Devin vs Mirror CLI

Devin

The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.

Mirror CLI

Mirror CLI is Apache-2.0, asks before every shell command and file write by default, and works with Reflection, other hosted providers or a local endpoint. It is a one-day-old 0.1.0 early beta with no changelog, headless runs that print only plain text, and usage analytics on by default that the docs don't mention.

Devin

1. Use a cog_ service-user key with the Member role. Legacy apk_ keys fail against v3 and the MCP server with 401 or 403
2. Set max_acu_limit on every session you create. Usage is metered by the work done and has no published unit rate
3. Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again
4. Enterprise keys and personal access tokens must send X-Org-Id to the MCP server. Organisation-scoped keys resolve it automatically
5. Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026

Mirror CLI

1. Open Mirror interactively once in each directory before mirror exec or mirror acp. Both refuse to run until the usage and folder notices are accepted
2. Pass --approval-mode auto to mirror exec only inside a container or VM. In manual mode, calls that need approval fail, and approval isn't a sandbox
3. Set --max-iterations on unattended runs. Turns are unlimited by default
4. Check the result with your own tests. exec returns 0 whenever it prints an answer
5. Never share logs recorded with --log-level debug. The docs say they contain request headers with the API key