# Conductor vs Droid CLI (slim)

> Droid CLI scores 57.2 (C) to Conductor's 41.3 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/conductor-vs-droid-cli.md (~6,400 tokens) · this version ~2,780 tokens · JSON https://www.anchorterminal.com/compare/conductor-vs-droid-cli.json · canonical https://www.anchorterminal.com/compare/conductor-vs-droid-cli
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Droid CLI scores 57.2 (C) on agent readiness against Conductor's 41.3 (E), and leads in every scored category. Both do agent harnesses.

- Conductor: E 41.3, rank #1285 of 1486 · https://www.anchorterminal.com/tools/conductor.min.md
- Droid CLI: C 57.2, rank #805 of 1486 · https://www.anchorterminal.com/tools/droid-cli.min.md
- Conductor, good for Existing Conductor users planning their move before Cloud closes on 20 November 2026 and the local app winds down in early 2027. Also No incidents deducted, where Droid CLI loses 3 points for them.
- Droid CLI, good for Teams that want a terminal coding agent with tiered autonomy, command rules and an optional sandbox, and that will pay for a Factory plan. Ahead on Reliability, 54 against 25; Schema & documentation, 79 against 60; Agent ergonomics, 72 against 55; Security & auth, 63 against 45; Payments & pricing, 10 against 0; Maintenance & community, 79 against 58; Transparency & trust, 65 against 53.

| Category | Conductor | Droid CLI |
| --- | --- | --- |
| Reliability (16%) | 25 | 54 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 60 | 79 |
| Agent ergonomics (13%) | 55 | 72 |
| Security & auth (14%) | 45 | 63 |
| Payments & pricing (10%) | 0 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 58 | 79 |
| Transparency & trust (7%) | 53 | 65 |

| Fact (where they differ) | Conductor | Droid CLI |
| --- | --- | --- |
| Vendor | Conductor (joining Meta) | Factory |
| Licence | Proprietary. A closed-source Mac app and hosted Conductor Cloud under Conductor's terms | Proprietary, under Factory's Terms and Conditions. The `droid` npm package is marked `UNLICENSED` and the public repository holds documentation only. The Python SDK is Apache-2.0 |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| Terms last updated | not read yet | 2026-07-14 |
| Privacy policy last updated | not read yet | 2026-08-20 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 49 stars, 7.8k npm/wk |

