Claude Code vs Conductor

Claude Code 91

Framework reading, adapted to a harness driven by a pipeline. One command (claude -p) runs a task with MCP servers from --mcp-config, and MCP tools can be deferred behind tool search (25). --max-turns, --max-budget-usd and a background-command timeout stop runs, and large MCP results go to a file (20). json and stream-json output, -p errors name the cause, and since 2.1.318 -p JSON results carry credential_expires_at and a timed-out claude.ai login names claude auth login and claude setup-token (16). --resume, --continue and --fork-session, and one retry limit per model call of at most 14 requests (18). Python and TypeScript Agent SDKs. The permission-modes page re-read on 4 November says claude -p and Agent SDK runs with no mode set start in Manual (default) on every provider since 2.1.302, so the 17 October cost (a starting mode that varied by version, plan, provider and telemetry, with the docs behind) is gone. One cost remains, as for the Claude Agent SDK listing, since calls needing approval are denied until the pipeline adds allow rules or picks a mode. Judgement call. Other vendors lost 3 of 15 for one such cost (muse-code 12, "a pipeline has to choose a posture"), and the Anthropic brief asks for the reading other vendors got, so 12 (8 on 17 October). Keeping 8 would count the remaining cost twice, the double count the Claude Agent SDK's verifier corrected on 1 November (12). 25 + 20 + 16 + 18 + 12 = 91.

Conductor 55

Harness reading. Each task gets a workspace, branch, terminal and diff, with pull requests and merges from the app, and an API for integrations; not re-read in detail (55).

Claude Code 80

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. The data-usage page, re-read on 4 November, says usage metrics are on by default on the Claude API without code, prompts or file paths, error reports are on by default for Pro, Max and Ultra sign-ins since v2.1.198, /feedback reports are on, session quality surveys run on every provider, and every provider sends WebFetch hostnames to api.anthropic.com for a blocklist check, each with an opt-out. Metrics, error reports and /feedback are off by default on Bedrock, Google Cloud, Foundry and Claude Platform on AWS unless a host sets CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST (18). Six modes, allow, ask and deny rules, protected paths, and managed settings that can disable bypass and auto mode. 2.1.314 added permissions.blockWritesOutsideWorkingDirectories. The sandbox is opt-in and absent on native Windows, and auto mode, a classifier rather than a person, is the built-in starting mode for terminal and VS Code sessions on 2.1.283 or later, per the permission-modes page re-read on 4 November; sandboxing per 17 October (16). The auto-mode classifier blocks named exfiltration patterns, the sandbox proxy denies hosts outside an allowlist that starts empty, and WebFetch checks a blocklist, but since 1 October 2026 a mod can approve a call a deny rule refuses unless managed settings or a Team or Enterprise sign-in hold it (11). Opt-in OpenTelemetry with tool content behind OTEL_LOG_TOOL_CONTENT, local transcripts for 30 days, and cloud sessions logged through a proxy; 2.1.317 adds plan, seat type and provider attributes (15). HackerOne bug bounty and SECURITY.md (unchanged since 15 May 2026 in the clone), advisories published with GHSA ids, the newest in GitHub's reviewed database GHSA-pq7j-f95f-qfcv (High, 15 October; OSV holds 29 for the package on 4 November, none newer), and anthropic.com's security.txt valid to 31 December 2026, re-read on 4 November (20). 18 + 16 + 11 + 15 + 20 = 80. SOC 2 isn't scored on the framework reading. Advisories and the changelog-only sandbox and permission fixes count under negative events. Judgement call, written by an agent on Claude, on the same checklist the other harnesses got.

Conductor 45

Closed app. Telemetry and data handling weren't read beyond the transition notice (10 of 30). A security and permissions page (10 of 20). No prompt-injection guidance found (5). No audit log found (5). SOC 2 Type II report at trust.conductor.build (15 of 20). 10 + 10 + 5 + 5 + 15 = 45.

Claude Code 81

Closed source with clear terms, LICENSE.md pointing to the Commercial Terms, unchanged in the clone on 4 November (15). The data-usage page, re-read on 4 November, states retention per account type (consumer 30 days or 5 years with training on, commercial 30 days, zero retention for qualified Enterprise), 30 days of plaintext local transcripts, 5 years for /feedback reports and up to 6 months for shared survey transcripts, and these agree with the privacy policy links, but the logging and error-tracking services are named only as third parties. The page still doesn't say that since 2.1.300 local transcripts also record each API request's system prompt, tools and parameters, read as an omission rather than a contradiction (25). No written deprecation policy. The README still marks npm installs deprecated without a date. 2.1.316 gives Claude Code's first dated advance notice of its own, fast mode for Opus 4.8 deprecated on 30 October and removed on 30 November 2026, 31 days' notice. Judgement call. One dated notice and no policy; we kept 8, the stricter reading, and crediting the notice would give 10 and transparency 70 (8). Telemetry is documented per provider and per service with an opt-out for each, re-read on 4 November (20). 15 + 25 + 8 + 20 = 68.

