Droid CLI vs T3 Code

Droid CLI 10

Harness reading of the published rubric. This is paid, closed software tied to a subscription, so the self-hosted rule does not apply. No payment protocol (0). Plan prices are public, $20, $100 and $200 a month for individuals and $60 a team plus $40 a seat for Teams, but included usage is given only as rolling rate limits and multiples of Pro (10). No free tier or trial was found on the pricing pages. Using your own model key is free up to an allowance, but only on a paid plan (0). A person signs in through a browser to subscribe and to create the API key. The Service Accounts API can issue keys only inside an existing organisation (0).

T3 Code 60

Free self-hosted software with nothing to buy, so 0 for a protocol and 20 each for public pricing, a free tier and onboarding with no sign-up, 60.

Droid CLI 63

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The agent loop runs locally and the docs say no copy of the repository is uploaded or indexed. Prompts and context go to the model endpoints. Usage metrics go to Factory's collector by default, with no opt-out in the pages read outside an airgapped deployment, and message content is never sent to it. The security page says code is not used as training data. Zero data retention is listed as a Business plan item. Headless runs use a long-lived fk- key (17). droid exec is read-only by default, autonomy has four levels, permission rules allow, ask or block commands, and an OS sandbox confines commands with Seatbelt or bubblewrap and a network proxy. The sandbox is off by default and --skip-permissions-unsafe skips every prompt (16). The sandbox page names prompt injection and states what the sandbox does not stop, MCP approvals are bound to the server's command or URL, and Droid Shield scans commits for secrets. The Agent Safety page was not read (9). An organisation audit log, OpenTelemetry export and session tags exist, with audit logging listed from the Business plan up (10). A disclosure address (security@factory.com), SOC 2 and ISO 42001 named on the security page, per the 9 October check, and Security sections in the changelog. No security.txt (404 on 4 November), no bug bounty and no published advisories were found, OSV holds nothing for droid, and the trust centre was not readable (11).

T3 Code 35

Harness reading. Product usage events go by default to ingest.t3.codes and PostHog, with hashed identifiers for your T3 Connect, OpenAI and Claude accounts, and relay traces to Axiom, which can include machine names and error text. Off with T3CODE_TELEMETRY_ENABLED=false or a managed policy. Disclosed in docs/user/telemetry.md, not the README (10 of 30). Permission modes and managed policies (12 of 20). No prompt-injection guidance (5). No audit log (5). No security policy file found (3). 10 + 12 + 5 + 5 + 3 = 35.

Droid CLI 79

Framework reading. The docs index links an OpenAPI file for the Factory public API, which we did not open, and the headless mode has a documented JSON-RPC surface with named methods. droid exec --list-tools --output-format json and droid rules check --json give machine-readable output. We found no published schema for the settings file (15). docs.factory.com/llms.txt lists a Markdown copy of every page (10). The overview says when to use the CLI, and the autonomy table says what each level allows, blocks and suits (16). Autonomy levels, output formats, sandbox modes and MCP server fields are enumerated with types and defaults (12). Examples on every page read, exit codes 0, 1 and 2, and a JSON result with is_error and subtype, with no error catalogue (11). A changelog by CLI version with dates and an RSS feed, 236 entries back to 30 September 2025 (15).

T3 Code 55

Harness reading. User docs in the repository (managed policy, handoffs, providers, telemetry), AGENTS.md for contributors, a server other clients connect to (55).

Droid CLI 65

Closed source under terms from The San Francisco AI Factory, Inc., last updated 14 July 2026. The npm package is marked UNLICENSED and the Python SDK is Apache-2.0 (15). The Data Flows page says where code, prompts and telemetry go in each deployment pattern, and the privacy policy (20 August 2026) lists service providers with the place of processing and keeps personal data up to 10 years after last use. Retention of Factory's operational logs is left to the trust centre, which we could not read, and whether session transcripts are stored in Factory's cloud on individual plans was not established (17). The terms promise commercially reasonable efforts to give 60 days' notice of major changes, the changelog has Deprecations sections, and the old command lists are deprecated but still honoured. A model retirement appeared in the changelog on the day it took effect, 11 August 2026 (12). The telemetry reference documents each metric and what reaches Factory, and telemetry.granularity can strip user identity. Metrics to Factory are on by default, with no opt-out found outside an airgapped deployment (11).

T3 Code 51

MIT (30). docs/user/telemetry.md lists what is sent and what isn't, but includes hashed third-party account identifiers and the README doesn't mention it (15 of 30). No deprecation policy (5). Disclosed with an opt-out, on by default (12 of 20). 30 + 15 + 5 + 12 = 62.

Droid CLI 72

Harness reading of the framework line. --restrict-tools, --disabled-tools, --additional-tools and --list-tools control built-in tools per run, and disabledTools in mcp.json keeps named MCP tools out of context. We found nothing on deferred tool loading (18). Output is text, json, stream-json or stream-jsonrpc, and the JSON result carries turns and duration. The droid exec help lists no flag for a turn or spend limit (10). Exit codes 0, 1 and 2 are documented, and a run that exceeds its autonomy level stops with a non-zero code and no partial changes, per the docs (15). --session-id continues a session, --fork branches one, and --worktree isolates parallel runs (16). Headless runs are read-only without flags, and TypeScript and Python SDKs wrap the CLI. A run needs a paid Factory account and an API key (13).

T3 Code 60

Harness reading. Remote control from phone or browser, portable handoffs between providers and managed policies for teams (60).

Droid CLI 54

Local-package reading, as for the other closed-source harnesses. An install script that verifies a SHA-256 checksum, a PowerShell installer, a Homebrew cask and the droid npm package (Node 20 or later) with prebuilt binaries for Linux, macOS and Windows on x64 and arm64, per the 9 October check (20). The source is not published. The public repository holds documentation only, so there is no public CI or test suite for the CLI (0). Bugs are tracked in the open at Factory-AI/factory. On 9 October 2026 it had 33 open issues that are not pull requests, most with no reply, and three closed in the previous week with replies. Issues were not re-read on 4 November because GitHub's API refused our requests (10). Every release has a dated, versioned changelog entry and deprecations get their own section. The line moved from 0.251.0 to 1.0.0 on 29 October, with three minors since, so the version number has signalled breaking changes for only six days (9). CLI v1.0.0 was released on 29 October 2026 and v1.3.0 on 4 November (15). The 99 per cent availability target on factory.com/sla is not scored on this reading.

T3 Code 43

Local software. An install script and desktop and mobile apps from the vendor (20). ci.yml and windows-tests.yml run on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Stable tags v0.1.5 to v0.1.7 with many nightlies, no changelog file (8). Version 0.1.7 (0). 20 + 15 + 0 + 8 + 0 = 43.