Emdash vs Paperclip

Emdash 55

Harness reading. Docs site and a workspace server package (55).

Paperclip 81

The running server publishes OpenAPI at /api/openapi.json and validates requests with Zod, and the MCP server's tools take Zod schemas. No copy of the spec is published on the docs site, and paperclip.ing/openapi.json describes only the website (22). llms.txt at paperclip.ing, and docs pages answer as Markdown at .md (10). An API reference page per resource and task guides, but the MCP tool descriptions are one line each, such as List agents in a company (13). Typed inputs throughout, apart from the paperclipApiRequest tool, which takes any path under /api and a JSON body (12). cURL, JavaScript and Python examples and a status-code table, with one {error} shape and an occasional details field (12). A changelog page for every stable release and release notes in the repository, but the API path carries no version (12).

Emdash 38

Harness reading. Telemetry is described as optional and disabled in Settings or with TELEMETRY_ENABLED=false, which reads as on by default (15 of 30). Worktree per task and remote machines over SSH (10 of 20). No prompt-injection guidance (5). No audit log (5). No security policy file found (3). 15 + 10 + 5 + 5 + 3 = 38.

Paperclip 64

Harness reading of the framework checklist, as used for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Anonymous usage telemetry is on by default and goes to telemetry.paperclip.ing. The README lists what is excluded and four opt-outs, and Sentry and OpenTelemetry stay off until configured. We found no first-run notice in the CLI source (18). Board approvals for hires and strategy, execution policies and per-action connection permissions, but claude_local defaults dangerouslySkipPermissions to true, codex_local defaults to bypassing approvals and the sandbox, local agents run on the host, sandbox providers are optional plugins and the default local_trusted mode has no login (10). A documented low_trust_review preset contains agents that read untrusted pull requests or tickets. It is opt-in (10). An activity log of mutating actions, run logs, cost events and audited board API keys (14). SECURITY.md with GitHub private reporting and twelve advisories published per the 8 October check, three now with CVEs in OSV. No security.txt, bug bounty or SOC 2 report found (12).

Emdash 55

Harness reading. Issue intake from Linear, GitHub, Jira and others, diff review, pull requests and CI checks in one place, local or over SSH (55).

Paperclip 70

Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. The MCP server lists 44 tools with no toolsets or read-only subset found, offset by compact reads such as paperclipInboxLite and the heartbeat context (12). Budgets by company, agent and project with an automatic pause at 100 per cent, though the README says enforcement uses recorded spend and can lag work in flight (16). onboard --yes, CLI commands with --json, the REST API and routines started by cron, webhook or API (16). Atomic task checkout with a documented 409, Idempotency-Key on routine triggers, saved sessions and bounded recovery (17). One command starts a server with embedded PostgreSQL, but it needs Node.js 24.11 and each harness CLI installed and signed in on the host, and we found no client SDK beyond the TypeScript plugin SDK (9).

Emdash 54

Apache 2.0 (30). A telemetry page on the docs site (not read) (18 of 30). No deprecation policy (5). Disclosed with an opt-out (15 of 20). 30 + 18 + 5 + 15 = 68.

Paperclip 66

MIT (30). The privacy policy of 23 July 2026 separates self-hosted use from the hosted services and names Paperclip Labs, Inc., but keeps data as long as reasonably necessary, lists no subprocessors, and the 90-day telemetry retention appears only in source. The terms grant a broad licence over content sent to the services and allow model training on opt-in detailed telemetry (16). Release notes carry dated Breaking Changes sections and upgrade guides, with no written deprecation policy or notice period (10). The README discloses telemetry, what it excludes and four opt-outs, and the event contract is public in the repository, but it is on by default (17).

Emdash 70

v1.2.11 on 6 November 2026 (30). v1.2.9, v1.2.10 and v1.2.11 within two weeks (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current installers and Homebrew cask (15). Release workflows, no test CI (5). 30 + 20 + 0 + 15 + 5 = 70.

Paperclip 78

Version 2026.1023.0, released on 23 October 2026 per its notes and the site banner (30). Ten stable releases from 2026.817.0 (17 August) to 2026.1023.0 in the 90 days to 4 November (20). Per the 8 October check, not re-read on 4 November, 650 pull requests merged in the last 30 days, but 2,849 issues and 3,338 pull requests were open, 1,396 open issues had no comment, and 309 of the 472 still-open issues from the two weeks before had none (8). paperclipai and @paperclipai/mcp-server publish from the same release workflow. We did not check the MCP registry (12). CI on master, a lockfile refresh workflow and signed image attestations (8). 30 + 20 + 8 + 12 + 8 = 78.