AXLR vs Qwen Code

AXLR 80

An OpenAPI 3.1 file for the service (15 paths, 23 schemas, mutualTLS security scheme, additionalProperties: false on request bodies), a checked proto for the gRPC service, and the 19 MCP tools built from the same shared schemas (25). No llms.txt on either site (404), and the docs site renders HTML; the Markdown sources are in the repository (5). The product contract tables what each of the four interfaces can and cannot do, the work-mode table states each mode's purpose and tool policy, the transport parity ledger names every verb's arguments and behaviour, and axlr_tools tells the model to look for a tool before forging one (15). Typed inputs throughout, Idempotency-Key 16 to 128 safe ASCII characters, expected_revision a positive integer, policy levels, sandbox profiles and egress values enumerated, budgets as four integers, and the service rejects unknown fields, invalid types and bodies over 4 MiB (14). Examples in every guide, an error shape of code, message and request_id, named codes (409 idempotency_conflict, 400 invalid_cursor, 422 invalid_policy, invalid_budget, sandbox_unavailable, not_ready, invalid_id), a gRPC status mapping, and the worker's five statuses and three exit codes; no single error reference page (14). /v1 routes and an OpenAPI version of 0.1.0 against a 0.15.0 release, and no changelog beyond the dated notes inside the docs (7). 25+5+15+14+14+7 = 80.

Qwen Code 91

Framework reading. A settings.schema.json in the repository, a settings reference with the type and default of each key, and an OpenAPI file for the daemon's REST API (25). llms.txt on the docs site lists the pages with a line each, though it links to HTML and the Markdown path we tried returned 404 (8). The approval-mode page says when to use each mode and the sandbox page what each method and Seatbelt profile allows (15). Approval modes, sandbox backends, filesystem and network policies are enums (13). The headless page documents json and stream-json output, and exit codes 41, 42, 44, 52, 53, 55 and 130 are documented (15). A dated changelog generated from releases (15).

AXLR 55

Apache-2.0 with a NOTICE (30). No privacy policy or terms on underpassai.com or axlr.underpassai.com; the docs' 'Where data goes' and 'Diagnostics and privacy' sections say that model requests go to OpenRouter, the local server or the native API, that Jev sends text to TypeSafe only when on, that sessions live under $XDG_STATE_HOME/axlr, that payload capture is off by default and redacted when on, and that traces are deleted after 30 days; nothing covers the engine downloads' or the catalog registry's handling of a client's requests (15). No deprecation policy; pre-1.0 changes are dated inline in the docs and the product contract records the 5 October 2026 retirement of the first skill catalogue after the fact (6). No telemetry to disclose, and the docs say in two places what leaves the machine and how to stop payload capture, though no single page says there is no telemetry (17). 30+15+6+17 = 68.

Qwen Code 66

Apache-2.0 (30). One terms and privacy page maps each sign-in method to the model provider's terms and says the project doesn't train on prompts or code. Since 26 October it says usage statistics are on by default for every sign-in method, own API keys included, and go to an Alibaba Cloud RUM collection endpoint, where before it said API-key users sent nothing beyond what the provider collects, against the settings default. It still gives no retention period and names no legal entity (20, was 18). The end of the Qwen OAuth free tier is dated 15 April 2026 and tools.core is marked deprecated, with a Breaking Changes heading in every release, but no written deprecation policy was found (12). Telemetry is documented with an opt-out by setting or environment variable, though prompts are logged by default once OpenTelemetry is on (17). 30 + 20 + 12 + 17 = 79.

AXLR 62

Harness reading of the framework checklist, as for the other four harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry in the console source (the outbound hosts are openrouter.ai, api.anthropic.com, api.openai.com, a configured local server, api.github.com and github.com for engine downloads, and registry.underpassai.com for the signed catalog index) or in the docs; payload capture is off by default since 9 October 2026, traces omit prompts and credentials, model keys are never given to commands or plugins, and Jev sends requests and answers to TypeSafe only when on, which the setup assistant does when TYPESAFE_API_KEY is set, with a notice on stderr (27). Approval cards, a destructive list that always asks, four work modes, a policy level per execution, a bubblewrap or container sandbox with an enforced egress allow list, and a service that approves nothing but reads. Against that, the setup assistant writes autonomous: true, exec_sandbox is off by default, forged tools run with the person's rights, and the README says the console and worker are not sandboxes (13). Forged tools are refused when a file changes since the forge, a policy forbids calls outside the model, and the docs say MCP tools keep their own side effects, but no prompt-injection guidance was found and MCP results reach the model unmarked (6). The service keeps an event journal, audit records, a receipt with the SHA-256 of every call's arguments and outcome, and correlation ids on every event; the console keeps session records, a redacted app log and /session (14). No SECURITY.md, no security.txt on either host, no advisories, no bug bounty; release checksums and a minisign-signed catalog are integrity, not a programme (2). 27+13+6+14+2 = 62.

Qwen Code 53

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Usage statistics are on by default (privacy.usageStatisticsEnabled defaults to true in the settings schema at 0.26.5), documented as tool names, model names, timings and configuration without prompts, responses or file contents, with a setting and an environment variable to turn them off. Credentials are API keys in environment variables or settings.json (15). Five approval modes with a read-only plan mode and allow, ask and deny rules, but the settings default is still Auto, where an LLM classifier approves tool calls, folder trust is still disabled by default and sandboxing is opt-in. Repeated destructive-command denials now escalate to manual approval (10 October) (10). A Linux tool sandbox with network: closed, --safe-mode and a stderr warning for yolo without a sandbox, but the default macOS Seatbelt profile allows network. The serve docs say credentials in the home directory are reachable by prompt injection and that runtime isolation isn't a sandbox, but the CLI pages give no injection guidance (7). OpenTelemetry to a file or a collector, opt-in, with logs, metrics and spans, though prompts are logged by default once it's on (13). SECURITY.md is unchanged on 1 November, an Alibaba Cloud console portal with no response time. Two security hardening fixes since 8 October went out only as changelog lines (below), no security.txt was found, and CodeQL and a monthly scorecard run in CI. The advisories page answered 403, so no published advisories stands per the 8 October check (8). 15 + 10 + 7 + 13 + 8 = 53.

AXLR 79

v0.15.0 on 2026-10-25, with commits on main to 2026-11-01 (30). 21 releases between 4 and 25 October 2026 (20). One maintainer (368 of 399 commits, the rest by two agent accounts), 10 open issues that are his own trackers with no comments, about 100 merged pull requests and no outside report to measure a reply against (15). Not in the MCP registry; the Go module and a proto to generate clients from are the only client code, beside the GHCR image and Helm chart (5). Go 1.26 toolchain pinned, release actions pinned by commit SHA, a go-licenses check that the third-party bundle matches the dependency graph, and CI passing on main (9). 30+20+15+5+9 = 79.

Qwen Code 88

0.26.5 on 1 November 2026 (30). 39 stable releases from 3 August to 1 November (v0.21.4 to v0.26.5), plus previews and nightlies (20). Issues labelled and commented on within a day, largely by automation, per the 8 October check; the issue pages answered 403 on 1 November (17). The TypeScript SDK reached 0.1.26 on 29 October, while the Python SDK's newest tag is still sdk-python-v0.1.0-preview.0 (9 May 2026) and the Java SDK is an alpha (11). CI, CodeQL, a monthly scorecard and Dependabot (10). 30 + 20 + 17 + 11 + 10 = 88.