Pi vs Letta

Pi 61

Harness reading of the framework checklist, used for the harnesses in this category. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. An anonymous install and update ping to pi.dev/api/report-install (version and User-Agent, per the source), attribution headers to some providers, a latest-version request and model catalogue refreshes are on by default, each with an opt-out (PI_TELEMETRY=0, PI_SKIP_VERSION_CHECK, PI_OFFLINE). Since 1.4.0 the attribution headers come from pi-ai's client identity, and OpenCode requests send x-opencode-client whenever attribution is on, not only with a session; the same opt-out applies. Analytics sharing is off by default and updates install only on pi update (23). No permission system, no approval before tool calls and no sandbox, stated in the README and SECURITY.md. Project trust gates a repository's .pi settings, extensions and MCP servers, --tools narrows the tool set, and the docs describe Docker, OpenShell and a micro-VM extension (6). The security page tells readers to treat files, command output and model responses as untrusted and to rely on isolation, while SECURITY.md puts prompt injection out of scope and context files such as AGENTS.md load whatever the trust decision (7). Sessions are JSONL files on disk with HTML export, MCP server logs go to ~/.pi/agent/mcp.log, and the JSON stream records each tool call (11). SECURITY.md gives security@earendil.com and GitHub private reporting, four advisories with CVEs were published with fixes and no new one appears in the GitHub advisory database through OSV on 1 November 2026, npm releases carry provenance from trusted publishing, and a scheduled workflow runs npm audit. Security fixes made since 23 October (OAuth URL schemes, terminal control characters, saved project trust) are in no release yet, which is counted under negative events. No security.txt and no bounty found (14).

Letta 35

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is unrestricted; standard, acceptEdits and strict are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.

Pi 75

Read as a local package. @earendil-works/pi-coding-agent 1.4.0 on npm (still the latest on 1 November 2026) with Node.js 22.19 or newer stated, install scripts for macOS, Linux and Windows, Nix and standalone binaries (20). A public CI workflow builds, checks and tests on every push to main and runs an MCP client conformance job. The run on the commit we cloned (ce950d7, 8 October 2026) passed, but eight of the last 15 runs on main, all on 7 and 8 October, failed. Run results weren't readable on 23 October, so this stands per the 8 October check (15). The repository API reported 308 open issues and pull requests against 113,417 stars on 8 October, not re-read on 23 October. Issues from new contributors are closed automatically and reviewed daily by maintainers, per CONTRIBUTING.md, so the open count understates what is reported, and we couldn't sample reply times (16). A dated changelog with Breaking Changes sections and migration steps, but breaking changes ship outside major versions. The Azure provider rename shipped in patch release 1.0.3 on 5 October 2026, minor release 1.2.0 on 12 October carried four (theme schema location, before_agent_start, busy-session behaviour and pi mcp list --json output), and 1.3.0 required /v1 on kimi-coding base URL overrides under Changed. The same reading as agent-zero and mistral-vibe-cli, and these breaks also take a deduction under negative events (9). 1.4.0 on 21 October 2026, with 1.0.0 dated 1 October 2026 (15).

Letta 58

Local-software lines, read for the harness. @letta-ai/letta-code on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.

Pi 84

Harness reading, as for the other harnesses. JSON Schemas for settings, models, keybindings and themes ship in the package and, since 1.2.0 on 12 October 2026, at pi.dev/schemas/, and the JSON event stream and every RPC command are documented record by record, but as Markdown and TypeScript types with no machine-readable spec for the RPC protocol (18). pi.dev/llms.txt returns 404. Each docs page answers Accept: text/markdown with Markdown, and the docs ship inside the npm package (8). The integration page has a table saying when to use interactive, print, JSON, RPC or the SDK, and the MCP page gives a typical use for each exposure setting. 1.4.0 adds a Models Configuration reference generated from the models.json schema (17). Enumerated modes, thinking levels and exposure values, typed settings with defaults (13). A Python RPC client, a typed TypeScript client and about 75 example extensions, with command errors and parse errors shown as records (13). A dated changelog in the repository and at pi.dev/changelog with an RSS feed (15).

Letta 70

Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an applies_to block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.

Pi 67

MIT (30). No privacy policy for pi.dev or the CLI was found (pi.dev/privacy, earendil.com/privacy and radius.earendil.com/privacy return 404 on 23 October 2026, and pi.dev/privacy and pi.dev/terms again on 1 November). The docs say where sessions and credentials are stored and what /share and /bug upload. The Radius alpha terms of 1 September 2026 name Earendil Works Co. and refer to a Privacy Notice we couldn't locate (10). Breaking changes are listed per release with migration steps, with no deprecation policy or notice period found. Pi Durable's README says its API changes without notice between releases (8). Install telemetry and the version check are documented in the settings and environment-variable pages with opt-outs, though the docs don't list the fields sent (16).

Letta 55

Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.

Pi 76

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. Four default tools (read, bash, edit, write) and a short system prompt. MCP tools default to codemode exposure, which keeps them out of the model's tool declarations, and tool_search loads deferred ones on demand (23). Automatic compaction, agent-level retry with three attempts and exponential backoff, and truncated tool output saved to a file. We found no turn or step limit in the CLI or settings reference (13). --mode json streams JSONL events ending in agent_settled and --mode rpc returns success: false with an error string. Print mode exits nonzero on a failed response, JSON mode doesn't (16). Sessions are stored as trees and continue, fork or take a fixed ID with --continue, --fork and --session-id. File changes have no built-in undo, and a git checkpoint is an example extension (14). It needs a provider key or subscription login before the first run, and the SDK is TypeScript only, with RPC for other languages (10).

Letta 67

Harness reading. Toolsets switch with /model, skills load per agent, and subagents run in the background (18 of 25). Context is managed through memory blocks, reflection and dreaming (12 of 20). letta -p --output-format json for scripted runs and an App Server for programmatic control (12 of 20). Conversations resume by agent and conversation id, and memory is git-tracked so changes can be reverted (15 of 20). Runs with no account on the local backend, with one SDK language, TypeScript (10 of 15). Total 67.