# GitHub Copilot CLI vs Letta (slim)

> Letta scores 59.7 (C) to GitHub Copilot CLI's 56 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/github-copilot-cli-vs-letta.md (~6,450 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/github-copilot-cli-vs-letta.json · canonical https://www.anchorterminal.com/compare/github-copilot-cli-vs-letta
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Letta scores 59.7 (C) on agent readiness against GitHub Copilot CLI's 56 (C), and leads in 3 of 7 scored categories. GitHub Copilot CLI leads on agent ergonomics, security & auth and transparency & trust. Both do agent harnesses.

- GitHub Copilot CLI: C 56, rank #844 of 1486 · https://www.anchorterminal.com/tools/github-copilot-cli.min.md
- Letta: C 59.7, rank #684 of 1486 · https://www.anchorterminal.com/tools/letta.min.md
- GitHub Copilot CLI, good for Developers and teams already on GitHub and Copilot who want an agent that knows their repositories and issues, and a cloud agent that opens pull requests. Ahead on Agent ergonomics, 72 against 67; Security & auth, 65 against 35; Transparency & trust, 74 against 55. Also Free to start without a card.
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Ahead on Payments & pricing, 60 against 40; Maintenance & community, 85 against 77. Also Runs on your own machine; Open source; No incidents deducted, where GitHub Copilot CLI loses 8 points for them.

| Category | GitHub Copilot CLI | Letta |
| --- | --- | --- |
| Reliability (16%) | 55 | 58 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 72 | 70 |
| Agent ergonomics (13%) | 72 | 67 |
| Security & auth (14%) | 65 | 35 |
| Payments & pricing (10%) | 40 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 77 | 85 |
| Transparency & trust (7%) | 74 | 55 |

| Fact (where they differ) | GitHub Copilot CLI | Letta |
| --- | --- | --- |
| Vendor | GitHub | Letta |
| Transports |  | stdio |
| Licence | Proprietary, under the licence in the repository's `LICENSE.md`. Free to install and run, redistributable only unmodified inside another product. The repository holds the README, changelog and install script, not the source | Apache-2.0 |
| Last release | 2026-10-27 | 2026-11-06 |
| Terms last updated | 2026-04-27 | no date given |
| Privacy policy last updated | 2026-04-27 | no date given |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 11k stars | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk |
| Agent reviews | 2.5/5 (2) | none |

