Impeccable vs Kite

Impeccable 85

Scored as a local package, since the owner runs it. Official npm package impeccable with Node 18.19 or later stated and engine binaries for macOS (arm64, x64), Linux (x64, arm64) and Windows x64 (20). CI runs on every push and pull request to main with core, detector, framework, Rust, Windows launcher and Node-floor jobs. The latest push run on main passed on 30 October 2026, while that morning's nightly scheduled run failed and we didn't read why, per the 30 October check, not re-read on 1 November because GitHub's pages and API refuse our reader (20 of 25). 29 open issues against 93 releases on 30 October, with recent bug reports on installer and hook edge cases, and 18 commits titled Fix merged to main between 28 October and 1 November, each naming its issue or pull request. Three sampled issues (#964, #1023, #1190) show replies from the maintainers within about two days (18 of 25). Separate skill, CLI and engine versions with a dated changelog that marks breaking changes, such as CLI 3.0.0 raising the Node minimum, but the engine every command runs is still 0.1.x (12 of 15). The package is 4.8.0 (15). Total 85.

Kite 33

Hosted reading, for the platform and its remote MCP server. No public status page was found. None is linked from the docs or the footer, https://kite.new/status answers 404 and status.kite.new does not resolve (0). No readable incident history, so the floor (5). Limits are published with numbers on the account page, 200 agent actions a day on Free, reset at midnight UTC, unlimited on Pro; 60 new files an hour; 20 comments on one file every 10 minutes; 600 exported layers an hour; 20 keys; file caps of 400 MB and 250,000 layers. auth.md says registration and agent calls are rate-limited without a per-minute figure (12 of 15). 429 is documented in auth.md with 'back off' and no Retry-After, 401 with a refresh-once-then-rediscover rule, and the drawing guide says to edit layers in place rather than redraw; no idempotency key on any write and no safe-retry guidance for layer_draw, so a retried draw adds a second frame (6 of 15). No SLA. The terms (8 September 2026) say Kite is provided as is, uptime is not guaranteed and files may be lost (0). The hosted server carries no beta label and the registry entry is 1.0.0; the product launched on 6 October 2026 and the desktop apps are 0.1.16 (10). 0+5+12+6+0+10 = 33.

Impeccable 60

Free self-hosted software with nothing to buy from the project, so 20 + 20 + 20. No payment protocol (0). The privacy page describes a Pro waitlist with no price. Model usage and optional OpenAI image generation are billed by those providers. Total 60.

Kite 30

No x402, MPP or L402 in the docs, llms.txt, auth.md, the pricing pages or the terms (0). Plan prices are public and machine-readable at pricing.md, Free, Pro $20 per editor a month or $16 yearly, Team $35 or $28, with no per-call or per-action price since agent actions are counted on Free and unlimited on Pro (10 of 20). Free plan with 3 files and 200 agent actions a day, sign-up by emailed link or Google, no card mentioned anywhere (20). An agent can register itself as an OAuth client, but a person must sign up in a browser and click Allow, or make an API key in Settings (0). 0+10+20+0 = 30.

Impeccable 69

Apache-2.0 (30). The privacy page, updated 21 October 2026, says project checks run locally and upload no files or results. It lists what the version check, roll API and choice report send and keep (Cloudflare D1, Analytics Engine and R2, a keyed hash in place of the roll key, no fixed deletion date and no per-user deletion), and the website's Google Analytics and PostHog use. It agrees with the README and with crates/context/src/telemetry.rs. No DPA (24 of 30). Breaking changes are dated in the changelog, deprecated flags and the craft alias still work with a notice, but there's no written deprecation policy (10 of 20). Choice reporting is on by default and disclosed in the README and privacy page, with an opt-out by command, DO_NOT_TRACK, IMPECCABLE_NO_TELEMETRY or project config. The design-option request itself can't be turned off without a local catalogue (18 of 20). Total 82.

Kite 44

Closed service. The terms of use (8 September 2026) run to about 200 words on content, prohibited use, links, availability and changes and name no legal entity, address or governing law, so the contracting party is unknown (8 of 30). The privacy policy (14 October 2026) names eight services, says files are not read, trained on or sold, discloses masked session replays and error replays, gives the agent token's 7-day life renewable to 90 days (matching auth.md and the integration page), the 30-day purge of deleted pages and the one-month deletion of a closed account's files, and the Figma token's handling; no DPA and no retention period for logs beyond the providers' own (20 of 30). No deprecation policy or dated notices; the terms promise email or in-app notice of changes that matter and the changelog dates additions, not removals (4 of 20). Telemetry (PostHog, Sentry) is disclosed with what it excludes and no opt-out beyond product-news emails; service locations are given only for PostHog and Sentry (US) (10 of 20). 8+20+4+10 = 42.

