Get an audit

Head to head · Agent harness · October 2026 research run

Devin vs Kilo Code CLI

Kilo Code CLI scores 75.4 (BB) on agent readiness against Devin's 55.7 (C), and leads in 6 of 7 scored categories. Devin leads on security & auth. Both do agent harness.

DevinCognition AI, Inc. · Agent harness C55.7/100#586 of 841 Kilo Code CLIKilo Code Inc. · Agent harness BB75.4/100#47 of 841

Which one, for what

Devin C

Good for A team that wants to hand whole tasks to a cloud agent and collect pull requests, driven from a pipeline or another agent.

Ahead on

  • Security & auth, 72 against 66

Also in its favour

  • A hosted endpoint, with nothing to install

Watch for

www.devinstatus.com lists three critical incidents (22 July, 13 August, 24 September 2026) and six major ones on the cloud agent or web app since 10 July 2026

Kilo Code CLI BB

Good for Developers who want an open-source terminal agent with per-tool permission rules, an optional sandbox and a choice of provider, and the same engine in VS Code and JetBrains.

Ahead on

  • Reliability, 85 against 30
  • Schema & documentation, 90 against 80
  • Agent ergonomics, 72 against 62
  • Payments & pricing, 50 against 20
  • Maintenance & community, 87 against 63
  • Transparency & trust, 76 against 69

Also in its favour

  • Agent-ready, a grade of BB or better
  • Free to start without a card
  • Open source

Watch for

Telemetry to PostHog is on by default, and the privacy policy and PRIVACY.md don't mention it

Score by category

CategoryWeight this runDevinKilo Code CLIEdge
Reliability16%203085Kilo Code CLI +55
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28090Kilo Code CLI +10
Agent ergonomics13%16.26272Kilo Code CLI +10
Security & auth14%17.57266Devin +6
Payments & pricing10%12.52050Kilo Code CLI +30
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.86387Kilo Code CLI +24
Transparency & trust7%8.86976Kilo Code CLI +7
Negative events≤1500
Total55.7 · C75.4 · BB

Facts side by side

FactDevinKilo Code CLI
KindAgent harnessAgent harness
VendorCognition AI, Inc.Kilo Code Inc.
Hosted endpointhttps://mcp.devin.ai/mcpno (local only)
TransportsHTTP
AuthAPI keyOAuth or key
PricingFreemiumFreemium
x402nono
LicenceProprietary service under Cognition's Platform Terms of ServiceMIT
Tools exposed13none
Read-only variant documentedyesno
llms.txtyesyes
Last release2026-10-072026-10-07
Terms last updated2026-06-302026-09-30
Privacy policy last updated2026-03-092026-05-29
Customer content may train modelsyes, with an opt-outnot found in the text
Terms restrict automated accessnot found in the textyes
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textyes
Arbitration or class-action waiveryesyes
Popularitynone28k stars, 33k npm/wk

Verdicts

Devin

The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

Before you call either

Devin

  1. Use a cog_ service-user key with the Member role. Legacy apk_ keys fail against v3 and the MCP server with 401 or 403
  2. Set max_acu_limit on every session you create. Usage is metered by the work done and has no published unit rate
  3. Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again
  4. Enterprise keys and personal access tokens must send X-Org-Id to the MCP server. Organisation-scoped keys resolve it automatically
  5. Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026

Kilo Code CLI

  1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
  2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry
  3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
  4. Without --auto a non-interactive run rejects every permission prompt and exits 1
  5. Put provider keys in global config or the environment. {env:VAR} in a project kilo.json is ignored

Questions

Which is better for AI agents, Devin or Kilo Code CLI?

Kilo Code CLI scores 75.4 (BB) on agent readiness against Devin's 55.7 (C), and leads in 6 of 7 scored categories. Devin leads on security & auth.

Are Devin and Kilo Code CLI open source?

No open-source release is listed for Devin. Kilo Code CLI is open source (MIT).

Other comparisons with Devin or Kilo Code CLI

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report