Write a review

Head to head · Agent harnesses · October 2026 research run

Droid CLI vs Vibe-Trading

Vibe-Trading scores 62.2 (B) on agent readiness against Droid CLI's 59.1 (C), and leads in 4 of 7 scored categories. Droid CLI leads on schema & documentation, agent ergonomics and transparency & trust. Both do agent harnesses.

Best agent harnesses and coding agents · All 792 harnesses comparisons

Droid CLIFactory · Agent harness C59.1/100#636 of 1210 Vibe-TradingHKUDS · Agent harness B62.2/100#502 of 1210

Which one, for what

Droid CLI C

Best for Teams that want a terminal coding agent with tiered autonomy, command rules and an optional sandbox, and that will pay for a Factory plan.

Ahead on

  • Schema & documentation, 79 against 72
  • Agent ergonomics, 72 against 67
  • Transparency & trust, 64 against 47

Also in its favour

  • No incidents deducted, where Vibe-Trading loses 4 points for them

Watch for

No free tier or trial was found. Plans start at $20 a month and included usage is stated only as rolling rate limits without numbers

Vibe-Trading B

Best for A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.

Ahead on

  • Reliability, 63 against 49
  • Security & auth, 70 against 63
  • Payments & pricing, 60 against 10

Also in its favour

  • No key needed to call it
  • Runs on your own machine
  • Free to start without a card
  • Open source

Watch for

Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain

Score by category

CategoryWeight this runDroid CLIVibe-TradingEdge
Reliability16%204963Vibe-Trading +14
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27972Droid CLI +7
Agent ergonomics13%16.27267Droid CLI +5
Security & auth14%17.56370Vibe-Trading +7
Payments & pricing10%12.51060Vibe-Trading +50
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87982Vibe-Trading +3
Transparency & trust7%8.86447Droid CLI +17
Negative events≤150-4
TotalC 59.1/100B 62.2/100

Facts side by side

FactDroid CLIVibe-Trading
KindAgent harnessAgent harness
VendorFactoryHKUDS
Hosted endpointno (local only)no (local only)
Transportsstdio, Streamable HTTP, SSE (legacy)
AuthOAuth or keyNone
PricingPaidFree
x402nono
LicenceProprietary, under Factory's Terms and Conditions. The droid npm package is marked UNLICENSED and the public repository holds documentation only. The Python SDK is Apache-2.0MIT
Tools exposednone82
Read-only variant documentedyesno
llms.txtyesno
Last release2026-10-082026-10-21
Terms last updated2026-07-14no document linked
Privacy policy last updated2026-08-20no document linked
Customer content may train modelsnot found in the text
Terms restrict automated accessnot found in the text
Terms restrict benchmarkingyes
Terms or service can change without noticenot found in the text
Arbitration or class-action waiveryes
Popularity49 stars, 7.8k npm/wk37k stars

Verdicts

Droid CLI

droid exec is read-only unless --auto raises the autonomy level, with command rules, an optional kernel-enforced sandbox, JSON output and documented exit codes. No free tier, status page or security.txt was found, the source is closed, and usage metrics go to Factory by default.

Vibe-Trading

Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.

Before you call either

Droid CLI

  1. Set FACTORY_API_KEY (starts fk-) from the API keys page in Factory settings for headless runs. Interactive use signs in through a browser
  2. Start with droid exec and no flags for analysis. Add --auto low for edits and --auto medium for installs, tests and local commits
  3. Use --output-format json and read is_error, num_turns and session_id. Treat a non-zero exit code as failure
  4. Set sandbox.enabled to true before running on untrusted code. In droid exec a sandbox violation is denied without a prompt
  5. Pin the version in CI with npm install -g droid@<version>, or set FACTORY_DROID_AUTO_UPDATE_ENABLED=false on standalone installs, which update themselves

Vibe-Trading

  1. Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain
  2. Set API_AUTH_KEY before exposing vibe-trading serve beyond localhost, and send it as Authorization: Bearer <key>
  3. Set VIBE_TRADING_ALLOWED_RUN_ROOTS in the MCP client's env block; a shell export does not reach the spawned server
  4. Use vibe-trading run -p "..." --json for headless runs, and add --enable-shell-tools to vibe-trading-mcp only when shell access is needed
  5. Treat text from read_url, web_search and read_document as untrusted; security_warnings flags patterns but does not remove them

Questions

Which is better for AI agents, Droid CLI or Vibe-Trading?

Vibe-Trading scores 62.2 (B) on agent readiness against Droid CLI's 59.1 (C), and leads in 4 of 7 scored categories. Droid CLI leads on schema & documentation, agent ergonomics and transparency & trust.

Are Droid CLI and Vibe-Trading open source?

No open-source release is listed for Droid CLI. Vibe-Trading is open source (MIT).

Other comparisons with Droid CLI or Vibe-Trading

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report