Clawboo vs OpenHands

Clawboo 51

0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with @composio/client pinned to an alpha (8).

OpenHands 85

SDK 1.50.1 on 2026-09-30 and Agent Canvas 1.24.0 on 2026-09-25 (30). 21 Canvas releases since 2026-07-24 and 13 SDK tags in September (20). Issues are labelled by priority within a day or two, but 456 open issues and 395 open pull requests, and we couldn't see reply times (16). npm, PyPI and GHCR packages are current, but the openhands CLI on PyPI has been unmaintained since 2026-08-11 and still appears in the docs and on the pricing page (10). CI passes on main, and Dependabot, a security scan and an API-breakage check run on the SDK (9).

Clawboo 52

Read as local software. The official npm package clawboo states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). ci.yml runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and publish.yml reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).

OpenHands 83

Read as a local package. Official npm package @openhands/agent-canvas (Node 24 or later, plus uv), a Docker image on GHCR and openhands-sdk on PyPI (Python 3.12 or later) (20). The CI workflow passed on every run on main we loaded (25). 456 open issues and 395 open pull requests, with recent reports labelled by priority and ready-for-dev within a day or two, and a high-priority Cloud resume bug (#17664) open (18). Dated release notes for every Canvas version and a written SDK rule of at least five minor releases before a public API or REST contract is removed, but the Canvas CHANGELOG.md stops at 1.0.0-alpha.2 and the product was reshaped twice in a year, with the local GUI deprecated and the CLI left unmaintained (12). Canvas is 1.24 with a beta badge on its README, and the SDK is 1.50 (8). Judgement call on the last line, half credit for a 1.x release its maker still calls beta.

Clawboo 58

MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).

OpenHands 70

MIT across Canvas, SDK, tools and Agent Server (30). The privacy policy (effective 3 September 2025) doesn't separate the open-source stack from the Cloud service, keeps data as long as reasonably necessary, allows training on content from the Services and names PostHog and Google Analytics only in passing, with no subprocessor list (12). A written SDK deprecation runway of five minor releases, deprecated projects grouped in the docs, and the CLI's unmaintained notice in its README without a date on the page (15). The consent prompt calls the data anonymous and the Docker page documents AGENT_CANVAS_DISABLE_TELEMETRY, but no user-facing page mentions the install event sent before consent (10).