HarnessRouter vs Kilo Code CLI

HarnessRouter

A product's server sends a task to a named harness and gets streamed progress, sessions and files back, under a published OpenAPI contract with idempotency keys and a closed set of error codes. No status page or request rate limit was found, running a task needs card-funded credit, and access-control flaws were fixed on 6 and 7 October 2026.

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

HarnessRouter

1. Name the harness yourself. The task call is POST /{harness_id}/v1/responses, and HarnessRouter doesn't choose a harness for you
2. Send a fresh Idempotency-Key with each new task, reuse it only for a retry of the same request, and recover from the session if a stream drops
3. Call cancel to stop work. Closing the SSE connection leaves the agent running and billing
4. Keep the Workspace API key on the server. The docs forbid calling the API from a browser with it
5. Check each tool's enforcement in GET /v1/bases. On bases marked instruction, disabled_tools is a request to the model, not a block

Kilo Code CLI

1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry, including the conda client ID
3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
4. Without --auto a non-interactive run rejects every permission prompt and exits 1
5. Confine subagent writes with a session-level edit rule. From 7.8.13 a custom agent's own edit denies no longer bind the subagents it starts