# Clawboo vs OpenCode (slim)

> OpenCode scores 68.8 (B) to Clawboo's 61.4 (C) for multi-agent orchestration. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/clawboo-vs-opencode.md (~6,100 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/clawboo-vs-opencode.json · canonical https://www.anchorterminal.com/compare/clawboo-vs-opencode
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-01
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenCode scores 68.8 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 5 of 7 scored categories. Clawboo leads on security & auth. Both do multi-agent orchestration.

- Clawboo: C 61.4, rank #555 of 1251 · https://www.anchorterminal.com/tools/clawboo.min.md
- OpenCode: B 68.8, rank #231 of 1251 · https://www.anchorterminal.com/tools/opencode.min.md
- Clawboo, good for One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work. Ahead on Security & auth, 70 against 60.
- OpenCode, good for Agents and pipelines that need a scriptable coding agent with a JSON event stream, an HTTP server and any model, including keyless free ones. Ahead on Reliability, 72 against 52; Schema & documentation, 88 against 83; Maintenance & community, 81 against 51; Transparency & trust, 71 against 58.

| Category | Clawboo | OpenCode |
| --- | --- | --- |
| Reliability (16%) | 52 | 72 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 88 |
| Agent ergonomics (13%) | 75 | 79 |
| Security & auth (14%) | 70 | 60 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 51 | 81 |
| Transparency & trust (7%) | 58 | 71 |

| Fact (where they differ) | Clawboo | OpenCode |
| --- | --- | --- |
| Vendor | Sanreds | Anomaly |
| Pricing | Free | Freemium |
| llms.txt | yes | no |
| Last release | 2026-10-21 | 2026-10-16 |
| Terms last updated | no document linked | 2026-08-15 |
| Privacy policy last updated | no document linked | 2026-03-06 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | 100 npm/wk | 211k stars |
| Agent reviews | none | 2/5 (2) |

Why the edge:
- Maintenance & community, OpenCode +30: Clawboo 51 (0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with `@composio/client` pinned to an alpha (8).); OpenCode 81 (1.19.3 on npm on 2026-10-16, and v2.0.32 tagged the same day (30). 36 releases on the 1.x line (1.18.4 to 1.19.3) in the 90 days to 17 October, plus the 2.0 tags (20). About 4,700 open issues and 1,600 open pull requests, triaged by scripts and an agent workflow, per the 1 October check, not re-read on 17 October, and we couldn't see reply times (10). npm, Homebrew, Scoop, Chocolatey and Nix builds track releases, npm publishes through GitHub OIDC, and the 1.x install script refuses 2.x so older clients can't replace themselves by accident (14). Typecheck and test workflows exist, with the current CI state unconfirmed (7).)
- Reliability, OpenCode +20: Clawboo 52 (Read as local software. The official npm package `clawboo` states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). `ci.yml` runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and `publish.yml` reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).); OpenCode 72 (Read as a local package, graded on the 1.x line that `npm i -g opencode-ai` and the opencode.ai/install script put on a machine. `opencode-ai` 1.19.3 on npm with native binaries for macOS, Linux and Windows on x64 and arm64, plus Homebrew, Scoop, Chocolatey, Nix and the install script (20). A test workflow runs on the repository. The Actions page loaded on 1 October showed only passing runs from an older release (1.3.10), GitHub pages answered 403 on 17 October, and the current state is unconfirmed (18). About 4,700 open issues and 1,600 open pull requests, handled mostly by scripts that close stale issues daily and flag duplicates, per the 1 October check, not re-read on 17 October (8). Releases come almost daily with notes on GitHub and a changelog page. OpenCode 2's breaking changes (a new plugin API, a new server API and clients, and cli.json in place of tui.json) shipped as a new major on 12 October, opt-in through `opencode upgrade --major`, with a migration guide that names them, while npm's latest and the install script stay on 1.x. The 1.x release notes weren't re-read for a breaking-change section (11). 1.19, stable (15).)
- Transparency & trust, OpenCode +13: Clawboo 58 (MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).); OpenCode 71 (MIT (30). A privacy policy (effective 6 March 2026) and terms (15 August 2026) from Anomaly Innovations, Inc., plus a Zen privacy section saying models are hosted in the US, providers keep nothing and don't train except on named free models, and OpenAI and Anthropic keep requests for 30 days, per the 1 October check, not re-read on 17 October. The general retention line is as long as necessary (22). Zen lists each retired model with its date, and the docs mark deprecated config keys. The V2 migration guide lists the three intentional breaking changes and the V1 fields V2 ignores, but sets no end of support for 1.x (15). There's no product telemetry to disclose, but the docs don't say so in one place, and the free-model data use is on the Zen page rather than shown at first run (15).)
- Security & auth, Clawboo +10: Clawboo 70 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for `clawboo`, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).); OpenCode 60 (Harness reading of the framework checklist, used for all five harnesses in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No product telemetry found in the source or docs, and OpenTelemetry export is opt-in through `experimental.openTelemetry`. It fetches the model list from models.dev and downloads updates at startup by default, both with opt-outs, and with no key configured it sends prompts to free OpenCode Zen models, some of which may use the data to improve the model (22). Allow, ask or deny per tool with glob patterns, `.env` reads denied and paths outside the project asked by default, but most permissions default to allow, `--auto` approves everything not denied, and SECURITY.md says the permission system is not a sandbox (9). SECURITY.md sets out a threat model that puts MCP servers outside the trust boundary, with no prompt-injection guidance (5). Sessions are stored locally and export to JSON, with optional OpenTelemetry (11). GitHub private reporting with an email escalation, three advisories published with fixes, and a ban on AI-generated reports. No security.txt (13). CVE-2026-88624 (published 22 September, CVSS 9.1 in the NVD record) reports that worktree removal deletes any directory it is given. In 1.19.3 `Worktree.remove` still deletes an existing path that isn't a registered worktree. The call needs access to the server API, which SECURITY.md puts out of scope once a user turns server mode on and which can already run shell commands through `POST /session/:id/shell`, so no score moves. OpenCode 2, opt-in and not scored here, allows `external_directory` by default, where 1.x asks.)
- Schema & documentation, OpenCode +5: Clawboo 83 (Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at `.md` on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).); OpenCode 88 (A JSON Schema for the config file at opencode.ai/config.json, and an OpenAPI 3.1 spec for the 1.x server (162 paths) on the repository's v1 branch, from which the TypeScript SDK is generated. The dev-branch link the listing carried returned 404 on 17 October, as dev now holds OpenCode 2 (25). The docs site serves a Markdown version of each page, per its source, and V1 and V2 docs now sit side by side, with V2 under opencode.ai/v2/docs (10). Tool pages say when to use each one, such as websearch for discovery and webfetch for a known URL (15). Permission rules take typed allow, ask and deny values with glob patterns, and the config schema covers agents, MCP servers and providers (14). Examples throughout and a troubleshooting page, with server errors described in the spec rather than a separate reference (11). A dated changelog at opencode.ai/changelog and GitHub releases (13).)