Clawboo vs Kilo Code CLI

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Kilo Code CLI 87

7.8.12 on the npm latest tag on 15 October 2026, with 7.8.13 and 7.8.14 on the rc tag on 16 October (30). 7.8.9, 7.8.10 and 7.8.12 since the 8 October check, and 46 versions published to npm since 17 July 2026, two of them on the rc tag (20). The newest issues carry area and triage labels from automation, but the 15 newest open issues had no or one comment each on 8 October, against 448 open issues and 147 open pull requests, per the 8 October check, not re-read on 17 October (15). @kilocode/sdk is at 7.8.12 with the CLI, and the VS Code extension ships from the same release workflow (13). CI, CodeQL and Dependabot security updates run, with version updates switched off because most dependencies arrive through merges from opencode (9).

Clawboo 52

Read as local software. The official npm package clawboo states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). ci.yml runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and publish.yml reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).

Kilo Code CLI 85

Local-package reading. @kilocode/cli on npm, a Homebrew tap, an AUR package, an install script and release binaries for Linux, macOS and Windows on x64 and arm64, with baseline and musl builds named (20). Public CI, and the 40 most recent completed workflow runs on main on 8 October 2026 all succeeded, the test, typecheck and VS Code test workflows among them, per the 8 October check, not re-read on 17 October (25). 448 open issues and 147 open pull requests, a workflow that closes issues after 60 quiet days and pull requests after 30, and open reports from 7 October of a turn that hangs after the loop exits (#14876) and of exhausted 503 retries ending a run with no visible error (#14877), per the 8 October check, not re-read on 17 October (15). The CLI changelog is generated by Changesets with Minor and Patch headings and no dates or breaking-change headings. 7.8.13 (rc on 16 October) changes how a custom agent's edit denies apply to its subagents under a Patch heading (10). 7.8.12 on the npm latest tag, past 1.0 (15).

Clawboo 58

MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).

Kilo Code CLI 76

MIT, with opencode's copyright kept in the licence file (30). The privacy policy (29 May 2026) names Kilo Code Inc. as controller, says data is stored in the United States and lists Stripe, OpenRouter, model providers, AppsFlyer and Sentry, but it doesn't mention the CLI's PostHog telemetry. PRIVACY.md in the repository is dated March 2025 and is silent on telemetry too. The terms (30 September 2026) are a contract with Anaconda, Inc. and grant a perpetual licence to use uploaded Customer Data to improve the services (13). kilo console is marked deprecated with no removal date, and updated terms apply after 30 days. No written deprecation policy found (8). The docs say telemetry is on by default and name the opt-out key in two places, without listing what is collected or where it goes (10).

Clawboo 60

No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card and no Clawboo account (20). One npx command installs and starts it with no sign-up (20). Model costs belong to the providers the owner connects.

Kilo Code CLI 50

No payment protocol (0). Scored on Kilo's paid options, as with Cline. Plan prices are public (Kilo Pass from $19 a month, Teams $15 a user a month, Enterprise by quote) and the gateway bills provider rates plus a 5 per cent fee on credit purchases, but the pricing page carries no per-token list (10). The CLI is MIT-licensed and free. The no-card statement seen on 8 October wasn't in the pricing page text on 17 October, but nothing has to be bought to use the CLI with your own key (20). Your own provider key or a local model works with no Kilo account, so an agent can install and run it without a sign-up (20).

Clawboo 83

Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at .md on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).

Kilo Code CLI 90

Framework reading. A JSON Schema for kilo.jsonc at https://app.kilo.ai/config.json, an OpenAPI file for the kilo serve API at packages/sdk/openapi.json and a CLI reference generated from the command definitions (25). llms.txt on kilo.ai and on the docs, the second listing a raw Markdown address for every page (10). The sandboxing page says when to use the sandbox, what it does not protect and how it differs from permissions (16). Permissions are allow, ask or deny with glob rules, sandbox.network and --format are enums, though the schema served on 8 October had no sandbox key (13). Config and CI samples and exit codes 0, 1 and 124, but we found no reference for the records --format json writes (11). A versioned changelog and dated GitHub releases (15).

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Kilo Code CLI 64

Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Telemetry is on by default and goes to PostHog in the United States, the source links the machine identifier to the account email after a Kilo sign-in, and since 7.8.10 (14 October) it also attaches the conda client ID when ~/.conda/aau_token exists (see negative). It is turned off with experimental.openTelemetry or KILO_TELEMETRY_LEVEL. Provider keys stay on the machine (14). Shell commands ask by default outside a built-in allow list, reads of .env files and paths outside the project ask, and edits inside the project run without asking. An operating-system sandbox (Seatbelt on macOS, Bubblewrap on Linux, none on Windows) limits writes and blocks the network, refuses to run when it can't be enforced, and is off by default. --auto approves everything not explicitly denied (15). The sandboxing page covers prompt injection and its limits, project config can't weaken the sandbox, and {env:VAR} is resolved only in trusted config (11). Session export, kilo stats and OTLP export of traces and logs, with audit logs on the Enterprise plan (12). A valid security.txt (expires 2026-12-31), a disclosure policy that cites HackerOne's standards and safe harbour, CodeQL in CI and no published repository advisories. NVD lists CVE-2026-8766 (low, through 7.0.47, May 2026) and says the vendor didn't respond, and SECURITY.md still says the CLI has no sandbox (12).