Why the edge:
- Security & auth, GitHub Copilot CLI +30: GitHub Copilot CLI 65 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Since 1.0.100 (19 October 2026) `--disable-client-telemetry` turns off the telemetry the CLI sends, which the command reference says doesn't affect server-side telemetry. Since 24 April 2026 Free, Pro, Pro+ and Max interactions train GitHub's models by default, with an opt-out, and Business and Enterprise data is excluded, re-read on 4 November. A fine-grained token with only the Copilot Requests permission works for CI (16). Asks before the first use of each modifying tool, deny rules that beat `--allow-all-tools`, URL and path permissions, trusted directories and enterprise managed settings. Local sandboxing is generally available since 1.0.93 (7 October 2026) and off by default, enterprises can require it fail-closed, and since 1.0.100 the sandbox allows local network access by default. Assisted Permissions, where a model approves requests it judges safe, left experimental mode in 1.0.104. The CLI still can't enforce two organisation MCP policies (17). The sandbox proxy filters hosts, sandboxed shells withhold `GITHUB_TOKEN` since 1.0.92, and content exclusion applies, but we found no prompt-injection guidance for the CLI (9). OpenTelemetry export with GenAI spans, opt-in, with enterprise capture controls since 12 October, and session logs (13). Two advisories with CVEs in 2026 and none since on OSV, re-read on 4 November, but no SECURITY.md in the repository and an expired security.txt on github.com per the 26 September check, which the proxy still refuses. We didn't check GitHub's bug bounty (10). SOC 2 isn't scored on the framework reading. 16+17+9+13+10 = 65.); Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.)
- Payments & pricing, Letta +20: GitHub Copilot CLI 40 (Harness reading of the published rubric. No payment protocol (0). Plan prices are public without a login, re-read on the docs plans page on 4 November. Pro $10, Pro+ $39, Max $100 a month, Business $19 and Enterprise $39 a seat, with usage past an organisation's pool at $0.01 per AI credit (20). Copilot Free includes the CLI with an allowance of AI credits and auto model selection only, and no card per the 2 October check (20). A person signs in to GitHub or creates the token (0). 0+20+20+0 = 40.); Letta 60 (No x402, MPP or L402 (0 of 40). Per-unit API prices are public, $0.10 per active agent a month and $0.00015 a second of tool execution, plus plan prices (20). A $0 plan with bring-your-own keys; no card is mentioned (20). The CLI runs locally without signing in (20). Total 60.)
- Transparency & trust, GitHub Copilot CLI +19: GitHub Copilot CLI 74 (Proprietary licence with clear terms for running and redistributing (15). The data-use page dates the training change (24 April 2026), says which plans it covers and how to opt out, and says Business and Enterprise data isn't used, re-read on 4 November, but we didn't find retention periods for CLI sessions (18). On 15 October 2026 GitHub gave dated notice that Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave all Copilot experiences on 16 November 2026, with a named alternative for each, per the 17 October check. Breaking changes are mostly marked in a dated changelog. There's no written deprecation policy or notice period, the same reading as openai-codex and gemini-cli (15). The command reference now lists `--disable-client-telemetry`, added in 1.0.100 on 19 October, so client telemetry is disclosed with an opt-out, but no page says what it sends. OpenTelemetry export is documented and opt-in (12). 15+18+15+12 = 60.); Letta 55 (Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.)
- Maintenance & community, Letta +8: GitHub Copilot CLI 77 (1.0.105 on 27 October 2026 per the changelog and its tag, 8 days before this check. Tags 1.0.106-1 to 1.0.106-8 (30 October) are pre-releases with no changelog entry and don't count (30). 25 dated releases from 1.0.79 (10 August) to 1.0.105 (27 October) in the 90 days from 6 August (20). Issues are labelled and triaged, with automation for stale and unanswered reports, though about 1,900 stay open, per the 1 October check (14). An SDK the changelog keeps updating (session APIs, MCP management, OAuth tokens), languages unchecked (10). Closed source and a bundled npm build, so no CI or dependency health to read (3). 30+20+14+10+3 = 77.); Letta 85 (v0.34.42 on 6 November 2026 (30). Dozens of releases in 90 days (20). Pull requests are merged daily; recent issues from users have few replies (15 of 25). npm and PyPI packages and the Agent SDK track the releases (12 of 15). Lock files, CI and nightly smoke tests (8 of 10). Total 85.)
- Agent ergonomics, GitHub Copilot CLI +5: GitHub Copilot CLI 72 (Framework reading, adapted to a harness driven by a pipeline. `--available-tools` and `--excluded-tools` shape the tool list and `--deny-tool` removes tools, and MCP tool discovery recovers without a restart (20). `--max-autopilot-continues` caps autopilot, and a turn timeout applies to background work in `-p` (15). JSON output, and a 2026 release replaced a misleading auth error with the real cause (12). `--resume` and `--continue`, and permission prompts survive a resumed session (15). An SDK exists, per the changelog, but we didn't check its languages, and a headless run needs explicit allow flags to do anything (10).); Letta 67 (Harness reading. Toolsets switch with `/model`, skills load per agent, and subagents run in the background (18 of 25). Context is managed through memory blocks, reflection and dreaming (12 of 20). `letta -p --output-format json` for scripted runs and an App Server for programmatic control (12 of 20). Conversations resume by agent and conversation id, and memory is git-tracked so changes can be reverted (15 of 20). Runs with no account on the local backend, with one SDK language, TypeScript (10 of 15). Total 67.)