Pi vs Qwen Code

Pi

Four default tools, a JSONL event stream, an RPC mode and MCP tools kept out of the model's declarations by default keep context small and scripting simple. Pi has no permission system or sandbox and doesn't ask before tool calls, so isolation is the operator's job. Version 1.0.0 is dated 1 October 2026.

Qwen Code

Apache-2.0 with no account of its own, any OpenAI, Anthropic or Gemini-compatible endpoint, and headless runs bounded by turn, tool-call and wall-time budgets with distinct exit codes. Out of the box, Auto mode lets an LLM classifier approve tool calls, with the sandbox and folder trust both off. Usage statistics are on by default.

Pi

1. Run Pi inside a container or VM for unattended work. It has no sandbox and doesn't ask before running shell commands
2. Use pi --mode json and wait for agent_settled. A failed response doesn't set a nonzero exit code in JSON mode
3. Split the JSONL stream on LF only. Node's readline also splits on U+2028 and U+2029, which are valid inside JSON strings
4. Pass --no-approve or --approve in scripts to make the project trust decision explicit
5. Set PI_TELEMETRY=0 and PI_SKIP_VERSION_CHECK=1, or PI_OFFLINE=1, to stop the default requests to pi.dev

Qwen Code

1. Pass --approval-mode on every run. The settings default is auto, and one docs page says headless runs default to asking, so don't rely on either
2. Add --max-session-turns, --max-wall-time and --max-tool-calls. All three are unlimited by default. Exit 53 is the turn limit and 55 a budget
3. --yolo doesn't turn on a sandbox. Add --sandbox, or on Linux set tools.executionSandbox with network set to closed
4. Set QWEN_USAGE_STATISTICS_ENABLED=false to stop usage statistics
5. Authenticate with OPENAI_API_KEY, OPENAI_BASE_URL and OPENAI_MODEL in CI. The browser sign-in is discontinued