Emdash vs MiniMax Code

Emdash 55

Harness reading. Docs site and a workspace server package (55).

MiniMax Code 81

Harness reading. mcode exec returns a versioned ExecResult JSON document (schemaVersion 1) or versioned stream-json events, takes --output-schema for the final answer, and mcode acp speaks the Agent Client Protocol. No OpenAPI, since there's no server API (20). llms.txt indexes the docs, and each page is served as Markdown (10). The security page says when to use each permission policy and to keep full and off to isolated workspaces, and the automation page gives a CI baseline (16). An options table with defaults and enums for permission, output and prompt modes (12). Examples for each mode, a nine-row exit-code table, five result statuses and a named error for invalid structured output (13). A dated CLI changelog in the docs, whose latest entry (0.7.0, 26 October) trails npm's 0.7.4 (10). Total 81.

Emdash 55

Harness reading. Issue intake from Linear, GitHub, Jira and others, diff review, pull requests and CI checks in one place, local or over SSH (55).

MiniMax Code 79

Harness reading, for a pipeline driving the CLI. Lightweight mode sends no tool schemas, Plan mode is separate from permissions, /btw side chats run without blocking the main task, and since 0.7.0 MCP tools beyond 64, or with large schemas, load on demand through tool_search. No per-tool allow or deny list was found in the CLI docs (16). json and stream-json output, --timeout, --max-steps, --output-schema and --output-last-message (18). Exit codes per failure class, a status field and an interaction error when a run would need a person (17). --session, --continue, fork and rewind, and a model request is retried when the first response doesn't arrive within 300 seconds (16). One positional argument runs a task and BYOK needs no MiniMax login. The TypeScript SDK @minimax-ai/code-sdk 0.1.0 (npm, 29 October) drives mcode exec, and a Python SDK is in the repository with no published release found (12). Total 79.

Emdash 38

Harness reading. Telemetry is described as optional and disabled in Settings or with TELEMETRY_ENABLED=false, which reads as on by default (15 of 30). Worktree per task and remote machines over SSH (10 of 20). No prompt-injection guidance (5). No audit log (5). No security policy file found (3). 15 + 10 + 5 + 5 + 3 = 38.

MiniMax Code 57

Harness reading of the framework checklist. 30 for credentials and what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Provider keys are read from an environment variable and never printed, and stored in config.yaml in the data directory. All three telemetry channels are off by default and the doc lists every field sent. The default smart policy classifies actions through a cloud classifier, and what it sends isn't documented (20). Ask, Auto and Full access in the TUI. Headless defaults to smart and fails on a pending permission request instead of approving it, while full and off skip checks. A bundled sandbox runtime with macOS tests, a read-only filesystem policy for Explore subagents when sandboxing is available, but the default sandbox coverage isn't documented (12). SECURITY.md says permissions and sandboxing don't replace review of untrusted plugins, MCP servers and shell commands. No guidance found for fetched web content (6). Sessions kept locally, /export with credential redaction, /transcript and stream-json events (11). SECURITY.md takes private reports by email and GitHub's private advisories with no response SLA, history and build scans with Gitleaks run in a release-audit workflow, and OSV lists no advisories for @minimax-ai/code or @minimax-ai/code-sdk. No security.txt (8). Total 57.

Emdash 70

v1.2.11 on 6 November 2026 (30). v1.2.9, v1.2.10 and v1.2.11 within two weeks (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current installers and Homebrew cask (15). Release workflows, no test CI (5). 30 + 20 + 0 + 15 + 5 = 70.

MiniMax Code 79

0.7.4 on npm on 30 October 2026 (30). Every npm release from 0.1.0 on 14 August falls in the last 90 days, 62 of them by 15 October per the 19 October check (20). The clone has 167 commits since 3 August and 32 since 2 October, with fixes that cite issues, but pull requests are taken only from collaborators, and issue counts and reply times couldn't be read (11). An official TypeScript SDK, @minimax-ai/code-sdk 0.1.0, published on 29 October, and a Python SDK in the repository with no published release found. ACP ships inside the CLI (10). CI pins its GitHub Actions by commit, and the root package pins overrides for vulnerable dependencies (8). Total 79.

Emdash 54

Apache 2.0 (30). A telemetry page on the docs site (not read) (18 of 30). No deprecation policy (5). Disclosed with an opt-out (15 of 20). 30 + 18 + 5 + 15 = 68.

MiniMax Code 63

First-party code is MIT, with the bundled sandbox runtime under Apache-2.0 and the desktop app closed. The repository says the published npm package isn't shown to be built from this source, and npm is at 0.7.4 while the source is at 0.7.2 (22 of 30). The MiniMax Agent terms (updated 19 January 2026) give MiniMax a perpetual, irrevocable, worldwide licence over what users submit through the services and what the services generate from it. The privacy policy of the same date states no retention period and says nothing on training, and the telemetry doc says server-side retention isn't defined. BYOK runs that don't touch MiniMax's services aren't covered by either (8 of 30). No deprecation policy. Removed functions are listed in the changelog without dates ahead (6 of 20). Telemetry is off by default, with each field, each destination and two environment opt-outs documented (20). Total 56.