Pi vs Kilo Code CLI

Pi

Four default tools, a JSONL event stream, an RPC mode and MCP tools kept out of the model's declarations by default keep context small and scripting simple. Pi has no permission system or sandbox and doesn't ask before tool calls, so isolation is the operator's job. Version 1.0.0 is dated 1 October 2026.

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

Pi

1. Run Pi inside a container or VM for unattended work. It has no sandbox and doesn't ask before running shell commands
2. Use pi --mode json and wait for agent_settled. A failed response doesn't set a nonzero exit code in JSON mode
3. Split the JSONL stream on LF only. Node's readline also splits on U+2028 and U+2029, which are valid inside JSON strings
4. Pass --no-approve or --approve in scripts to make the project trust decision explicit
5. Set PI_TELEMETRY=0 and PI_SKIP_VERSION_CHECK=1, or PI_OFFLINE=1, to stop the default requests to pi.dev

Kilo Code CLI

1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry
3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
4. Without --auto a non-interactive run rejects every permission prompt and exits 1
5. Put provider keys in global config or the environment. {env:VAR} in a project kilo.json is ignored