Clawboo vs Junie CLI

Clawboo 83

Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at .md on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).

Junie CLI 62

Framework reading. A CLI reference that lists every flag with examples, documented formats for the allowlist, config.json, custom model profiles and hook payloads, and ACP as the editor protocol. No schema for the json or json-stream output was found, and the OpenAPI covers only update metadata (12). llms.txt exists and claims Markdown by content negotiation, but docs pages came back as HTML with Accept: text/markdown and llms.txt doesn't index them (6). Pages say when to use ACP and when not, and how trust works in each launch mode, but the headless page doesn't say what happens when an action needs approval (13). Output formats, effort levels, channels and allowlist actions are enumerated, though the effort values differ between the CLI reference and the model page (11). Examples throughout and nine StopFailure categories in the hooks page, but no exit codes or error format (8). A dated release list and dated docs pages (12). 12+6+13+11+8+12 = 62.

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Junie CLI 72

Release 26.10.12 (3659.7) on 16 October 2026 (30). What's New lists builds on 6, 12, 13, 15 and 16 October alone, npm shows weekly versions from March, and the repository has 1,133 tags in 90 days, most of them nightly builds (20). A GitHub tracker with 6 open and 75 closed issues and 4 open and 40 closed pull requests, a public YouTrack project with 30 issues resolved in 30 days against 67 opened, mostly without replies on recent CLI reports, and a Discord server. Response times on GitHub couldn't be read (13). No SDK and no registry entry. The GitHub Action is at v1 and GitLab CI is documented, and ACP is kept current (6). Closed source with no workflow files in the repository, so no CI or dependency health to read. The installer checks sums, and npm is five weeks behind the release feed (3). 30+20+13+6+3 = 72.

Clawboo 75

Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one {error} shape, refused MCP calls return denied: with a reason prefix, and 429s carry Retry-After (16). claim_task and assign_task are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One npx command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).

Junie CLI 55

Framework reading, adapted to a harness driven by a pipeline. MCP tools can be allowed per server prefix, and default MCP, skill, agent and config locations can each be switched off, with no deferred tool loading found (15). text, json and json-stream output and --json-output-file. Remote mode mentions a step limit, but no turn, time or spend cap for a headless run was documented (10). No exit codes. A Stop hook can end a task with a failure status, and StopFailure names the failure category (8). Sessions resume with --session-id or --resume, and worktrees isolate parallel sessions (14). One command with --auth and a dynamically chosen default model, a GitHub Action and GitLab CI, and no SDK (8). 15+10+8+14+8 = 55.

Clawboo 58

MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).

Junie CLI 77

Proprietary, with clear terms. The JetBrains AI Terms of Service (version 2.1, effective 30 September 2025) name AI Assistant and Junie, though the Junie EAP terms from December 2024 still call Junie a plugin (15). The terms rule out training on inputs without consent and list AI subcontractors with 30 days' notice of new ones (page updated 29 September 2026, naming OpenAI, Google, Anthropic and SpaceXAI for Junie). The AI FAQ says nothing persists unless detailed data collection is on, retained up to a year, and that it's on by default for non-commercial licences. Security monitoring keeps data for an unstated limited period (22). The terms promise 30 days' email notice before JetBrains AI is discontinued, but Junie Lite's model may change without notice and model aliases change without a stated period (10). A per-run override for anonymous statistics is documented, with no stated default and no list of what is sent (10). 15+22+10+10 = 57.

Clawboo 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card and no Clawboo account (20). One npx command installs and starts it with no sign-up (20). Model costs belong to the providers the owner connects.

Junie CLI 42

Harness reading of the published rubric. No payment protocol (0). Plan prices and the US$1 credit are public without a login, but per-model credit rates and Junie API key usage rates weren't found (12). Junie Lite is free with a JetBrains account and no card (20). Judgement call. The docs present BYOK keys and custom endpoints such as Ollama as alternatives to a JetBrains sign-in, so a pipeline holding a provider key needs no JetBrains signup, but the headless page says a token is required and a Junie API key is created by hand at junie.jetbrains.com/cli (10). 0+12+20+10 = 42.

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Junie CLI 56

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. A browser login, a long-lived Junie API key with no scopes we found, or provider keys passed as flags or environment variables. The CLI's statistics default isn't stated (13). The allowlist asks before terminal commands, MCP tools, edits outside the project, reads outside it and secret files, and checks every part of chained, nested and multi-line commands. Brave mode is interactive only. Sandbox mode limits writes and hides ~/.ssh, but it's EAP-only, off by default, missing on Windows, and leaves the network open by default (12). Interactive runs keep an untrusted project's MCP servers, hooks and skills unloaded and a project can't widen the sandbox, but one-shot, piped, ACP and Gateway runs trust every project by design, and the docs say to run them only in trusted projects (9). /usage shows per-session cost and sessions are stored, and PreToolUse hooks in batch runs can log or block tools, but they're EAP, and no audit log for the CLI was found (7). A coordinated disclosure policy (updated 10 October 2026) and a security.txt contact, CVEs published through NVD and a fixed-issues page (OSV lists no advisory for @jetbrains/junie, and the repository has no SECURITY.md), discretionary rewards with no formal bounty, and SOC 2 per the Junie homepage (15). 13+12+9+7+15 = 56.