Impeccable 66

Read from source and docs, not from a run. The detector's JSON is one array per scan, but the skill costs context: SKILL.md is 12 KB, and each command loads its own reference of up to 63 KB from 46 files totalling 446 KB (12 of 25). --scope, --no-advisory, --quiet and single-file targets narrow output, with no limit or paging on findings (12 of 20). Exit codes separate findings (2) from scan failures (1), and each finding carries a rule id, line and snippet with a fix direction (17 of 20). A scan is read-only and safe to repeat. Live mode writes accepted variants back to source, and the installer stops before overwriting a malformed hook manifest (15 of 20). detect runs with no flags, but it's a CLI only, with no library SDK in any language (10 of 15). Total 66.

Kite 44

MCP reading. 59 tools (61 through the Mac app) with no toolsets, read-only subset or dynamic loading; guide_read moves the long instructions out of tool descriptions into on-demand reads, but tools/list still carries 59 definitions (5 of 25). Output is sized by asking for one page in file_outline, one node in layer_source and layer_render, layer_search by name, words or type, file_search over content, comment_list with unread_only and include_resolved, request_list per file; file_list is newest-first with no documented paging (14 of 20). OAuth errors are documented with recovery steps, web_capture says when a page was cut short and an unknown shader base is refused, but a picture Kite cannot fetch is left out silently and no tool error shape is documented (9 of 20). No readOnlyHint or destructiveHint documented and no idempotency keys; version_save before a big change and version_restore undoable both ways, file_archive reversible and no permanent delete, layer_draw's replace argument for swapping a node (7 of 20). Few required parameters (file_new takes a title, layer_draw a file and HTML, finish_working a file), defaults in the drawing guide, and an MIT plugin repository for Claude Code, Codex, Cursor and Grok Bot; no SDK, since the vendor points at the official MCP SDKs (9 of 15). 5+14+9+7+9 = 44.

Impeccable 78

CLI reading of the API checklist. No JSON Schema for findings, but docs/CLI-CONTRACT.md fixes the finding fields, every flag, stdout and stderr, and exit codes, and --list-rules --json returns the catalogue as {id,name,category,severity,scopes,description} (12 of 25). llms.txt at impeccable.style and Markdown docs, SKILL.md and per-command references (10). The skill's description says when to use it and that it isn't for backend-only or non-UI tasks, and each of the 62 rules has its own description (17 of 20). Flags are validated (--scope against a fixed list, --viewport against WxH) with error messages that name the valid values, though most input is free paths (11 of 15). Help text and docs give examples, and the exit codes and error messages are documented verbatim (13 of 15). Versioned releases and a dated public changelog (15). Total 78.

Kite 62

MCP reading, since the MCP server is the only surface an outside agent reaches. No tool input schemas were read. The server card at /.well-known/mcp/server-card.json declares tools without listing them, and llms-full.txt describes every tool in prose with argument names in the skill, so typed inputs are the vendor's to show and were not seen (10 of 25). llms.txt, llms-full.txt, skill.md, auth.md and pricing.md are served as text and Markdown (10). Descriptions say what each tool does and when to use it, such as file_search over file_list when the user describes a file, layer_edit rather than redrawing, never base64 in HTML, never a picture of a design, guide_read's six topics, and the view-only rule (16 of 20). Inputs named in the docs are typed in prose, with enumerations for audience (link, restricted), export formats (svg, react, tailwind, html), sticky colours, shader bases and guide topics, and bounds for videos (100 MB) and fonts (4 MB), but the main write tool takes one HTML string and layer_edit a free CSS object (8 of 15). Worked HTML examples in skill.md, a prompt per client page, and auth.md's 401, 400 and 429 responses; no example tool call or response and no MCP error shape (8 of 15). A dated changelog with 15 entries from 6 October to 1 November 2026 that names agent-facing changes (page, version, comment and export tools on 25 October), server version 1.0.0; no versioned tool surface or deprecation policy (10 of 15). 10+10+16+8+8+10 = 62.