Kilo Code CLI vs Verdent

Kilo Code CLI 85

Local-package reading. @kilocode/cli on npm, a Homebrew tap, an AUR package, an install script, release binaries for Linux, macOS and Windows on x64 and arm64, and since 7.8.20 (27 October) a kilo-cli conda package on Anaconda.org (20). Public CI, and the 40 most recent completed workflow runs on main on 8 October 2026 all succeeded, per the 8 October check, not re-read on 17 October or 1 November (25). 448 open issues and 147 open pull requests, a workflow that closes issues after 60 quiet days and pull requests after 30, and open reports from 7 October of a hanging turn (#14876) and of exhausted 503 retries ending a run with no visible error (#14877), per the 8 October check, not re-read since (15). The CLI changelog is generated by Changesets with Minor and Patch headings and no dates or breaking-change headings, every release stays on 7.8.x whatever its heading, and 7.8.13 and 7.8.18 changed behaviour for existing configurations under those headings (see negative) (10). 7.8.18 on the npm latest tag on 1 November, past 1.0 (15). 20 + 25 + 15 + 10 + 15 = 85.

Verdent 43

Local-package reading, as for the other closed-source harnesses. The desktop app installs from verdent.ai with macOS 11 or later and 64-bit Windows 10 and 11 stated, and the extension from the editor marketplaces, but not from a package registry (15). No public CI or test suite, since the source isn't published (0). No public issue tracker, every task runs through Verdent's servers, and no status page was found, so there is no readable record (5). A dated changelog by version, with the end of Free Mode called out in v2.18.0, but no breaking-change sections (8). 2.18.0, generally available (15). 15+0+5+8+15 = 43.

Kilo Code CLI 72

Framework reading, adapted to a harness driven by a pipeline. Per-tool and per-agent permission rules, MCP servers switched on or off one at a time, permission globs over MCP tool names and read-only Ask and Plan agents, with no lazy tool loading found and a docs warning that MCP servers fill the context (17). Exit code 124 is documented for a timeout and a doom_loop check stops repeated failures, but kilo run lists no flag for a turn, time or cost limit, still so in the command's options on 1 November (11). Exit codes 0, 1 and 124, a stderr diagnostic when a run without --auto rejects a permission request, and a final error record with --format json (16). --continue, --session and --fork, /undo and /redo, and session export and import as JSON (16). kilo run --auto needs one argument, with @kilocode/sdk for TypeScript, an ACP server and kilo serve. We found no second-language SDK on a registry (12). 17 + 11 + 16 + 16 + 12 = 72.

Verdent 35

Harness reading. MCP servers per project or globally, subagents, skills and rules, but no per-tool disabling or deferred loading found (10). No output-size, turn-limit or budget controls for a run were found beyond credit balances (5). No exit codes or error format, since there is no headless mode (3). Parallel workers in git worktrees and a review column make runs reviewable and reversible, with no resume by ID documented (10). No CLI, API or SDK. A pipeline can only reach Manager through a paired Telegram, Slack or Feishu bot (7). 10+5+3+10+7 = 35.

Kilo Code CLI 90

Framework reading. A JSON Schema for kilo.jsonc at https://app.kilo.ai/config.json, an OpenAPI file for the kilo serve API at packages/sdk/openapi.json and a CLI reference generated from the command definitions (25). llms.txt on kilo.ai and on the docs, the second listing a raw Markdown address for every page (10). The sandboxing page says when to use the sandbox, what it does not protect and how it differs from permissions (16). Permissions are allow, ask or deny with glob rules, sandbox.network and --format are enums, though the schema served on 8 October had no sandbox key (13). Config and CI samples and exit codes 0, 1 and 124, but we found no reference for the records --format json writes (11). A versioned changelog and dated GitHub releases (15). Not re-read on 1 November apart from the changelog. 25 + 10 + 16 + 13 + 11 + 15 = 90.

Verdent 55

Framework reading for a harness. No schema for settings or output, only mcp.json examples in the standard mcpServers shape (5). Every current docs page has a Markdown twin at the same path with .md, though no llms.txt (10). The docs say when to use Agent Mode or Plan Mode and what Plan Mode can't do, but the Agent Mode page lists the actions that need approval only as "certain tool executions" and "destructive operations" (12). Modes and BYOA agent types are enumerated, permissions are not (5). Examples on the MCP, BYOA and messaging pages, and a recovery page, with no error codes (8). Version numbers and a dated public changelog (15). The archived 1.0 docs are still served beside the current ones. 5+10+12+5+8+15 = 55.

