# Droid CLI vs Orca (slim)

> Orca and Droid CLI score within a point of each other for agent harnesses, 57.4 and 57.2 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/droid-cli-vs-orca.md (~5,500 tokens) · this version ~2,030 tokens · JSON https://www.anchorterminal.com/compare/droid-cli-vs-orca.json · canonical https://www.anchorterminal.com/compare/droid-cli-vs-orca
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Orca and Droid CLI score within a point of each other on agent readiness, 57.4 (C) and 57.2 (C). Droid CLI leads on schema & documentation, security & auth and transparency & trust. Both do agent harnesses.

- Droid CLI: C 57.2, rank #805 of 1486 · https://www.anchorterminal.com/tools/droid-cli.min.md
- Orca: C 57.4, rank #791 of 1486 · https://www.anchorterminal.com/tools/orca.min.md
- Droid CLI, good for Teams that want a terminal coding agent with tiered autonomy, command rules and an optional sandbox, and that will pay for a Factory plan. Ahead on Schema & documentation, 79 against 65; Security & auth, 63 against 43; Transparency & trust, 65 against 54.
- Orca, good for Developers who want an orchestrator agent to split work across parallel coding agents, on desktop or mobile. Ahead on Payments & pricing, 40 against 10. Also No key needed to call it; Open source; No incidents deducted, where Droid CLI loses 3 points for them.

| Category | Droid CLI | Orca |
| --- | --- | --- |
| Reliability (16%) | 54 | 58 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 79 | 65 |
| Agent ergonomics (13%) | 72 | 70 |
| Security & auth (14%) | 63 | 43 |
| Payments & pricing (10%) | 10 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 79 | 75 |
| Transparency & trust (7%) | 65 | 54 |

| Fact (where they differ) | Droid CLI | Orca |
| --- | --- | --- |
| Vendor | Factory | Lovecast Inc. |
| Auth | OAuth or key | None |
| Pricing | Paid | Free |
| Licence | Proprietary, under Factory's Terms and Conditions. The `droid` npm package is marked `UNLICENSED` and the public repository holds documentation only. The Python SDK is Apache-2.0 | MIT |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| Last release | 2026-11-04 | 2026-11-06 |
| Terms last updated | 2026-07-14 | no document linked |
| Privacy policy last updated | 2026-08-20 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 49 stars, 7.8k npm/wk | none |

Why the edge:
- Payments & pricing, Orca +30: Droid CLI 10 (Harness reading of the published rubric. This is paid, closed software tied to a subscription, so the self-hosted rule does not apply. No payment protocol (0). Plan prices are public, $20, $100 and $200 a month for individuals and $60 a team plus $40 a seat for Teams, but included usage is given only as rolling rate limits and multiples of Pro (10). No free tier or trial was found on the pricing pages. Using your own model key is free up to an allowance, but only on a paid plan (0). A person signs in through a browser to subscribe and to create the API key. The Service Accounts API can issue keys only inside an existing organisation (0).); Orca 40 (Scored on the cloud option. No protocol (0). The cloud price wasn't found on the pages read (0). The desktop app is free and MIT with no card (20). The local app needs no sign-up that we found (20). 0 + 0 + 20 + 20 = 40.)
- Security & auth, Droid CLI +20: Droid CLI 63 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The agent loop runs locally and the docs say no copy of the repository is uploaded or indexed. Prompts and context go to the model endpoints. Usage metrics go to Factory's collector by default, with no opt-out in the pages read outside an airgapped deployment, and message content is never sent to it. The security page says code is not used as training data. Zero data retention is listed as a Business plan item. Headless runs use a long-lived `fk-` key (17). `droid exec` is read-only by default, autonomy has four levels, permission rules allow, ask or block commands, and an OS sandbox confines commands with Seatbelt or bubblewrap and a network proxy. The sandbox is off by default and `--skip-permissions-unsafe` skips every prompt (16). The sandbox page names prompt injection and states what the sandbox does not stop, MCP approvals are bound to the server's command or URL, and Droid Shield scans commits for secrets. The Agent Safety page was not read (9). An organisation audit log, OpenTelemetry export and session tags exist, with audit logging listed from the Business plan up (10). A disclosure address (security@factory.com), SOC 2 and ISO 42001 named on the security page, per the 9 October check, and Security sections in the changelog. No security.txt (404 on 4 November), no bug bounty and no published advisories were found, OSV holds nothing for `droid`, and the trust centre was not readable (11).); Orca 43 (Harness reading. Anonymous usage data with an opt-out, per the README's link to its telemetry docs (15 of 30). Worktrees per agent and a sandboxed Linux build (12 of 20). No prompt-injection guidance (5). No audit log (5). A dependency-security workflow (6 of 20). 15 + 12 + 5 + 5 + 6 = 43.)
- Schema & documentation, Droid CLI +14: Droid CLI 79 (Framework reading. The docs index links an OpenAPI file for the Factory public API, which we did not open, and the headless mode has a documented JSON-RPC surface with named methods. `droid exec --list-tools --output-format json` and `droid rules check --json` give machine-readable output. We found no published schema for the settings file (15). docs.factory.com/llms.txt lists a Markdown copy of every page (10). The overview says when to use the CLI, and the autonomy table says what each level allows, blocks and suits (16). Autonomy levels, output formats, sandbox modes and MCP server fields are enumerated with types and defaults (12). Examples on every page read, exit codes 0, 1 and 2, and a JSON result with `is_error` and `subtype`, with no error catalogue (11). A changelog by CLI version with dates and an RSS feed, 236 entries back to 30 September 2025 (15).); Orca 65 (Harness reading. A docs site with CLI orchestration and native chat pages (65).)
- Transparency & trust, Droid CLI +11: Droid CLI 65 (Closed source under terms from The San Francisco AI Factory, Inc., last updated 14 July 2026. The npm package is marked `UNLICENSED` and the Python SDK is Apache-2.0 (15). The Data Flows page says where code, prompts and telemetry go in each deployment pattern, and the privacy policy (20 August 2026) lists service providers with the place of processing and keeps personal data up to 10 years after last use. Retention of Factory's operational logs is left to the trust centre, which we could not read, and whether session transcripts are stored in Factory's cloud on individual plans was not established (17). The terms promise commercially reasonable efforts to give 60 days' notice of major changes, the changelog has Deprecations sections, and the old command lists are deprecated but still honoured. A model retirement appeared in the changelog on the day it took effect, 11 August 2026 (12). The telemetry reference documents each metric and what reaches Factory, and `telemetry.granularity` can strip user identity. Metrics to Factory are on by default, with no opt-out found outside an airgapped deployment (11).); Orca 54 (MIT (30). Privacy and telemetry docs on the site (not read) (18 of 30). No deprecation policy (5). Disclosed with an opt-out (15 of 20). 30 + 18 + 5 + 15 = 68.)