Clawboo vs Kimi Code CLI

Clawboo 70

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for clawboo, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).

Kimi Code CLI 45

Harness reading of the framework checklist. 30 for credentials and what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. OAuth tokens sit in 0600 files and shell keys aren't read unless named. Telemetry is on by default and, in the 2.2.0 package, sends events with a device ID, session ID and model name to telemetry-logs.kimi.com. Auto-update is on by default (14). Interactive sessions ask before edits and commands, and a dangerous-command guard covers rm -rf and similar, but kimi -p runs under Never Ask, where everything is approved and the guard is off, with only static deny rules left. No sandbox found, and hooks fail open (7). The MCP page warns about untrusted servers and project .kimi-code/mcp.json entries, and since 2.1.0 project config waits for workspace trust, but no prompt-injection guidance was found for fetched web pages (6). Sessions on disk, kimi export, the kimi vis session visualiser, a diagnostic log and hooks for auditing (11). SECURITY.md names private GitHub advisories and an email, supports only the latest version and gives no response time. No security.txt was found on kimi.com, kimi.ai or moonshot.ai, and OSV, the public mirror of the GitHub Advisory Database, lists no advisories for the package, though 2.1.0 shipped security fixes (7).

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

Kimi Code CLI 72

2.2.0 on 14 October 2026 (30). 32 releases on npm in the 90 days to 14 October (20). Pull requests are closed at pace, 2.3k closed against 467 open, and the changelog credits merged pull requests up to #4159 from many contributors, with 742 commits in the 90 days to 18 October. Issues lag, with 1.1k open against 391 closed, and reply times couldn't be read (11). No SDK packages. The ACP server and REST API ship inside the CLI, and Homebrew core is current at 2.2.0 (5). CI with a frozen lockfile, lint and a dependency check (sherif), with no Dependabot file found and the pass state unchecked (6).

Clawboo 52

Read as local software. The official npm package clawboo states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). ci.yml runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and publish.yml reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).

Kimi Code CLI 68

Local-package reading. An install script that verifies a checksum, npm @moonshot-ai/kimi-code with Node 22.19.0 or newer stated, and Homebrew core at 2.2.0, for macOS, Linux and Windows (20). A public CI workflow runs the build, a smoke test, sharded tests on Linux, tests on Windows, lint and typecheck. GitHub refused our requests, so whether it passes on main wasn't checked (15). Read on 18 October through shields.io counts, 1.1k issues are open against 391 closed and 467 pull requests open against 2.3k closed, in a repository whose first commit was on 22 May 2026. Which of the open issues are crashes or regressions, and how fast they are answered, couldn't be read, so the line scores the backlog alone (8). Changesets changelog with Major, Minor and Patch headings and a Breaking note in 0.28.0, but 2.0.0's only major change was a new slash command, and 2.2.0 made configs with executor = "kaos" fail validation in a minor release (10). 2.2.0, past 1.0 (15).