Junie CLI vs Traycer

Junie CLI 33

Local-package reading, the same as the other closed-source harnesses. Install scripts for macOS, Linux and Windows on x86-64 and ARM64, a Homebrew tap and npm, with SHA-256 sums checked against the release feed (update-info.jsonl, read from a clone on 4 November), but the script carries on without a sum for an unlisted version and npm sat five weeks behind at 3110.7.0 on 18 October (17). No public CI or test suite. No source is published and the repository has no workflow files, per a clone on 4 November (0). Crash and regression line 0. The 18 October counts came from shields.io badges and YouTrack's JSON API, both struck in this run, and no first-hand reading of the GitHub tracker or YouTrack is possible today (github.com pages refused, JetBrains hosts paused). What's New dates every build, but entries are one line and no breaking change is called out, and versions are a date plus a build number, per the 18 October check (6). JetBrains said Junie left Beta on 17 June 2026, but the headless page dated 15 October still calls the CLI an EAP, per the 18 October check (10). 17+0+0+6+10 = 33.

Traycer 65

Local software. Builds for macOS, Linux and Windows, and package-manager publishing workflows (20). test.yml, CodeQL, OpenSSF Scorecard and secret scanning run on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). CHANGELOG.md (15). Host 1.5.3 (15). 20 + 15 + 0 + 15 + 15 = 65.

Junie CLI 77

Proprietary, with clear terms. The JetBrains AI Terms of Service (version 2.1, effective 30 September 2025) name AI Assistant and Junie, though the Junie EAP terms from December 2024 still call Junie a plugin (15). The terms rule out training on inputs without consent and list AI subcontractors with 30 days' notice of new ones (page updated 29 September 2026, naming OpenAI, Google, Anthropic and SpaceXAI for Junie). The AI FAQ says nothing persists unless detailed data collection is on, retained up to a year, and that it's on by default for non-commercial licences. Security monitoring keeps data for an unstated limited period (22). The terms promise 30 days' email notice before JetBrains AI is discontinued, but Junie Lite's model may change without notice and model aliases change without a stated period (10). A per-run override for anonymous statistics is documented, with no stated default and no list of what is sent (10). 15+22+10+10 = 57. Per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites.

Traycer 60

MIT (30). README privacy section and a linked privacy policy (not read) (18 of 30). CHANGELOG.md, no deprecation policy (10). Analytics described as 'may be enabled', with no opt-out given in the README (8 of 20). 30 + 18 + 10 + 8 = 66.

Junie CLI 56

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. A browser login, a long-lived Junie API key with no scopes we found, or provider keys passed as flags or environment variables. The CLI's statistics default isn't stated (13). The allowlist asks before terminal commands, MCP tools, edits outside the project, reads outside it and secret files, and checks every part of chained, nested and multi-line commands. Brave mode is interactive only. Sandbox mode limits writes and hides ~/.ssh, but it's EAP-only, off by default, missing on Windows, and leaves the network open by default (12). Interactive runs keep an untrusted project's MCP servers, hooks and skills unloaded and a project can't widen the sandbox, but one-shot, piped, ACP and Gateway runs trust every project by design, and the docs say to run them only in trusted projects (9). /usage shows per-session cost and sessions are stored, and PreToolUse hooks in batch runs can log or block tools, but they're EAP, and no audit log for the CLI was found (7). A coordinated disclosure policy (updated 10 October 2026) and a security.txt contact, CVEs JetBrains publishes as a CVE numbering authority (three for Junie in cvelistV5) and a fixed-issues page, discretionary rewards with no formal bounty, and SOC 2 per the Junie homepage. The repository has no SECURITY.md, per a clone on 4 November (15). The docs, policy and homepage readings are per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites. 13+12+9+7+15 = 56.

Traycer 42

Harness reading. Code is processed in memory and not used for training, but Privacy Mode is opt-in for individuals, prompts may be logged with it off, and Sentry and PostHog 'may be enabled in release builds' (10 of 30). No approval model described in the README (8 of 20). No prompt-injection guidance (5). No audit log found (5). SECURITY.md, CodeQL, Scorecard and secret scanning (14 of 20). 10 + 8 + 5 + 5 + 14 = 42.

Junie CLI 42

Harness reading of the published rubric. No payment protocol (0). Plan prices and the US$1 credit are public without a login, but per-model credit rates and Junie API key usage rates weren't found (12). Junie Lite is free with a JetBrains account and no card (20). Judgement call. The docs present BYOK keys and custom endpoints such as Ollama as alternatives to a JetBrains sign-in, so a pipeline holding a provider key needs no JetBrains signup, but the headless page says a token is required and a Junie API key is created by hand at junie.jetbrains.com/cli (10). 0+12+20+10 = 42. Per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites.

Traycer 30

Scored on the paid option, Traycer's own inference subscription, whose price wasn't read (0 of 20). No protocol (0). Bring-your-own-agent use is free (20). Accounts for sync and teams weren't checked, half (10). 0 + 0 + 20 + 10 = 30.

Junie CLI 64

Release 26.11.3 (build 3959.5) added to the release feed on 3 November 2026, read from a clone of JetBrains/junie (30). The release channel added 30 builds between 6 August and 3 November, from 2651.3 on 11 August to 3959.5, and the repository has 1,032 tags created in that window, most of them nightly builds (20). Responsiveness 5 of 25. The 18 October counts of the GitHub tracker and YouTrack came from shields.io badges and YouTrack's JSON API, both struck, so what is left is the dated What's New page and a Discord server, per the 18 October check, with replies unread (5). No SDK and no registry entry. The GitHub Action is at v1 and GitLab CI is documented, and ACP is kept current, per the 18 October check (6). Closed source with no workflow files in the repository, so no CI or dependency health to read. The installer checks sums, and npm sat five weeks behind the release feed on 18 October (3). 30+20+5+6+3 = 64.

Traycer 75

Commits on 6 November 2026 and host 1.5.3 (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current apps and CLI packages (15). CI with tests (10). 30 + 20 + 0 + 15 + 10 = 75.

Junie CLI 55

Framework reading, adapted to a harness driven by a pipeline. MCP tools can be allowed per server prefix, and default MCP, skill, agent and config locations can each be switched off, with no deferred tool loading found (15). text, json and json-stream output and --json-output-file. Remote mode mentions a step limit, but no turn, time or spend cap for a headless run was documented (10). No exit codes. A Stop hook can end a task with a failure status, and StopFailure names the failure category (8). Sessions resume with --session-id or --resume, and worktrees isolate parallel sessions (14). One command with --auth and a dynamically chosen default model, a GitHub Action and GitLab CI, and no SDK (8). 15+10+8+14+8 = 55. Per the 18 October check, not re-read on 4 November, because JetBrains' website terms bar robots and data mining on its sites.

Traycer 65

Harness reading. Model switching within an agent, agent-to-agent loops, a CLI and cross-device sync (65).