Crush vs T3 Code

Crush 65

Harness reading of the framework line. A JSON Schema for the config at https://charm.land/crush.json (also printed by crush schema), --json on the session commands, and an OpenAPI document that crush server generates from its endpoint list and serves at /v1/docs/openapi.json, which isn't published anywhere we could fetch. crush run output has no typed form (20). No llms.txt (charm.land/llms.txt is a not-found page). The docs are Markdown in the repository and the hooks guide says it was written for humans and agents (5). The README and config docs explain when to allow, deny or hook a tool and warn that configs run as code (12). The schema carries enums and defaults, such as the attribution trailer style, while permissions take bare tool names with no command patterns (11). Many examples for providers, MCP, hooks and local models, with no reference for error messages or exit codes (9). Version tags and GitHub releases with generated notes, which we couldn't open, and no changelog file (8).

T3 Code 55

Harness reading. User docs in the repository (managed policy, handoffs, providers, telemetry), AGENTS.md for contributors, a server other clients connect to (55).

Crush 52

Local-package reading. @charmland/crush on npm, a Homebrew tap, Winget, Scoop, AUR, Nix, FreeBSD pkg, Charm's apt and yum repositories and release binaries, with supported platforms named in the README (20). The public build workflow runs go test -race -failfast ./... on Linux, macOS and Windows for every push to main and every pull request, but GitHub pages and the API answer 403 to us, so results are unread (15). The 18 October issue and pull request counts came from shields.io badges, a third-party copy of GitHub data, and are struck. The repository's own refs show 2,574 pull requests to #4224, 272 of them open with a merge ref, and 147 merges into main in the 90 days to 4 November. Crash and regression issues couldn't be read (10). Release notes are generated from commit messages, with no CHANGELOG file and no breaking-change headings found. The legacy JSON config is deprecated in favour of crushrc while still loading (7, held partial). v0.99.0, before 1.0, with no stability statement (0). 20 + 15 + 10 + 7 + 0 = 52.

T3 Code 43

Local software. An install script and desktop and mobile apps from the vendor (20). ci.yml and windows-tests.yml run on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Stable tags v0.1.5 to v0.1.7 with many nightlies, no changelog file (8). Version 0.1.7 (0). 20 + 15 + 0 + 8 + 0 = 43.

Crush 52

Harness reading, scored on what an agent or pipeline driving crush run has to supply. About 20 built-in tools, any of which permissions deny hides, MCP servers take per-server disabled_tools, and skills can be turned off or kept out of the model's list. No lazy loading of MCP tools found (17). No turn, time or cost limit on crush run, and the only output controls are --quiet and --verbose (6). Errors come back as plain messages with a non-zero exit, such as the one for an unconfigured provider, with no documented codes and no JSON error record (8). --session and --continue resume a run, and crush session list, show, last, rename and delete take --json (13). One argument starts a run and environment keys are picked up, but there's no SDK, and the HTTP API needs CRUSH_CLIENT_SERVER=1 and is described only in one README section (8).

T3 Code 60

Harness reading. Remote control from phone or browser, portable handoffs between providers and managed policies for teams (60).

Crush 59

FSL-1.1-MIT, source-available, barring competing commercial use and converting each release to MIT on its second anniversary. Code from before 30 May 2025 is MIT. Not an OSI licence today (20). No privacy policy or terms for Crush were found on charm.land, and Hyper's legal pages render by script and weren't read. The README says Hyper is zero-data-retention, while Hyper's own app says some plans aren't and that usage on them may train Hyper's models, so the statements don't agree (8). The JSON config is marked deprecated with no removal date, and no deprecation policy was found (6). The README discloses usage metrics, links the source, says prompts aren't collected and gives two opt-outs, but doesn't mention the alias to the Hyper account (15).

T3 Code 51

MIT (30). docs/user/telemetry.md lists what is sent and what isn't, but includes hashed third-party account identifiers and the README doesn't mention it (15 of 30). No deprecation policy (5). Disclosed with an opt-out, on by default (12 of 20). 30 + 15 + 5 + 12 = 62.

Crush 82

v0.99.0 tagged on 29 October 2026 (6 days, 30). 21 release tags from 7 August to 29 October, v0.88.1 to v0.99.0, besides a moving nightly tag that isn't counted (20). The 18 October shields.io counts are struck. The repository's refs show 147 merges into main and 438 commits in the 90 days to 4 November, with 272 open pull requests carrying a merge ref, and new contributors signing the CLA most days. Reply times couldn't be read (12). No SDK, as with other harnesses. npm, Homebrew, Winget, Scoop, apt, yum and NUR builds come from the release workflow (12, held partial). Dependabot, a go mod tidy check in CI and nightly security scans, with CI results unread (8). 30 + 20 + 12 + 12 + 8 = 82.

T3 Code 75

Commits and nightly tags on 6 November 2026 (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current official apps and install script (15). CI on push (10). 30 + 20 + 0 + 15 + 10 = 75.

Crush 41

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage metrics go to PostHog through data.charm.land by default, keyed to a hashed machine ID, aliased to the Hyper user ID after a Hyper login, and including error messages. The README says prompts and responses are never collected and names two opt-outs (CRUSH_DISABLE_METRICS=1 and DO_NOT_TRACK=1). The provider list is fetched from Catwalk at startup unless turned off, the update check only notifies, and provider keys stay local (15). The TUI asks before bash, edit, write, fetch, download and MCP calls, permissions deny hides tools and PreToolUse hooks can block calls. But crush run approves every permission request in its session automatically (internal/app/app.go in v0.99.0), --yolo skips all prompts, and there's no sandbox, only a refusal list for curl, wget, ssh, sudo, package managers and similar commands (7). No prompt-injection guidance found, and a project's .crushrc and $(...) in crush.json run as code at startup, which the README warns about (3). Logs in ./.crush/logs/crush.log with crush logs, sessions in a local database readable as JSON, and crush stats, with no OpenTelemetry export (9). The organisation's SECURITY.md is a disclosure policy with a reporting address (vt100@charm.sh) and no response time. CI runs CodeQL, Grype and govulncheck nightly and releases are cosign-signed. OSV lists no advisory for the npm package or the Go module. No security.txt and no bug bounty. A disclosure route with no stated time is this run's 7 (was 10). 15 + 7 + 3 + 9 + 7 = 41.

T3 Code 35

Harness reading. Product usage events go by default to ingest.t3.codes and PostHog, with hashed identifiers for your T3 Connect, OpenAI and Claude accounts, and relay traces to Axiom, which can include machine names and error text. Off with T3CODE_TELEMETRY_ENABLED=false or a managed policy. Disclosed in docs/user/telemetry.md, not the README (10 of 30). Permission modes and managed policies (12 of 20). No prompt-injection guidance (5). No audit log (5). No security policy file found (3). 10 + 12 + 5 + 5 + 3 = 35.