Droid CLI vs mini-swe-agent

Droid CLI

droid exec is read-only unless --auto raises the autonomy level, with command rules, an optional kernel-enforced sandbox, JSON output and documented exit codes. No free tier, status page or security.txt was found, the source is closed, and usage metrics go to Factory by default.

mini-swe-agent

A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

Droid CLI

1. Set FACTORY_API_KEY (starts fk-) from the API keys page in Factory settings for headless runs. Interactive use signs in through a browser
2. Start with droid exec and no flags for analysis. Add --auto low for edits and --auto medium for installs, tests and local commits
3. Use --output-format json and read is_error, num_turns and session_id. Treat a non-zero exit code as failure
4. Set sandbox.enabled to true before running on untrusted code. In droid exec a sandbox violation is denied without a prompt
5. Pin the version in CI with npm install -g droid@<version>, or set FACTORY_DROID_AUTO_UPDATE_ENABLED=false on standalone installs, which update themselves

mini-swe-agent

1. Run with -y --exit-immediately for unattended use. Without --exit-immediately it waits for input when the agent finishes
2. Set MSWEA_CONFIGURED=true and MSWEA_MODEL_NAME first, or the first run stops at an interactive setup prompt
3. Read info.exit_status in the -o trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use -c mini.yaml -c environment.environment_class=docker -c environment.image=<image>. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command