Clawboo vs Droid CLI

Clawboo 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card and no Clawboo account (20). One npx command installs and starts it with no sign-up (20). Model costs belong to the providers the owner connects.

Droid CLI 10

Harness reading of the published rubric. This is paid, closed software tied to a subscription, so the self-hosted rule does not apply. No payment protocol (0). Plan prices are public, $20, $100 and $200 a month for individuals and $60 a team plus $40 a seat for Teams, but included usage is given only as rolling rate limits and multiples of Pro (10). No free tier or trial was found on the pricing pages. Using your own model key is free up to an allowance, but only on a paid plan (0). A person signs in through a browser to subscribe and to create the API key. The Service Accounts API can issue keys only inside an existing organisation (0).

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Droid CLI 79

The changelog's newest entry is CLI v0.236.0 of 8 October 2026, and npm and the install script served 0.237.0 on 9 October 2026 (30). 62 dated changelog entries between 11 July and 8 October 2026 (20). The public tracker had 33 open issues that are not pull requests on 9 October 2026, most with no reply, and three closed in the previous week after two or three comments. Support is also by email and Discord, where reply times are not visible (9). The Python SDK was at 0.5.0 on 24 September 2026 and the TypeScript SDK repository was last changed on 16 September 2026 (15). The npm package is published from GitHub Actions through a trusted publisher and the installer checks a checksum. There is no public CI for the CLI (5).

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Droid CLI 63

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The agent loop runs locally and the docs say no copy of the repository is uploaded or indexed. Prompts and context go to the model endpoints. Usage metrics go to Factory's collector by default, with no opt-out in the pages read outside an airgapped deployment, and message content is never sent to it. The security page says code is not used as training data. Zero data retention is listed as a Business plan item. Headless runs use a long-lived fk- key (17). droid exec is read-only by default, autonomy has four levels, permission rules allow, ask or block commands, and an OS sandbox confines commands with Seatbelt or bubblewrap and a network proxy. The sandbox is off by default and --skip-permissions-unsafe skips every prompt (16). The sandbox page names prompt injection and states what the sandbox does not stop, MCP approvals are bound to the server's command or URL, and Droid Shield scans commits for secrets. The Agent Safety page was not read (9). An organisation audit log, OpenTelemetry export and session tags exist, with audit logging listed from the Business plan up (10). A disclosure address (security@factory.com), SOC 2 and ISO 42001 named on the security page, and Security sections in the changelog. No security.txt, no bug bounty and no published advisories were found, and the trust centre was not readable (11).

Clawboo 58

MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).

Droid CLI 65

Closed source under terms from The San Francisco AI Factory, Inc., last updated 14 July 2026. The npm package is marked UNLICENSED and the Python SDK is Apache-2.0 (15). The Data Flows page says where code, prompts and telemetry go in each deployment pattern, and the privacy policy (20 August 2026) lists service providers with the place of processing and keeps personal data up to 10 years after last use. Retention of Factory's operational logs is left to the trust centre, which we could not read, and whether session transcripts are stored in Factory's cloud on individual plans was not established (17). The terms promise commercially reasonable efforts to give 60 days' notice of major changes, the changelog has Deprecations sections, and the old command lists are deprecated but still honoured. A model retirement appeared in the changelog on the day it took effect, 11 August 2026 (12). The telemetry reference documents each metric and what reaches Factory, and telemetry.granularity can strip user identity. Metrics to Factory are on by default, with no opt-out found outside an airgapped deployment (11).