# Devin vs Letta (slim)

> Letta scores 59.7 (C) to Devin's 57.3 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/devin-vs-letta.md (~6,300 tokens) · this version ~2,730 tokens · JSON https://www.anchorterminal.com/compare/devin-vs-letta.json · canonical https://www.anchorterminal.com/compare/devin-vs-letta
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Letta scores 59.7 (C) on agent readiness against Devin's 57.3 (C), and leads in 4 of 7 scored categories. Devin leads on schema & documentation, security & auth and transparency & trust. Both do agent harnesses.

- Devin: C 57.3, rank #801 of 1510 · https://www.anchorterminal.com/tools/devin.min.md
- Letta: C 59.7, rank #687 of 1510 · https://www.anchorterminal.com/tools/letta.min.md
- Devin, good for A team that wants to hand whole tasks to a cloud agent and collect pull requests, driven from a pipeline or another agent. Ahead on Schema & documentation, 80 against 70; Security & auth, 72 against 35; Transparency & trust, 75 against 55. Also A hosted endpoint, with nothing to install.
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Ahead on Reliability, 58 against 35; Agent ergonomics, 67 against 62; Payments & pricing, 60 against 20; Maintenance & community, 85 against 63. Also Runs on your own machine; Open source.

| Category | Devin | Letta |
| --- | --- | --- |
| Reliability (16%) | 35 | 58 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 70 |
| Agent ergonomics (13%) | 62 | 67 |
| Security & auth (14%) | 72 | 35 |
| Payments & pricing (10%) | 20 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 63 | 85 |
| Transparency & trust (7%) | 75 | 55 |

| Fact (where they differ) | Devin | Letta |
| --- | --- | --- |
| Vendor | Cognition AI, Inc. | Letta |
| Hosted endpoint | `https://mcp.devin.ai/mcp` | no (local only) |
| Transports | HTTP | stdio |
| Auth | API key | OAuth or key |
| Licence | Proprietary service under Cognition's Platform Terms of Service | Apache-2.0 |
| Tools exposed | 13 | none |
| Read-only variant documented | yes | no |
| Last release | 2026-11-02 | 2026-11-06 |
| Terms last updated | 2026-06-30 | no date given |
| Privacy policy last updated | 2026-03-09 | no date given |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | none | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk |

Why the edge:
- Payments & pricing, Letta +40: Devin 20 (Published rubric. No payment protocol (0). Plan prices are public, $20, $200 and $40 a seat with an $80 team minimum, but usage past the quota is billed at an unpublished rate (10). A Free plan exists. The pricing page lists cloud agents from Pro upward, and we couldn't confirm API use on Free or whether a card is needed (10). A person signs up in a browser and provisions the service user in settings (0).); Letta 60 (No x402, MPP or L402 (0 of 40). Per-unit API prices are public, $0.10 per active agent a month and $0.00015 a second of tool execution, plus plan prices (20). A $0 plan with bring-your-own keys; no card is mentioned (20). The CLI runs locally without signing in (20). Total 60.)
- Security & auth, Devin +37: Devin 72 (Hosted reading. Service-user keys with roles and named permissions per endpoint, revocable, with rotation endpoints in beta for Enterprise and expiring personal tokens. Custom roles are an Enterprise option, and Teams has Admin and Member only (25). Security profiles restrict network, MCP servers, git and the Devin MCP to read-only, and read-only API permissions exist. They are opt-in, and session creation accepts `bypass_approval` (16). AI Guardrails screen user messages and pull request comments for prompt injection, on Enterprise only, and they don't cover web pages or repository content Devin reads (8). Audit logs through the API need an enterprise-level permission. Session events and insights are available on all plans (10). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address at security@cognition.ai, no security.txt, and the trust centre answers No to having a bug bounty (13).); Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.)
- Reliability, Letta +23: Devin 35 (Hosted reading. Status page at www.devinstatus.com (Atlassian Statuspage) with 14 components, among them Cloud Agent and Cloud Web Client, read from the page itself on 4 November 2026 (20). Its history feed for the 90 days from 6 August 2026 lists Devin unavailable on 13 August (20 minutes), Devin Cloud unavailable on 13 August (2 hours 40 minutes) and the web app down on 24 September (about 2 hours), with minor session and Ask Devin incidents on 10 and 11 August, 3 and 17 September and 26 October. Both 13 August entries report the service unavailable. The 24 September entry names only the web app, not the API or the MCP server, so it is read as partial, as dashboard outages are on other listings. Two majors (5). Two scheduled maintenance entries (7 and 17 August) are read as maintenance. 429 is a documented response, but no rate limit figures were found (0). No Retry-After or backoff guidance found, and v3 session creation has no idempotency key (0). The platform terms give no guarantee of availability, and enterprise terms weren't read (0). The v3 API is the current, recommended surface, with 27 of 274 operations under /v3beta1 (10).); Letta 58 (Local-software lines, read for the harness. `@letta-ai/letta-code` on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.)
- Maintenance & community, Letta +22: Devin 63 (Closed service. Newest release note dated 2 November 2026 (30). Thirty dated release notes between 7 August and 2 November 2026, and API notes for August, September, October and November (20). Public release notes and a support address, with no public tracker or forum found (10). No official SDK for the Devin API found (a Python SDK in the federal docs covers analytics and ACU limits for air-gapped Desktop), and the Devin MCP server didn't appear in the official MCP registry per the 8 October check (0). No public CI or packages to assess, with the docs and three OpenAPI specs kept current (3).); Letta 85 (v0.34.42 on 6 November 2026 (30). Dozens of releases in 90 days (20). Pull requests are merged daily; recent issues from users have few replies (15 of 25). npm and PyPI packages and the Agent SDK track the releases (12 of 15). Lock files, CI and nightly smoke tests (8 of 10). Total 85.)
- Transparency & trust, Devin +20: Devin 75 (Editorial half. Closed source with clear terms from Cognition AI, Inc. (15). Terms (30 June 2026), privacy policy, security page and data processing agreement agree with each other. Customer data may be used for model training by default on self-serve plans, with an opt-out on paid plans that also turns on zero data retention at model providers, and Enterprise data isn't trained on without written consent. Retention is stated as the length of the customer relationship, with no periods (18). The API versioning policy on the release notes page says breaking changes are announced at least 7 days in advance and a deprecated endpoint stays available through a deprecation period. Dated notices followed it for the schedules endpoints (announced 10 September, creation refused from 24 September 2026), and others cover the v2 clone endpoint and Playbooks moving to Skills (23 October). v1 and v2 are marked legacy with no end date (20). Sub-processors listed with purpose and country, and 15 days' notice of additions, per the 8 October check (18).); Letta 55 (Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.)
- Schema & documentation, Devin +10: Devin 80 (API reading. Public OpenAPI 3.1 spec for v3 with 182 paths and 274 operations on 4 November 2026, and separate v1 and v2 specs (25). llms.txt with 393 lines and a Markdown twin of every page (10). Each endpoint page names its required permission, but 63 of 274 operations have no description and the MCP tool descriptions are one line each (10). Enums on fields such as `devin_mode`, `origin` and `category`, with most strings unconstrained and nullable (9). curl examples in the quick starts, and 401, 403, 404, 409, 422 and 429 declared on all 274 operations, without a catalogue of `error_code` values (11). Versioned paths (v1, v2, v3, v3beta1) and an API release notes page dated by month, newest November 2026 (15).); Letta 70 (Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an `applies_to` block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.)