Get an audit

Head to head · Agent harness · October 2026 research run

Devin vs Kiro CLI

Kiro CLI scores 59.9 (C) on agent readiness against Devin's 55.7 (C), and leads in 4 of 7 scored categories. Devin leads on security & auth. Both do agent harness.

DevinCognition AI, Inc. · Agent harness C55.7/100#447 of 629 Kiro CLIAmazon Web Services · Agent harness C59.9/100#370 of 629

Which one, for what

Devin C

Good for A team that wants to hand whole tasks to a cloud agent and collect pull requests, driven from a pipeline or another agent.

Ahead on

  • Security & auth, 72 against 66

Also in its favour

  • A hosted endpoint, with nothing to install
  • No incidents deducted, where Kiro CLI loses 4 points for them

Watch for

www.devinstatus.com lists three critical incidents (22 July, 13 August, 24 September 2026) and six major ones on the cloud agent or web app since 10 July 2026

Kiro CLI C

Good for Teams on AWS that want one agent configuration across terminal, IDE and web, with central permission policy, prompt logging to their own S3 bucket and IAM Identity Centre sign-in.

Ahead on

  • Reliability, 57 against 30
  • Agent ergonomics, 67 against 62
  • Payments & pricing, 40 against 20
  • Maintenance & community, 73 against 63

Also in its favour

  • Free to start without a card

Watch for

Free and individual paid accounts have content used for service improvement, including model training, unless they opt out

Score by category

CategoryWeight this runDevinKiro CLIEdge
Reliability16%203057Kiro CLI +27
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28079Devin +1
Agent ergonomics13%16.26267Kiro CLI +5
Security & auth14%17.57266Devin +6
Payments & pricing10%12.52040Kiro CLI +20
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.86373Kiro CLI +10
Transparency & trust7%8.86967Devin +2
Negative events≤150-4
Total55.7 · C59.9 · C

Facts side by side

FactDevinKiro CLI
KindAgent harnessAgent harness
VendorCognition AI, Inc.Amazon Web Services
Hosted endpointhttps://mcp.devin.ai/mcpno (local only)
TransportsHTTP
AuthAPI keyOAuth or key
PricingFreemiumFreemium
x402nono
LicenceProprietary service under Cognition's Platform Terms of ServiceProprietary. Licensed as AWS Content under the AWS Customer Agreement and the AWS Intellectual Property Licence (https://kiro.dev/license/). The GitHub repository is the public issue tracker and doesn't hold the source
Tools exposed13none
Read-only variant documentedyesno
llms.txtyesyes
Last release2026-10-072026-10-05
Terms last updated2026-06-302026-08-14
Privacy policy last updated2026-03-092026-05-18
Customer content may train modelsyes, with an opt-outnot found in the text
Terms restrict automated accessnot found in the textnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textnot found in the text
Arbitration or class-action waiveryesyes
Popularitynone4.4k stars

Verdicts

Devin

The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.

Kiro CLI

Permission rules follow deny over ask over allow, cloned repositories can't add rules, and a headless session treats every ask as a deny. Content from Free and individual paid accounts is used for service improvement, including model training, unless the user opts out, and API keys for pipelines need a paid plan.

Before you call either

Devin

  1. Use a cog_ service-user key with the Member role. Legacy apk_ keys fail against v3 and the MCP server with 401 or 403
  2. Set max_acu_limit on every session you create. Usage is metered by the work done and has no published unit rate
  3. Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again
  4. Enterprise keys and personal access tokens must send X-Org-Id to the MCP server. Organisation-scoped keys resolve it automatically
  5. Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026

Kiro CLI

  1. Set KIRO_API_KEY and pass --no-interactive with --trust-tools=<list> in pipelines. Keep --trust-all-tools for disposable environments
  2. Pass --require-mcp-startup when a run depends on MCP tools. Without it a failed server is logged and the run continues
  3. Pass --no-interactive whenever input is piped from a source you don't control, and run 2.10.0 or later on Windows
  4. Run kiro-cli settings telemetry.enabled false and turn off content collection on Free and individual plans. Both are on by default
  5. Export variables in the shell before starting. Since 2.24.0 a project .env file is no longer loaded into sessions, MCP servers or tools

Questions

Which is better for AI agents, Devin or Kiro CLI?

Kiro CLI scores 59.9 (C) on agent readiness against Devin's 55.7 (C), and leads in 4 of 7 scored categories. Devin leads on security & auth.

Other comparisons with Devin or Kiro CLI

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report