Clawboo vs Crush

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Crush 82

v0.98.1 on 9 October 2026 on npm (30). 20 npm releases in the 90 days to 18 October, 0.86.0 to 0.98.1 (20). About 2,100 pull requests closed against 375 open, and 828 issues closed against 482 open, per shields.io badge counts read on 18 October (our GitHub record), with 514 commits in the 90 days to 18 October and new contributors signing the CLA most days. Reply times couldn't be read (12). No SDK, as with other harnesses. npm, Homebrew, Winget, Scoop, apt, yum and NUR builds track releases, and the latest npm version matches the latest tag (12). Dependabot, a go mod tidy check in CI and scheduled security scans, with the current CI state unconfirmed (8).

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Crush 44

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage metrics go to PostHog through data.charm.land by default, keyed to a hashed machine ID, aliased to the Hyper user ID after a Hyper login, and including error messages. The README says prompts and responses are never collected and names three opt-outs. The provider list is fetched from Catwalk at startup unless turned off, the update check only notifies, and provider keys stay local (15). The TUI asks before bash, edit, write, fetch, download and MCP calls, permissions deny hides tools and PreToolUse hooks can block calls. But crush run approves every permission request in its session automatically (internal/app/app.go), --yolo skips all prompts, and there's no sandbox, only a fixed refusal list for curl, wget, ssh, sudo, package managers and similar commands (7). No prompt-injection guidance found, and a project's .crushrc and $(...) in crush.json run as code at startup, which the README warns about (3). Logs in ./.crush/logs/crush.log with crush logs, sessions in a local database readable as JSON, and crush stats, with no OpenTelemetry export (9). The organisation's SECURITY.md gives an email address, CI runs CodeQL, Grype and govulncheck, releases are cosign-signed, and OSV (the GitHub Advisory Database's public mirror) and NVD list no vulnerability for Crush, rechecked in our GitHub record, which also finds no SECURITY.md in the repository. No security.txt and no bug bounty (10).

Clawboo 75

Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one {error} shape, refused MCP calls return denied: with a reason prefix, and 429s carry Retry-After (16). claim_task and assign_task are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One npx command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).

Crush 52

Harness reading, scored on what an agent or pipeline driving crush run has to supply. About 20 built-in tools, any of which permissions deny hides, MCP servers take per-server disabled_tools, and skills can be turned off or kept out of the model's list. No lazy loading of MCP tools found (17). No turn, time or cost limit on crush run, and the only output controls are --quiet and --verbose (6). Errors come back as plain messages with a non-zero exit, such as the one for an unconfigured provider, with no documented codes and no JSON error record (8). --session and --continue resume a run, and crush session list, show, last, rename and delete take --json (13). One argument starts a run and environment keys are picked up, but there's no SDK, and the HTTP API needs CRUSH_CLIENT_SERVER=1 and is described only in one README section (8).

Clawboo 83

Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at .md on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).

Crush 65

Harness reading of the framework line. A JSON Schema for the config at https://charm.land/crush.json (also printed by crush schema), --json on the session commands, and an OpenAPI document that crush server generates from its endpoint list and serves at /v1/docs/openapi.json, which isn't published anywhere we could fetch. crush run output has no typed form (20). No llms.txt (charm.land/llms.txt is a not-found page). The docs are Markdown in the repository and the hooks guide says it was written for humans and agents (5). The README and config docs explain when to allow, deny or hook a tool and warn that configs run as code (12). The schema carries enums and defaults, such as the attribution trailer style, while permissions take bare tool names with no command patterns (11). Many examples for providers, MCP, hooks and local models, with no reference for error messages or exit codes (9). Version tags and GitHub releases with generated notes, which we couldn't open, and no changelog file (8).

Clawboo 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card and no Clawboo account (20). One npx command installs and starts it with no sign-up (20). Model costs belong to the providers the owner connects.

Crush 55

No payment protocol (0). Scored on Charm's Hyper provider. Its public provider file at hyper.charm.land/v1/provider lists per-million-token figures for 22 models without a login, but no pricing page confirms them as billed rates, and plan prices sit in a script-rendered app (15). The CLI is free to use and runs with your own provider key or a local model, so nothing needs a card (20). A local model through Ollama, llama.cpp or LM Studio, or an existing provider key in the environment, works with no Charm account, so an agent can install it and run a task without a person signing up (20).