Kilo Code CLI vs mini-swe-agent

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

mini-swe-agent

A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

Kilo Code CLI

1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry, including the conda client ID
3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
4. Without --auto a non-interactive run rejects every permission prompt and exits 1
5. Confine subagent writes with a session-level edit rule. From 7.8.13 a custom agent's own edit denies no longer bind the subagents it starts

mini-swe-agent

1. Run with -y --exit-immediately for unattended use. Without --exit-immediately it waits for input when the agent finishes
2. Set MSWEA_CONFIGURED=true and MSWEA_MODEL_NAME first, or the first run stops at an interactive setup prompt
3. Read info.exit_status in the -o trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use -c mini.yaml -c environment.environment_class=docker -c environment.image=<image>. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command