Claude Code vs mini-swe-agent

Claude Code

Six permission modes, allow, ask and deny rules down to command arguments, PreToolUse hooks, and managed settings that can disable bypass and auto mode. The sandbox is off by default and native Windows has none.

mini-swe-agent

A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

Claude Code

1. Pass --permission-mode, --max-turns and --max-budget-usd on every claude -p run. The unset mode changed again in 2.1.302, and the docs page still gives the older rule
2. Turn on the sandbox with sandbox.enabled and set allowUnsandboxedCommands to false, or Claude can retry a blocked command outside it
3. Write MCP allow rules as mcp__<server>__* with the server's whole name. Since 2.1.299 a rule for mcp__a no longer covers a server named a__b
4. Set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 on a Claude login to stop metrics and error reports in one go
5. Set autoUpdatesChannel to stable or DISABLE_AUTOUPDATER=1 in CI. Native installs update themselves about once a day

mini-swe-agent

1. Run with -y --exit-immediately for unattended use. Without --exit-immediately it waits for input when the agent finishes
2. Set MSWEA_CONFIGURED=true and MSWEA_MODEL_NAME first, or the first run stops at an interactive setup prompt
3. Read info.exit_status in the -o trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use -c mini.yaml -c environment.environment_class=docker -c environment.image=<image>. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command