Devin vs Sculptor

Devin 20

Published rubric. No payment protocol (0). Plan prices are public, $20, $200 and $40 a seat with an $80 team minimum, but usage past the quota is billed at an unpublished rate (10). A Free plan exists. The pricing page lists cloud agents from Pro upward, and we couldn't confirm API use on Free or whether a card is needed (10). A person signs up in a browser and provisions the service user in settings (0).

Sculptor 60

Free self-hosted software with nothing to buy, so 0 for a protocol and 20 each for public pricing, a free tier and onboarding with no sign-up, 60.

Devin 80

API reading. Public OpenAPI 3.1 spec for v3 with 182 paths and 274 operations on 4 November 2026, and separate v1 and v2 specs (25). llms.txt with 393 lines and a Markdown twin of every page (10). Each endpoint page names its required permission, but 63 of 274 operations have no description and the MCP tool descriptions are one line each (10). Enums on fields such as devin_mode, origin and category, with most strings unconstrained and nullable (9). curl examples in the quick starts, and 401, 403, 404, 409, 422 and 429 declared on all 274 operations, without a catalogue of error_code values (11). Versioned paths (v1, v2, v3, v3beta1) and an API release notes page dated by month, newest November 2026 (15).

Sculptor 45

Harness reading. A README, specs and agent docs in the repository; no API reference (45).

Devin 75

Editorial half. Closed source with clear terms from Cognition AI, Inc. (15). Terms (30 June 2026), privacy policy, security page and data processing agreement agree with each other. Customer data may be used for model training by default on self-serve plans, with an opt-out on paid plans that also turns on zero data retention at model providers, and Enterprise data isn't trained on without written consent. Retention is stated as the length of the customer relationship, with no periods (18). The API versioning policy on the release notes page says breaking changes are announced at least 7 days in advance and a deprecated endpoint stays available through a deprecation period. Dated notices followed it for the schedules endpoints (announced 10 September, creation refused from 24 September 2026), and others cover the v2 clone endpoint and Playbooks moving to Skills (23 October). v1 and v2 are marked legacy with no end date (20). Sub-processors listed with purpose and country, and 15 days' notice of additions, per the 8 October check (18).

Sculptor 57

MIT (30). Consent-based telemetry documented in the repository (18 of 30). The README warns of drastic changes during the research preview, with no deprecation policy (5). Opt-in telemetry (20). 30 + 18 + 5 + 20 = 73.

Devin 72

Hosted reading. Service-user keys with roles and named permissions per endpoint, revocable, with rotation endpoints in beta for Enterprise and expiring personal tokens. Custom roles are an Enterprise option, and Teams has Admin and Member only (25). Security profiles restrict network, MCP servers, git and the Devin MCP to read-only, and read-only API permissions exist. They are opt-in, and session creation accepts bypass_approval (16). AI Guardrails screen user messages and pull request comments for prompt injection, on Enterprise only, and they don't cover web pages or repository content Devin reads (8). Audit logs through the API need an enterprise-level permission. Session events and insights are available on all plans (10). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address at security@cognition.ai, no security.txt, and the trust centre answers No to having a bug bounty (13).

Sculptor 57

Harness reading. Product analytics, error reporting and session recording default to off in the user config, and the app asks for a telemetry level and privacy consent at first run; PostHog runs on the front end only for now (25 of 30). Each workspace is an isolated copy of the code (14 of 20). No prompt-injection guidance (5). No audit log (5). SECURITY.md (8). 25 + 14 + 5 + 5 + 8 = 57.

Devin 62

API and MCP reading. The MCP server documents 13 tools, several of them consolidated manage tools, and list endpoints take first to size a page (17). Cursor pagination on every v3 list endpoint and filters on session search by tag, playbook, origin, user and time (18). problem+json with error_code, field-level errors on 422 and a 400 that lists valid platform names, but no published code list (15). No idempotency key on v3 session creation. max_acu_limit caps what a session can spend, and the MCP tool annotations couldn't be read without a key (4). Only prompt is required to start a session. No official SDK found, only a Terraform provider (8).

Sculptor 50

Harness reading. Workspaces as isolated copies, review and merge back, and built-in skills (50).

Devin 63

Closed service. Newest release note dated 2 November 2026 (30). Thirty dated release notes between 7 August and 2 November 2026, and API notes for August, September, October and November (20). Public release notes and a support address, with no public tracker or forum found (10). No official SDK for the Devin API found (a Python SDK in the federal docs covers analytics and ACU limits for air-gapped Desktop), and the Devin MCP server didn't appear in the official MCP registry per the 8 October check (0). No public CI or packages to assess, with the docs and three OpenAPI specs kept current (3).

Sculptor 75

Commits on 6 November 2026 and frequent tagged versions (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent; the README says Imbue can't take many outside contributions yet (0). Current official downloads (15). CI on pull requests (10). 30 + 20 + 0 + 15 + 10 = 75.