Kilo Code CLI vs OpenAI Agents API

Kilo Code CLI 85

Local-package reading. @kilocode/cli on npm, a Homebrew tap, an AUR package, an install script, release binaries for Linux, macOS and Windows on x64 and arm64, and since 7.8.20 (27 October) a kilo-cli conda package on Anaconda.org (20). Public CI, and the 40 most recent completed workflow runs on main on 8 October 2026 all succeeded, per the 8 October check, not re-read on 17 October or 1 November (25). 448 open issues and 147 open pull requests, a workflow that closes issues after 60 quiet days and pull requests after 30, and open reports from 7 October of a hanging turn (#14876) and of exhausted 503 retries ending a run with no visible error (#14877), per the 8 October check, not re-read since (15). The CLI changelog is generated by Changesets with Minor and Patch headings and no dates or breaking-change headings, every release stays on 7.8.x whatever its heading, and 7.8.13 and 7.8.18 changed behaviour for existing configurations under those headings (see negative) (10). 7.8.18 on the npm latest tag on 1 November, past 1.0 (15). 20 + 25 + 15 + 10 + 15 = 85.

OpenAI Agents API 60

Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.

Kilo Code CLI 64

Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Telemetry is on by default and goes to PostHog in the United States, the source links the machine identifier to the account email after a Kilo sign-in, and since 7.8.10 (14 October) it also attaches the conda client ID when ~/.conda/aau_token exists (see negative). It is turned off with experimental.openTelemetry or KILO_TELEMETRY_LEVEL. Provider keys stay on the machine (14). Shell commands ask by default outside a built-in allow list, reads of .env files and paths outside the project ask, and edits inside the project run without asking. An operating-system sandbox (Seatbelt on macOS, Bubblewrap on Linux, none on Windows) limits writes and blocks the network, refuses to run when it can't be enforced, and is off by default. --auto approves everything not explicitly denied. Since 7.8.13 a custom agent's own edit denies no longer bind the subagents it starts (15). The sandboxing page covers prompt injection and its limits, project config can't weaken the sandbox, and {env:VAR} is resolved only in trusted config. 7.8.16 (22 October) stopped running shell expressions found in MCP prompt text (see negative) and restricted MCP OAuth URLs to HTTP(S), and 7.8.18 stopped following cross-origin redirects for MCP HTTP and OAuth requests (11). Session export, kilo stats and OTLP export of traces and logs, with audit logs on the Enterprise plan (12). A valid security.txt (expires 2026-12-31, re-read on 1 November), a disclosure policy that cites HackerOne's standards and safe harbour, CodeQL in CI and no published repository advisories, though 7.8.16's MCP prompt fix appeared only as a changelog line. NVD lists CVE-2026-8766 and CVE-2026-8765 (both low, through 7.0.47, published 17 May 2026, the second a path traversal in the opt-in server's file diff route) and says the vendor didn't respond, and SECURITY.md still says the CLI has no sandbox (12). 14 + 15 + 11 + 12 + 12 = 64.

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

Kilo Code CLI 50

No payment protocol (0). Scored on Kilo's paid options, as with Cline. Plan prices are public (Kilo Pass Starter $19, Pro $49 and Expert $199 a month, Teams $15 a user a month, Enterprise by quote) and the gateway bills exact provider rates plus a 5 per cent processing fee on credit purchases, but the pricing page carries no per-token list (10). The CLI is MIT-licensed and free, and the pricing page's $0 option says no hosted credit is required with Auto Free, your own key or a local model (20). Your own provider key or a local model works with no Kilo account, so an agent can install and run it without a sign-up (20). Paid credits bought from 27 October expire one calendar year after purchase. 0 + 10 + 20 + 20 = 50.

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

Kilo Code CLI 76

MIT, with opencode's copyright kept in the licence file (30). The privacy policy (29 May 2026, re-read on 1 November) names Kilo Code Inc. as controller, says data is stored in the United States and lists Stripe, OpenRouter, model providers, AppsFlyer and Sentry, but it doesn't mention the CLI's PostHog telemetry. PRIVACY.md in the repository is dated March 2025 and is silent on telemetry too. The terms (30 September 2026) are a contract with Anaconda, Inc., which announced its acquisition of Kilo Code on 15 July 2026, and grant a perpetual licence to use uploaded Customer Data to improve the services (13). kilo console is marked deprecated with no removal date, and updated terms apply after 30 days. No written deprecation policy found (8). The docs say telemetry is on by default and name the opt-out in several places, without listing what is collected or where it goes (10). 30 + 13 + 8 + 10 = 61.

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

Kilo Code CLI 72

Framework reading, adapted to a harness driven by a pipeline. Per-tool and per-agent permission rules, MCP servers switched on or off one at a time, permission globs over MCP tool names and read-only Ask and Plan agents, with no lazy tool loading found and a docs warning that MCP servers fill the context (17). Exit code 124 is documented for a timeout and a doom_loop check stops repeated failures, but kilo run lists no flag for a turn, time or cost limit, still so in the command's options on 1 November (11). Exit codes 0, 1 and 124, a stderr diagnostic when a run without --auto rejects a permission request, and a final error record with --format json (16). --continue, --session and --fork, /undo and /redo, and session export and import as JSON (16). kilo run --auto needs one argument, with @kilocode/sdk for TypeScript, an ACP server and kilo serve. We found no second-language SDK on a registry (12). 17 + 11 + 16 + 16 + 12 = 72.

OpenAI Agents API 80

Read as an API an agent drives. Context is compacted automatically, and session budgets and streamed events keep output sized (20 of 25). Sessions can be listed, continued and steered, events streamed or sent by webhook, artifacts fetched (15 of 20). Actionable error codes with recovery steps (20). No idempotency key; a documented check-then-retry procedure (10 of 20). One session call with defaults (medium sandbox, network enabled), SDKs in five languages (15). 20 + 15 + 20 + 10 + 15 = 80.