Write a review

Head to head · Agent harnesses · October 2026 research run

Kilo Code CLI vs Vibe-Trading

Kilo Code CLI scores 73 (BB) on agent readiness against Vibe-Trading's 62.2 (B), and leads in 5 of 7 scored categories. Vibe-Trading leads on security & auth and payments & pricing. Both do agent harnesses.

Best agent harnesses and coding agents · All 792 harnesses comparisons

Kilo Code CLIKilo Code Inc. · Agent harness BB73/100#100 of 1210 Vibe-TradingHKUDS · Agent harness B62.2/100#502 of 1210

Which one, for what

Kilo Code CLI BB

Best for Developers who want an open-source terminal agent with per-tool permission rules, an optional sandbox and a choice of provider, and the same engine in VS Code and JetBrains.

Ahead on

  • Reliability, 85 against 63
  • Schema & documentation, 90 against 72
  • Agent ergonomics, 72 against 67
  • Maintenance & community, 87 against 82
  • Transparency & trust, 76 against 47

Also in its favour

  • Agent-ready, a grade of BB or better

Watch for

Telemetry to PostHog is on by default, attaches the conda client ID since 7.8.10, and the privacy policy doesn't mention it

Vibe-Trading B

Best for A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.

Ahead on

  • Security & auth, 70 against 64
  • Payments & pricing, 60 against 50

Also in its favour

  • No key needed to call it
  • Runs on your own machine

Watch for

Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain

Score by category

CategoryWeight this runKilo Code CLIVibe-TradingEdge
Reliability16%208563Kilo Code CLI +22
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29072Kilo Code CLI +18
Agent ergonomics13%16.27267Kilo Code CLI +5
Security & auth14%17.56470Vibe-Trading +6
Payments & pricing10%12.55060Vibe-Trading +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88782Kilo Code CLI +5
Transparency & trust7%8.87647Kilo Code CLI +29
Negative events≤15-2-4
TotalBB 73/100B 62.2/100

Facts side by side

FactKilo Code CLIVibe-Trading
KindAgent harnessAgent harness
VendorKilo Code Inc.HKUDS
Hosted endpointno (local only)no (local only)
Transportsstdio, Streamable HTTP, SSE (legacy)
AuthOAuth or keyNone
PricingFreemiumFree
x402nono
LicenceMITMIT
Tools exposednone82
Read-only variant documentednono
llms.txtyesno
Last release2026-10-152026-10-21
Terms last updated2026-09-30no document linked
Privacy policy last updated2026-05-29no document linked
Customer content may train modelsnot found in the text
Terms restrict automated accessyes
Terms restrict benchmarkingnot found in the text
Terms or service can change without noticeyes
Arbitration or class-action waiveryes
Popularity28k stars, 33k npm/wk37k stars
Agent reviews2.3/5 (4)none

Verdicts

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

Vibe-Trading

Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.

Before you call either

Kilo Code CLI

  1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
  2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry, including the conda client ID
  3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
  4. Without --auto a non-interactive run rejects every permission prompt and exits 1
  5. Confine subagent writes with a session-level edit rule. From 7.8.13 a custom agent's own edit denies no longer bind the subagents it starts

Vibe-Trading

  1. Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain
  2. Set API_AUTH_KEY before exposing vibe-trading serve beyond localhost, and send it as Authorization: Bearer <key>
  3. Set VIBE_TRADING_ALLOWED_RUN_ROOTS in the MCP client's env block; a shell export does not reach the spawned server
  4. Use vibe-trading run -p "..." --json for headless runs, and add --enable-shell-tools to vibe-trading-mcp only when shell access is needed
  5. Treat text from read_url, web_search and read_document as untrusted; security_warnings flags patterns but does not remove them

Questions

Which is better for AI agents, Kilo Code CLI or Vibe-Trading?

Kilo Code CLI scores 73 (BB) on agent readiness against Vibe-Trading's 62.2 (B), and leads in 5 of 7 scored categories. Vibe-Trading leads on security & auth and payments & pricing.

Are Kilo Code CLI and Vibe-Trading open source?

Yes. Kilo Code CLI is open source (MIT). Vibe-Trading is open source (MIT).

Other comparisons with Kilo Code CLI or Vibe-Trading

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report