Conductor 53

Closed service with terms and privacy pages (15). The transition notice says when Cloud data deletion begins (20 November) and that all user data is deleted when the app shuts down in early 2027 (20 of 30). Dated shutdown notice (15 of 20). SOC 2 report on a trust portal, subprocessors not read (10 of 20). 15 + 20 + 15 + 10 = 60.

Claude Code 50

Local-package reading. Official installers for macOS 13+, Windows 10 1809+, Ubuntu 20.04+, Debian 10+ and Alpine 3.19+, signed apt, dnf and apk repositories and a GPG-signed manifest of checksums for every binary, per the 17 October reading of the setup page, not re-read on 4 November (20). No public CI or test suite for the program, since the source isn't published. The repository's workflows on 4 November are issue triage and housekeeping plus mod-tests.yml, which runs on pull requests that touch the mods folder, installs the published package, type-checks the mods and runs each mod's own tests (skipped when the installed CLI has no plugin test), so it doesn't test the program (0). Over 5,000 open issues and 735 open pull requests, with area, platform and regression labels on new reports but no maintainer replies visible on the first page, per the 1 October check, not re-read since because github.com answers our proxy with 403 (10). Every change still ships as a 2.1.x patch with no breaking-change heading. 2.1.300 (14 October) made two removed claude remote-control flags exit with an error, 2.1.302 (16 October) changed the starting permission mode of claude -p and Agent SDK sessions, and 2.1.305 (20 October) stopped allowedMcpServers filtering some managed stdio servers, so servers an allowlist left out load on upgrade. A stable channel skips releases with major regressions (5). 2.1.318, so 1.0 or later (15). 20 + 0 + 10 + 5 + 15 = 50. Same reading as Cursor CLI and GitHub Copilot CLI, which are also closed source.

Conductor 25

Read as local software that is winding down. Installed from Conductor's own download, which stopped taking new users on 4 November 2026 (10). Closed source, so no public CI or issue tracker (0, 0). A dated changelog, newest 0.93.0 on 4 November (15). Version 0.93 (0). 10 + 0 + 0 + 15 + 0 = 25.

Claude Code 82

2.1.318 on 4 November 2026 (feed.xml 00:00:44 UTC, tag v2.1.318), not confirmed on npm because registry.npmjs.org didn't resolve and the fallback waited on an approval prompt (30). 81 release tags in the 90 days from 6 August (v2.1.223 on 6 August to v2.1.318), from the clone (20). A public issue tracker with automatic triage, duplicate detection and labels, but over 5,000 open issues and no visible maintainer replies on the page we read, per the 1 October check, not re-read since (12). The Python and TypeScript Agent SDKs that run the same loop are current, Python 0.2.176 and TypeScript 0.3.316 tagged 31 October, per the Claude Agent SDK listing's 1 November check (15). Signed releases and a stable channel, but no public CI for the program (5). 30 + 20 + 12 + 15 + 5 = 82.

Conductor 58

0.93.0 on 4 November 2026 (30). Several dated releases in 90 days, per the changelog index (20). Discord, a subreddit and email for support (8). Closed app, no package or CI to read (0). 30 + 20 + 8 + 0 + 0 = 58. The local app gets new models and critical fixes only until early 2027.

Claude Code 80

Framework reading. No published JSON Schema for settings that we checked (per the 1 October check, not re-read), but the settings reference types every key, and the stream-json output has typed message classes in the Python and TypeScript Agent SDKs (18). llms.txt at code.claude.com/docs/llms.txt with a Markdown version of each page; code.claude.com's robots.txt carries Content-Signal ai-train=yes, search=yes, ai-input=yes (10). The permission-mode table says what each mode is best for and, re-read on 4 November, now gives default as the starting mode for claude -p and the Agent SDK, matching 2.1.302. The rules still carry many version-specific exceptions (mods, protected paths, carve-outs by settings source) that a model has to read closely. Judgement call. The page catching up removes the reason given on 17 October but not the one given before it, so the line stays at 15 rather than rising; the lighter reading gives 17 and schema 82 (15). Permission modes, sandbox settings and rule syntax are enumerated, though rules are strings parsed at runtime (12). Examples on every page and a troubleshooting section for install and auth errors (13). A changelog for every release. CHANGELOG.md in the repository has no dates, feed.xml dates the latest 20 (2.1.318 at 00:00 UTC on 4 November), and the code.claude.com changelog page dated every release on 17 October. Breaking changes still aren't marked (12). 18 + 10 + 15 + 12 + 13 + 12 = 80.

Conductor 60

Harness reading. Docs for workspaces, review and merge, a Conductor API reference page linked from the docs (not read), and security and permissions pages (60).