PRIVATE LIMITED under Singapore law, and the SDK's LICENSE points to the same terms (15). The privacy policy lists purposes with retention for each (mostly for as long as the account exists), names storage in the United States, Singapore and Japan and names model providers. The terms let the operator use User Content to improve the Services unless Share & Improve is turned off, and the policy says the opt-out depends on the plan. No subprocessor list or DPA was found (14). Dated notices with two weeks' warning for the Lite tier removal (4 to 18 September 2026) and for the credit factor change on 21 September, but no stated deprecation policy (8). Usage statistics and AI code statistics are disclosed as settings with an opt-out, both on by default, and the installer's telemetry isn't described (14). 15+14+8+14 = 51.