Conductor vs OpenHands

Conductor 25

Read as local software that is winding down. Installed from Conductor's own download, which stopped taking new users on 4 November 2026 (10). Closed source, so no public CI or issue tracker (0, 0). A dated changelog, newest 0.93.0 on 4 November (15). Version 0.93 (0). 10 + 0 + 0 + 15 + 0 = 25.

OpenHands 90

Read as a local package. Official npm package @openhands/agent-canvas (Node 24 or later, plus uv), a Docker image on GHCR and openhands-sdk on PyPI (Python 3.12 or later) (20). A CI workflow (ci.yml) runs on main beside desktop, Docker and end-to-end workflows; the runs passed on every load on 1 October, and GitHub's pages refused us on 1 November, so the award rests on that check (25). 456 open issues and 395 open pull requests with priority labels and a high-priority Cloud resume bug (#17664), per the 1 October check, not re-read on 1 November (18). Dated release notes for every Canvas version and a written SDK rule of at least five minor releases before a public API or REST contract is removed, which the SDK followed on 28 October when it dropped the ACP curated model lists at their stated 1.59.0 deadline, but the Canvas CHANGELOG.md still stops at 1.0.0-alpha.2 (12). Canvas is 1.34.0 and the SDK 1.59.0, and the README's beta badge was removed on 23 October 2026 (commit 4d1c4d1, noted in the 1.33.0 release notes), so the product is no longer labelled beta. Only the Apps extension API keeps a beta label (15).

Conductor 0

No new sign-ups since 4 November, free users can't upgrade, and no price is shown. No protocol, no published price, no open free tier, no onboarding (0).

OpenHands 60

No payment protocol (0). Scored on the paid options and the OpenHands LLM provider. The docs publish per-token prices for the OpenHands LLM provider at provider rates with no markup, and the pricing page now lists Agent Canvas free, Teams at $500 a month for up to 10 users (plus $50 a seat, 30-day trial) and Enterprise by sales (20). The MIT stack is free to self-host, and two DeepSeek models are free on app.all-hands.dev (20). It runs any model through LiteLLM, local ones included, so an agent can install and run it with no signup (20). The provider price table still lists 2025 models, so it may be stale.

Conductor 60

Harness reading. Docs for workspaces, review and merge, a Conductor API reference page linked from the docs (not read), and security and permissions pages (60).

OpenHands 90

The Agent Server REST API has an OpenAPI 3.1 spec in the docs repository (40 paths, still labelled 0.1.0), the Cloud API has another (155 paths), SDK models are Pydantic-typed and there's a TypeScript client (25). llms.txt at docs.openhands.dev (551 lines on 1 November), with no CLI, local GUI or V0 pages in it (10). The docs have a when-to-use page and examples of good and bad task instructions. On 23 October the Deprecated Projects group (local GUI, CLI, V0) was taken out of the navigation and links to it reworded towards Agent Canvas, though the pages stay reachable by URL and the SDK architecture page still links the CLI repository (15). Confirmation policies, security analysers and MCP configs are discriminated Pydantic unions with validators (13). SDK examples are checked by a CI workflow and there are troubleshooting pages, but we found no error reference for the Agent Server (12). Dated release notes for each Canvas version in the docs (1.25.0 to 1.34.0 added since 1 October), and release tags (15).

Conductor 58

0.93.0 on 4 November 2026 (30). Several dated releases in 90 days, per the changelog index (20). Discord, a subreddit and email for support (8). Closed app, no package or CI to read (0). 30 + 20 + 8 + 0 + 0 = 58. The local app gets new models and critical fixes only until early 2027.

OpenHands 85

Agent Canvas 1.34.0 on 2026-10-27 and SDK 1.59.0 on 2026-10-28, by the repository tags (30). 29 Canvas releases (1.9.0 on 3 August to 1.34.0) and 33 SDK releases (1.40.1 on 5 August to 1.59.0) in the 90 days from 3 August, not counting the security rebuild tags (20). Issues labelled by priority, but 456 open issues and 395 open pull requests and no visible reply times per the 1 October check; GitHub's pages refused us on 1 November (16). npm, PyPI and GHCR packages current per the 1 October check (the registries didn't answer from our shell on 1 November). The unmaintained openhands CLI is gone from the docs navigation and the pricing page but its pages remain (10). CI on main, Dependabot, a security scan and an API-breakage check on the SDK, and security rebuilds of older images (agent-canvas 1.23.0-r3, agent-server 1.49.5-r3, 29 October) (9).

Conductor 55

Harness reading. Each task gets a workspace, branch, terminal and diff, with pull requests and merges from the app, and an API for integrations; not re-read in detail (55).

OpenHands 78

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. The default agent carries three tools (terminal, file editor, task tracker), and filter_tools_regex trims MCP tools before they reach the model (23). Stuck detection is on by default and a condenser compacts long histories, but Canvas leaves max_iterations unset and we found no cost cap (15). Headless runs go through the SDK, the Agent Server REST API or the Cloud API with typed events, and the old CLI's --headless mode is unmaintained (14). Conversations persist and resume, and a Docker conversation keeps its workspace and history when the container is replaced (16). Python SDK and TypeScript client, but the quickstart needs Node 24 and uv, and the defaults skip both confirmation and the sandbox (10).

Conductor 45

Closed app. Telemetry and data handling weren't read beyond the transition notice (10 of 30). A security and permissions page (10 of 20). No prompt-injection guidance found (5). No audit log found (5). SOC 2 Type II report at trust.conductor.build (15 of 20). 10 + 10 + 5 + 5 + 15 = 45.

OpenHands 64

Harness reading of the framework checklist, as for goose and the other agent harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Agent Canvas still sends a canvas_install event to PostHog through z.openhands.dev on first use "regardless of consent" (telemetry.ts header, re-read on 1 November), and the consent banner's box is still defaultChecked. AGENT_CANVAS_DISABLE_TELEMETRY=1, --disable-telemetry, VITE_DO_NOT_TRACK=1 or the browser's Do Not Track setting stops all of it, the last since 1.26.0 (15). Confirmation policies (always, never, at or above a risk level) and a Docker sandbox per conversation exist, but Canvas still starts with confirmation_mode: false and the npm install runs on the host with full filesystem access. No network egress controls found. Local listeners bind to 127.0.0.1 with an injected session key, and since SDK 1.52.0 (5 October) DockerWorkspace publishes its ports on loopback (12). LLM, Invariant and GraySwan risk analysers and a policy-rail module, documented, all advisory (11). Conversation event logs, completion logs and OpenTelemetry tracing through Laminar, with hosted Laminar setup documented on 16 October (13). Security programme. openhands.dev's security.txt expired on 28 October 2026 (re-read on 1 November), though the responsible-disclosure policy it names still loads. A Vanta-hosted trust page per the 1 October check, and the git diff injection published as an OpenHands advisory with a CVE. CVE-2026-112346, the SDK's unauthenticated sandbox server, was published by VulnCheck on 26 October with no OpenHands advisory found. No bug bounty found. 13, down from 15 for the expired file, read as shopware's and tokeneconomizer's expired files are (still credited for the policy behind them, less than a valid file).