Cline vs Letta

Cline 57

Harness reading of the framework checklist, used for all five harnesses in the 1 October batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Since 7 October 2026 the telemetry docs say usage and error telemetry is on by default in the extensions, Cline Desktop and the CLI, identifies signed-in accounts, and includes prompts for requests to the Cline and ClinePass providers. Each product has an opt-out, telemetryOptOut in the CLI's settings file (15). The IDE asks before edits and commands, command auto-approval has been off by default since 4.0.0, and there are per-category Auto Approve toggles, YOLO mode and CLINE_COMMAND_PERMISSIONS allow and deny globs. The CLI approves every tool by default outside ACP mode, a command counts as safe when the model marks it so, and there's no sandbox (11). No prompt-injection guidance found in the docs (4). Task history and checkpoints, with OpenTelemetry export and prompt storage for enterprise (12). A valid security.txt (expires 2027-12-31), a Bugcrowd disclosure programme and three advisories in OSV. GHSA-3cj3-hqcr-g934 now lists 3.0.30 as patched, and GHSA-5c57-rqjx-35g2 lists 2.13.0 as the last affected version (15).

Letta 35

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is unrestricted; standard, acceptEdits and strict are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.

Cline 70

Read as a local package. The cline CLI on npm (Node 22 or later), the VS Code extension (VS Code 1.101 or later), a JetBrains plugin and desktop builds (20). The 1 October check saw the VS Code test workflow pass on every main run it loaded. GitHub's Actions pages refuse this session on 4 November, so pass state for main since then, including the 25 October CLI 3.0.74 and extension 4.1.26 releases, is unread (15, as node-red). 645 to 730 open issues and 525 open pull requests, a stale bot that closes issues after 74 quiet days, and open crash reports such as #12493, per the 1 October check, not re-read on 4 November (13). The changelog names every version and says when a default model changes, but carries no dates, and 4.0.0 listed its removals under Changed rather than a breaking section. CLI 3.0.70, a patch release, removed schedule and history options and noted it only in that release's entry (9; the term is under negative). Extension 4.1.26 and CLI 3.0.74 are past 1.0, while the SDK (0.2.0) and desktop app (0.0.49) aren't (13).

Letta 58

Local-software lines, read for the harness. @letta-ai/letta-code on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.

Cline 50

No payment protocol (0). Scored on Cline's paid options. ClinePass is $9.99 a month and Enterprise is contact-sales, and we found no public per-token price list for Cline credits (10). The open-source extension and CLI need no card (20). Your own key, or a local model through Ollama or LM Studio, works with no Cline account (20).

Letta 60

No x402, MPP or L402 (0 of 40). Per-unit API prices are public, $0.10 per active agent a month and $0.00015 a second of tool execution, plus plan prices (20). A $0 plan with bring-your-own keys; no card is mentioned (20). The CLI runs locally without signing in (20). Total 60.

Cline 65

Apache-2.0 (30). The privacy policy at cline.bot/privacy renders only with JavaScript and we couldn't read it. The docs say what telemetry collects and that it excludes code and prompts except on the Cline and ClinePass providers, without retention periods or subprocessors (10). Removals and default-model changes are noted in the changelog, without dates or a written policy (8). Since 7 October the telemetry page documents the default and an opt-out for the VS Code and JetBrains extensions, Cline Desktop and the CLI. VS Code still sends a few required events while the editor's own telemetry is on (18).

Letta 55

Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.

Cline 77

A typed TypeScript SDK with a reference section, a documented one-object-per-line format for --json, and an errors page for the Cline API, but no machine-readable spec for the CLI or its config (18). llms.txt at docs.cline.bot, listing a Markdown version of every page (10). Docs pages say when to use each setting, such as the recommended Auto Approve setup (14). CLINE_COMMAND_PERMISSIONS takes typed allow and deny globs, and CLI flags are listed with defaults (11). CLI samples, SDK examples and the API errors page (13). A versioned changelog without dates, with dated tags on GitHub (11).

Letta 70

Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an applies_to block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.