Conductor vs GitHub Copilot CLI

Conductor 0

No new sign-ups since 4 November, free users can't upgrade, and no price is shown. No protocol, no published price, no open free tier, no onboarding (0).

GitHub Copilot CLI 40

Harness reading of the published rubric. No payment protocol (0). Plan prices are public without a login, re-read on the docs plans page on 4 November. Pro $10, Pro+ $39, Max $100 a month, Business $19 and Enterprise $39 a seat, with usage past an organisation's pool at $0.01 per AI credit (20). Copilot Free includes the CLI with an allowance of AI credits and auto model selection only, and no card per the 2 October check (20). A person signs in to GitHub or creates the token (0). 0+20+20+0 = 40.

Conductor 25

Read as local software that is winding down. Installed from Conductor's own download, which stopped taking new users on 4 November 2026 (10). Closed source, so no public CI or issue tracker (0, 0). A dated changelog, newest 0.93.0 on 4 November (15). Version 0.93 (0). 10 + 0 + 0 + 15 + 0 = 25.

GitHub Copilot CLI 55

Local-package reading. npm, Homebrew, WinGet and an install script for Linux, macOS and Windows, with PowerShell 6 or newer named for Windows, though the npm package declares no engines, per the 17 October check (20). No public CI or test suite, since the source isn't published, and the repository holds only the README, licence, changelog, install script and a container folder, per a clone on 4 November (0). About 1,900 open issues and 28 open pull requests, labelled by area and platform with a triage label and no-response automation, per the 1 October check, not re-read on 4 November (12). A dated changelog for every release, with breaking changes marked BREAKING, though they ship in 1.0.x patch versions, and 1.0.103 removed the --no-remote flag without the label (8). 1.0 since March 2026, at 1.0.105 on 27 October per the changelog and tag (15). Same reading as Claude Code and Cursor CLI, which are also closed source. 20+0+12+8+15 = 55.

Conductor 53

Closed service with terms and privacy pages (15). The transition notice says when Cloud data deletion begins (20 November) and that all user data is deleted when the app shuts down in early 2027 (20 of 30). Dated shutdown notice (15 of 20). SOC 2 report on a trust portal, subprocessors not read (10 of 20). 15 + 20 + 15 + 10 = 60.

GitHub Copilot CLI 74

Proprietary licence with clear terms for running and redistributing (15). The data-use page dates the training change (24 April 2026), says which plans it covers and how to opt out, and says Business and Enterprise data isn't used, re-read on 4 November, but we didn't find retention periods for CLI sessions (18). On 15 October 2026 GitHub gave dated notice that Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave all Copilot experiences on 16 November 2026, with a named alternative for each, per the 17 October check. Breaking changes are mostly marked in a dated changelog. There's no written deprecation policy or notice period, the same reading as openai-codex and gemini-cli (15). The command reference now lists --disable-client-telemetry, added in 1.0.100 on 19 October, so client telemetry is disclosed with an opt-out, but no page says what it sends. OpenTelemetry export is documented and opt-in (12). 15+18+15+12 = 60.

Conductor 45

Closed app. Telemetry and data handling weren't read beyond the transition notice (10 of 30). A security and permissions page (10 of 20). No prompt-injection guidance found (5). No audit log found (5). SOC 2 Type II report at trust.conductor.build (15 of 20). 10 + 10 + 5 + 5 + 15 = 45.

GitHub Copilot CLI 65

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Since 1.0.100 (19 October 2026) --disable-client-telemetry turns off the telemetry the CLI sends, which the command reference says doesn't affect server-side telemetry. Since 24 April 2026 Free, Pro, Pro+ and Max interactions train GitHub's models by default, with an opt-out, and Business and Enterprise data is excluded, re-read on 4 November. A fine-grained token with only the Copilot Requests permission works for CI (16). Asks before the first use of each modifying tool, deny rules that beat --allow-all-tools, URL and path permissions, trusted directories and enterprise managed settings. Local sandboxing is generally available since 1.0.93 (7 October 2026) and off by default, enterprises can require it fail-closed, and since 1.0.100 the sandbox allows local network access by default. Assisted Permissions, where a model approves requests it judges safe, left experimental mode in 1.0.104. The CLI still can't enforce two organisation MCP policies (17). The sandbox proxy filters hosts, sandboxed shells withhold GITHUB_TOKEN since 1.0.92, and content exclusion applies, but we found no prompt-injection guidance for the CLI (9). OpenTelemetry export with GenAI spans, opt-in, with enterprise capture controls since 12 October, and session logs (13). Two advisories with CVEs in 2026 and none since on OSV, re-read on 4 November, but no SECURITY.md in the repository and an expired security.txt on github.com per the 26 September check, which the proxy still refuses. We didn't check GitHub's bug bounty (10). SOC 2 isn't scored on the framework reading. 16+17+9+13+10 = 65.

Conductor 58

0.93.0 on 4 November 2026 (30). Several dated releases in 90 days, per the changelog index (20). Discord, a subreddit and email for support (8). Closed app, no package or CI to read (0). 30 + 20 + 8 + 0 + 0 = 58. The local app gets new models and critical fixes only until early 2027.

GitHub Copilot CLI 77

1.0.105 on 27 October 2026 per the changelog and its tag, 8 days before this check. Tags 1.0.106-1 to 1.0.106-8 (30 October) are pre-releases with no changelog entry and don't count (30). 25 dated releases from 1.0.79 (10 August) to 1.0.105 (27 October) in the 90 days from 6 August (20). Issues are labelled and triaged, with automation for stale and unanswered reports, though about 1,900 stay open, per the 1 October check (14). An SDK the changelog keeps updating (session APIs, MCP management, OAuth tokens), languages unchecked (10). Closed source and a bundled npm build, so no CI or dependency health to read (3). 30+20+14+10+3 = 77.

Conductor 55

Harness reading. Each task gets a workspace, branch, terminal and diff, with pull requests and merges from the app, and an API for integrations; not re-read in detail (55).

GitHub Copilot CLI 72

Framework reading, adapted to a harness driven by a pipeline. --available-tools and --excluded-tools shape the tool list and --deny-tool removes tools, and MCP tool discovery recovers without a restart (20). --max-autopilot-continues caps autopilot, and a turn timeout applies to background work in -p (15). JSON output, and a 2026 release replaced a misleading auth error with the real cause (12). --resume and --continue, and permission prompts survive a resumed session (15). An SDK exists, per the changelog, but we didn't check its languages, and a headless run needs explicit allow flags to do anything (10).