Why the edge:
- Reliability, Droid CLI +29: Conductor 25 (Read as local software that is winding down. Installed from Conductor's own download, which stopped taking new users on 4 November 2026 (10). Closed source, so no public CI or issue tracker (0, 0). A dated changelog, newest 0.93.0 on 4 November (15). Version 0.93 (0). 10 + 0 + 0 + 15 + 0 = 25.); Droid CLI 54 (Local-package reading, as for the other closed-source harnesses. An install script that verifies a SHA-256 checksum, a PowerShell installer, a Homebrew cask and the `droid` npm package (Node 20 or later) with prebuilt binaries for Linux, macOS and Windows on x64 and arm64, per the 9 October check (20). The source is not published. The public repository holds documentation only, so there is no public CI or test suite for the CLI (0). Bugs are tracked in the open at Factory-AI/factory. On 9 October 2026 it had 33 open issues that are not pull requests, most with no reply, and three closed in the previous week with replies. Issues were not re-read on 4 November because GitHub's API refused our requests (10). Every release has a dated, versioned changelog entry and deprecations get their own section. The line moved from 0.251.0 to 1.0.0 on 29 October, with three minors since, so the version number has signalled breaking changes for only six days (9). CLI v1.0.0 was released on 29 October 2026 and v1.3.0 on 4 November (15). The 99 per cent availability target on factory.com/sla is not scored on this reading.)
- Maintenance & community, Droid CLI +21: Conductor 58 (0.93.0 on 4 November 2026 (30). Several dated releases in 90 days, per the changelog index (20). Discord, a subreddit and email for support (8). Closed app, no package or CI to read (0). 30 + 20 + 8 + 0 + 0 = 58. The local app gets new models and critical fixes only until early 2027.); Droid CLI 79 (The changelog's newest entry is CLI v1.3.0 of 4 November 2026 (30). 67 dated changelog entries between 6 August and 4 November 2026, 20 of them after 9 October (20). The public tracker had 33 open issues that are not pull requests on 9 October 2026, most with no reply, and three closed in the previous week after two or three comments, not re-read on 4 November. Support is also by email and Discord, where reply times are not visible (9). The TypeScript SDK repository moved to 0.10.0 with examples tested in CI on 20 October 2026, and the Python SDK is at 0.5.0 of 24 September 2026 (15). The npm package is published from GitHub Actions through a trusted publisher and the installer checks a checksum, per the 9 October check. There is no public CI for the CLI (5).)
- Schema & documentation, Droid CLI +19: Conductor 60 (Harness reading. Docs for workspaces, review and merge, a Conductor API reference page linked from the docs (not read), and security and permissions pages (60).); Droid CLI 79 (Framework reading. The docs index links an OpenAPI file for the Factory public API, which we did not open, and the headless mode has a documented JSON-RPC surface with named methods. `droid exec --list-tools --output-format json` and `droid rules check --json` give machine-readable output. We found no published schema for the settings file (15). docs.factory.com/llms.txt lists a Markdown copy of every page (10). The overview says when to use the CLI, and the autonomy table says what each level allows, blocks and suits (16). Autonomy levels, output formats, sandbox modes and MCP server fields are enumerated with types and defaults (12). Examples on every page read, exit codes 0, 1 and 2, and a JSON result with `is_error` and `subtype`, with no error catalogue (11). A changelog by CLI version with dates and an RSS feed, 236 entries back to 30 September 2025 (15).)
- Security & auth, Droid CLI +18: Conductor 45 (Closed app. Telemetry and data handling weren't read beyond the transition notice (10 of 30). A security and permissions page (10 of 20). No prompt-injection guidance found (5). No audit log found (5). SOC 2 Type II report at trust.conductor.build (15 of 20). 10 + 10 + 5 + 5 + 15 = 45.); Droid CLI 63 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The agent loop runs locally and the docs say no copy of the repository is uploaded or indexed. Prompts and context go to the model endpoints. Usage metrics go to Factory's collector by default, with no opt-out in the pages read outside an airgapped deployment, and message content is never sent to it. The security page says code is not used as training data. Zero data retention is listed as a Business plan item. Headless runs use a long-lived `fk-` key (17). `droid exec` is read-only by default, autonomy has four levels, permission rules allow, ask or block commands, and an OS sandbox confines commands with Seatbelt or bubblewrap and a network proxy. The sandbox is off by default and `--skip-permissions-unsafe` skips every prompt (16). The sandbox page names prompt injection and states what the sandbox does not stop, MCP approvals are bound to the server's command or URL, and Droid Shield scans commits for secrets. The Agent Safety page was not read (9). An organisation audit log, OpenTelemetry export and session tags exist, with audit logging listed from the Business plan up (10). A disclosure address (security@factory.com), SOC 2 and ISO 42001 named on the security page, per the 9 October check, and Security sections in the changelog. No security.txt (404 on 4 November), no bug bounty and no published advisories were found, OSV holds nothing for `droid`, and the trust centre was not readable (11).)
- Agent ergonomics, Droid CLI +17: Conductor 55 (Harness reading. Each task gets a workspace, branch, terminal and diff, with pull requests and merges from the app, and an API for integrations; not re-read in detail (55).); Droid CLI 72 (Harness reading of the framework line. `--restrict-tools`, `--disabled-tools`, `--additional-tools` and `--list-tools` control built-in tools per run, and `disabledTools` in `mcp.json` keeps named MCP tools out of context. We found nothing on deferred tool loading (18). Output is text, json, stream-json or stream-jsonrpc, and the JSON result carries turns and duration. The `droid exec` help lists no flag for a turn or spend limit (10). Exit codes 0, 1 and 2 are documented, and a run that exceeds its autonomy level stops with a non-zero code and no partial changes, per the docs (15). `--session-id` continues a session, `--fork` branches one, and `--worktree` isolates parallel runs (16). Headless runs are read-only without flags, and TypeScript and Python SDKs wrap the CLI. A run needs a paid Factory account and an API key (13).)
- Transparency & trust, Droid CLI +12: Conductor 53 (Closed service with terms and privacy pages (15). The transition notice says when Cloud data deletion begins (20 November) and that all user data is deleted when the app shuts down in early 2027 (20 of 30). Dated shutdown notice (15 of 20). SOC 2 report on a trust portal, subprocessors not read (10 of 20). 15 + 20 + 15 + 10 = 60.); Droid CLI 65 (Closed source under terms from The San Francisco AI Factory, Inc., last updated 14 July 2026. The npm package is marked `UNLICENSED` and the Python SDK is Apache-2.0 (15). The Data Flows page says where code, prompts and telemetry go in each deployment pattern, and the privacy policy (20 August 2026) lists service providers with the place of processing and keeps personal data up to 10 years after last use. Retention of Factory's operational logs is left to the trust centre, which we could not read, and whether session transcripts are stored in Factory's cloud on individual plans was not established (17). The terms promise commercially reasonable efforts to give 60 days' notice of major changes, the changelog has Deprecations sections, and the old command lists are deprecated but still honoured. A model retirement appeared in the changelog on the day it took effect, 11 August 2026 (12). The telemetry reference documents each metric and what reaches Factory, and `telemetry.granularity` can strip user identity. Metrics to Factory are on by default, with no opt-out found outside an airgapped deployment (11).)