Clawboo vs DeepSeek Harness (dsh)

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

DeepSeek Harness (dsh) 40

Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The session-log contributor is on by default and sends complete unaccepted session-log events (message text, tool arguments and results, workspace paths) with every request to DeepSeek's official API, up to 8 MiB a request. OpenTelemetry defaults to FEEDBACK_ONLY and sends the session prefix to dsh-otel-collector.deepseeksvc.com after any feedback or rating. Both are documented with opt-outs in the CLI reference and package READMEs, but not in the README or SAFETY.md. Keys stay local (8). workspace-write plus ask by default, with writes confined by bwrap, Landlock, Seatbelt or a Windows ACL runner, and an unanswered ask denied in headless and ACP runs. Reads and network are not confined, web_fetch runs without approval (public destinations only), and the SDK's sdk-minimal profile pins danger-full-access with no approval service (13). SAFETY.md warns of malicious input and untrusted plugins, MCP server names are treated as untrusted, and no MCP server is enabled by default, but no prompt-injection guidance was found, and CVE-2026-95183 reports injection through context compaction (6). Local JSONL session logs record approval decisions as audit events (12). No SECURITY.md (none in a clone of 18 October either), no security.txt, no bug bounty, and OSV lists no advisory for @deepseek-ai/dsh or deepseek-harness-sdk. SAFETY.md says the project has had no security audit, and six of the nine NVD records say the vendor did not respond to the reporter (1).

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

DeepSeek Harness (dsh) 71

0.2.1-rc.2 on npm and 0.2.1rc2 on PyPI on 17 October 2026 (30). 36 npm versions since 10 August 2026, with 14 since 18 September, and 32 dsh-v tags in the 90 days to 18 October in a clone of the repository (20). CONTRIBUTING.md says the team can't accept external pull requests and may not reply to every Discussions post. shields.io reads 0 issues and 0 pull requests, open or closed, which fits issues being turned off. The clone shows 22,395 commits since 10 June 2026, 8,645 of them merges, which says little about replies to users. Reply times in Discussions are unchecked (5). The Python SDK ships with each release, still as a pre-release (10). A CI workflow with a Node version matrix exists, with its current state unconfirmed (6).

Clawboo 52

Read as local software. The official npm package clawboo states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). ci.yml runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and publish.yml reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).

DeepSeek Harness (dsh) 33

Local-package reading, graded on npm latest 0.2.0-rc.2, which the README's npx @deepseek-ai/dsh installs. Official npm package with Node 22.19+ and 24+ stated, and a Python wheel for Python 3.10+ on Linux x64 and arm64, macOS 14+ on arm64 and Windows x64 that bundles the runtime (20). A public CI workflow (.github/workflows/ci.yml) with a Node 22.19, 24 and 26 matrix, a separate real-API end-to-end workflow and 25 workflow files in the clone of 18 October, but run results couldn't be read, so whether it passes on master is unconfirmed (10). shields.io reads 0 open and 0 closed issues and 0 pull requests on 18 October. The README and CONTRIBUTING.md send bug reports to GitHub Discussions and refuse external pull requests, so issues are probably turned off, though the counts alone are ambiguous. Discussions couldn't be read, so crash reports and their handling are unchecked and scored absent (0). Alpha, next and latest dist-tags separate channels, but no changelog or breaking-change notes were found and the README warns generally of breaking changes (3). Developer preview, no 1.0 or stable release (0).

Clawboo 75

Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one {error} shape, refused MCP calls return denied: with a reason prefix, and 429s carry Retry-After (16). claim_task and assign_task are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One npx command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).

DeepSeek Harness (dsh) 68

Harness reading, scored on what a pipeline driving it has to supply. Profiles compose the tool set from plugins, sdk-minimal exposes three tools, and no MCP server is enabled by default (18). Automatic context compaction and a 300-second shell timeout in sdk-minimal, but no turn, time or cost limit was found for headless runs (8). Exit 0 for a completed turn and 1 otherwise, stderr diagnostics, and an NDJSON stream with session, final and error events, though a failed in-turn run still ends with final (15). --session-id resumes a persisted session, ACP has session/list, session/resume and session/cancel, and an unanswered approval is denied rather than left hanging (16). One-argument headless runs, ACP and a Python SDK, with no TypeScript SDK found and a model key required (11).

Clawboo 83

Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at .md on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).

DeepSeek Harness (dsh) 77

Framework reading. --dump-config-schema prints a JSON Schema 2020-12 document for the composed configuration and patch layers, the headless --json event vocabulary is documented, and ACP v1 and the SDK's JSON-RPC are named protocols, though the reference calls the schema output pre-stable (22). llms.txt on the docs site, with a raw Markdown address for every page (10). Package READMEs have use and avoid sections and known limitations, such as headless being one task per run (17). Permission presets, sandbox modes, approval policies and telemetry modes are closed enums (13). Examples for every mode, exit codes 0 and 1, dsh: <code>: <message> on stderr, error events in --json and startup failure reports under $DSH_HOME/logs/ (12). Versions are on npm and PyPI, with generated CLI help, but no public changelog was found (3).

Clawboo 58

MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).

DeepSeek Harness (dsh) 53

MIT, Copyright 2026 DeepSeek, with third-party licences in THIRD_PARTY_NOTICES.md (30). The package READMEs state what leaves the machine, the defaults, the collector address and that exports can include message text, tool arguments, results and workspace paths, but the project has no privacy policy or retention statement of its own, and uploads fall under DeepSeek's platform policy (14). The README warns of breaking changes, but no changelog, deprecation notices or dates were found (3). Telemetry is disclosed with opt-outs by setting, Web switch and environment variable, though only in reference pages and not at the top of the README or in SAFETY.md (12).