Kilo Code CLI 64

Harness reading of the framework checklist. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Telemetry is on by default and goes to PostHog in the United States, the source links the machine identifier to the account email after a Kilo sign-in, and since 7.8.10 (14 October) it also attaches the conda client ID when ~/.conda/aau_token exists (see negative). It is turned off with experimental.openTelemetry or KILO_TELEMETRY_LEVEL. Provider keys stay on the machine (14). Shell commands ask by default outside a built-in allow list, reads of .env files and paths outside the project ask, and edits inside the project run without asking. An operating-system sandbox (Seatbelt on macOS, Bubblewrap on Linux, none on Windows) limits writes and blocks the network, refuses to run when it can't be enforced, and is off by default. --auto approves everything not explicitly denied. Since 7.8.13 a custom agent's own edit denies no longer bind the subagents it starts (15). The sandboxing page covers prompt injection and its limits, project config can't weaken the sandbox, and {env:VAR} is resolved only in trusted config. 7.8.16 (22 October) stopped running shell expressions found in MCP prompt text (see negative) and restricted MCP OAuth URLs to HTTP(S), and 7.8.18 stopped following cross-origin redirects for MCP HTTP and OAuth requests (11). Session export, kilo stats and OTLP export of traces and logs, with audit logs on the Enterprise plan (12). A valid security.txt (expires 2026-12-31, re-read on 1 November), a disclosure policy that cites HackerOne's standards and safe harbour, CodeQL in CI and no published repository advisories, though 7.8.16's MCP prompt fix appeared only as a changelog line. NVD lists CVE-2026-8766 and CVE-2026-8765 (both low, through 7.0.47, published 17 May 2026, the second a path traversal in the opt-in server's file diff route) and says the vendor didn't respond, and SECURITY.md still says the CLI has no sandbox (12). 14 + 15 + 11 + 12 + 12 = 64.

Verdent 33

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). Conversation history and tool results go to Verdent's US servers and on to Azure, Bedrock or Vertex, with zero data retention stated for Vertex and Bedrock only. Event logging to log.verdent.ai has no documented opt-out. BYOA keys stay on the machine (10). Plan Mode is read-only, Agent Mode asks before destructive commands and edits outside scope, and workers are isolated by git worktree, but there is no sandbox or network control and the approval list isn't enumerated (9). No prompt-injection guidance found, while web search and fetch results enter the context (2). Usage history in the dashboard, no audit log found (5). A security page with a disclosure address and a five-day acknowledgement, SOC 2 and ISO/IEC 42001 being pursued rather than held, no security.txt and no bug bounty (7). 10+9+2+5+7 = 33.

Kilo Code CLI 50

No payment protocol (0). Scored on Kilo's paid options, as with Cline. Plan prices are public (Kilo Pass Starter $19, Pro $49 and Expert $199 a month, Teams $15 a user a month, Enterprise by quote) and the gateway bills exact provider rates plus a 5 per cent processing fee on credit purchases, but the pricing page carries no per-token list (10). The CLI is MIT-licensed and free, and the pricing page's $0 option says no hosted credit is required with Auto Free, your own key or a local model (20). Your own provider key or a local model works with no Kilo account, so an agent can install and run it without a sign-up (20). Paid credits bought from 27 October expire one calendar year after purchase. 0 + 10 + 20 + 20 = 50.

Verdent 20

Harness reading of the published rubric, scored on the Verdent subscription the agent needs. No payment protocol (0). Plan prices from $5 a month, top-up prices and the credit value of about $0.059 are public without a login (20). Free Mode and the free trial ended on 29 October 2026, so there is no free tier (0). A person signs up in a browser (0). 0+20+0+0 = 20.

Kilo Code CLI 87

7.8.18 on the npm latest tag (tag of 26 October 2026), with 7.8.25 on the rc tag (28 October) (30). 51 v7 release tags from 4 August to 28 October 2026, among them 7.8.13 to 7.8.25 since the 17 October check (20). Issue replies weren't re-read. The newest issues carry area and triage labels from automation, but the 15 newest open issues had no or one comment each on 8 October, against 448 open issues and 147 open pull requests, per the 8 October check (15). @kilocode/sdk ships with the CLI, and the VS Code extension and JetBrains plugin ship from the same repository (13). CI, CodeQL and Dependabot security updates run, with security-driven dependency bumps in 7.8.18 and 7.8.20 (9). 30 + 20 + 15 + 13 + 9 = 87.

Verdent 61

Closed service. v2.18.0 on 29 October 2026, eight days before this check (30). More than three dated releases in the 90 days from 8 August, among them 2.10.0 to 2.18.0 (20). A dated public changelog, a support address, Discord and a subreddit, with no public tracker to read reply times (8). No official SDK or MCP server to keep current (0). No public packages or CI to judge (3). 30+20+8+0+3 = 61.