Crush vs Devin

Crush

Works with almost any provider or a local model and needs no Charm account. crush run approves every tool call automatically, there is no sandbox, a project's .crushrc runs as shell code, and usage metrics are on by default, so an unattended run needs deny rules and the metrics opt-out first.

Devin

The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.

Crush

1. Add permissions deny rules or a PreToolUse hook before crush run. It approves every permission request in its session
2. Read .crushrc, crushrc and crush.json in a cloned repository before running Crush there. They execute as shell code at startup
3. Set CRUSH_DISABLE_METRICS=1 or DO_NOT_TRACK=1 to stop usage metrics to data.charm.land
4. Wrap crush run in your own timeout. It has no turn, time or cost limit flag
5. Configure a provider by environment variable or crushrc first. With none, crush run exits with an error asking for interactive setup

Devin

1. Use a cog_ service-user key with the Member role. Legacy apk_ keys fail against v3 and the MCP server with 401 or 403
2. Set max_acu_limit on every session you create. Usage is metered by the work done and has no published unit rate
3. Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again
4. Enterprise keys and personal access tokens must send X-Org-Id to the MCP server. Organisation-scoped keys resolve it automatically
5. Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026