Clawboo vs Cline

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Cline 85

CLI 3.0.68 on 2026-10-01 and extension 4.1.22 on 2026-09-29 (30). 29 extension releases and 34 CLI releases since 2026-07-03 (20). Issues get platform labels, but about 700 open issues and 525 open pull requests sit beside a stale bot, and the newest issue we could see was from 23 July, so we couldn't judge reply times (13). VS Code Marketplace, JetBrains, npm and desktop builds are current, while the SDK packages are 0.0.x (13). CI passes, Dependabot runs, and npm publishing moved to OIDC trusted publishing after the February token compromise (9).

Clawboo 52

Read as local software. The official npm package clawboo states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). ci.yml runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and publish.yml reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).

Cline 80

Read as a local package. The cline CLI on npm (Node 22 or later), the VS Code extension (VS Code 1.101 or later), a JetBrains plugin and desktop builds (20). The VS Code test workflow passed on every main run we loaded, including the 1 October CLI and SDK releases (25). 645 to 730 open issues and 525 open pull requests, a stale bot that closes issues after 74 quiet days, and open crash reports such as #12493, where aborting a turn can crash the hub daemon (13). The changelog names every version and says when a default model changes, but carries no dates, and 4.0.0 listed its removals (Explain Changes, subagents for a time) under Changed rather than a breaking section (9). Extension 4.1 and CLI 3.0 are past 1.0, while the SDK (0.0.90) and desktop app (0.0.42) aren't (13).

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Cline 57

Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The extension sends usage and error events to PostHog unless the user unticks 'Allow error and usage reporting' or turns off VS Code telemetry. The CLI is built with a telemetry key and an enable flag from repository secrets and its reference lists no telemetry setting, so its default is unconfirmed (15). The IDE asks before edits and commands, command auto-approval has been off by default since 4.0.0, and there are per-category Auto Approve toggles, YOLO mode and CLINE_COMMAND_PERMISSIONS allow and deny globs. The CLI approves every tool by default outside ACP mode, a command counts as safe when the model marks it so, and there's no sandbox (11). No prompt-injection guidance found in the docs (4). Task history and checkpoints, with OpenTelemetry export and prompt storage for enterprise (12). A valid security.txt (expires 2027-12-31), a Bugcrowd disclosure programme and three advisories published with CVEs, two of which list no patched version (15).

Clawboo 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card and no Clawboo account (20). One npx command installs and starts it with no sign-up (20). Model costs belong to the providers the owner connects.

Cline 50

No payment protocol (0). Scored on Cline's paid options. ClinePass is $9.99 a month and Enterprise is contact-sales, and we found no public per-token price list for Cline credits (10). The open-source extension and CLI need no card (20). Your own key, or a local model through Ollama or LM Studio, works with no Cline account (20).

Clawboo 75

Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one {error} shape, refused MCP calls return denied: with a reason prefix, and 429s carry Retry-After (16). claim_task and assign_task are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One npx command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).

Cline 67

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. Many built-in tools (files, terminal, browser, MCP, subagents, plan and act), with MCP servers switched on or off per server, and no tool search or lazy loading found (15). --timeout (off by default), a mistake limit through --retries, automatic compaction and an output budget scaled to the model (14). --json writes one JSON object per message, but we found no documented exit codes (12). Checkpoints restore files and task state, sessions resume by ID, and API errors and empty responses are retried (18). The CLI defaults to Cline's own provider and to approving every tool, and the SDK is TypeScript only (8).

Clawboo 83

Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at .md on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).

Cline 77

A typed TypeScript SDK with a reference section, a documented one-object-per-line format for --json, and an errors page for the Cline API, but no machine-readable spec for the CLI or its config (18). llms.txt at docs.cline.bot, listing a Markdown version of every page (10). Feature pages say when to use each setting, such as the recommended Auto Approve setup (14). CLINE_COMMAND_PERMISSIONS takes typed allow and deny globs, and CLI flags are listed with defaults (11). CLI samples, SDK examples and the API errors page (13). A versioned changelog without dates, with dated tags on GitHub (11).