Kiro CLI vs OpenAI Agents API

Kiro CLI 69

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and content collection are on by default for Free and individual accounts, each with a documented opt-out, and enterprise users are opted out. API keys are long-lived and revocable with no scopes, and administrators must switch key generation on (14). Deny over ask over allow across six scopes, hard-coded denies on Kiro's own settings paths, workspace trust and a managed policy that fails closed. V3 is the default since 3.0.0 (3 November 2026), interactive V3 sessions ask before loading a folder's hooks, agents and MCP servers since 2.33.0, and /sandbox puts agent shell commands and local stdio MCP servers in an operating-system sandbox. The sandbox is off unless chosen and doesn't cover the agent, built-in file tools or remote MCP servers, and AWS says managed policies are client-enforced and can be circumvented (17). An untrusted workspace doesn't load its agents, steering, MCP configuration or skills, compound shell commands are split before matching, and the MCP page warns that servers run outside any sandbox (11). Enterprise prompt logging to the customer's S3 bucket covers the CLI, with daily activity reports and OpenTelemetry export, and individuals have local logs only (11). AWS vulnerability reporting through a HackerOne disclosure programme with no paid bounty, CVEs published in security bulletins with credit to reporters, ISO/IEC 27001:2022 scope and HIPAA eligibility. The aws.amazon.com security.txt is valid (Expires 2027-10-16) and kiro.dev/.well-known/security.txt answers 404, so 2 are held back for that and 2 for no bounty (16). 14+17+11+11+16 = 69.

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

Kiro CLI 73

3.0.0 on 3 November 2026, after 2.37.1 on 31 October (30). 25 dated releases from 2.17.0 on 11 August to 3.0.0 on 3 November, plus five patches, read from the first three changelog pages back to 9 July (20). A public issue tracker with area labels and triage automation, 69 cli issues closed against 96 opened in the 30 days to 8 October, and a Discord server, per the 8 October check, not re-read on 3 November. We didn't establish how many replies come from staff (14). No SDK and no registry entry. The ACP server is kept current, with ACP sign-in added in 2.37.0 and a migration guide for clients moving to V3 (6). Closed source, so no CI or dependency health to read. The installer verifies checksums (3). 30+20+14+6+3 = 73.

OpenAI Agents API 87

Closed API. Last dated change 16 October 2026, Ultrafast mode and document skills (30). Four dated changelog entries in the 57 days since release, 10 September, 29 September, 9 October and 16 October (20). Changelog and help centre, as the openai-api listing reads them (12 of 15). Official SDKs carry beta.agents (15). SDK CI, per the openai-api listing (10). 30 + 20 + 12 + 15 + 10 = 87.

Kiro CLI 71

Proprietary, with clear terms. The licence page puts the CLI under the AWS Customer Agreement and the AWS Intellectual Property Licence, where the Amazon Q Developer CLI it replaced was Apache 2.0, per the 8 October check (15). The data protection page (updated 23 October 2026) says what is stored for Free, individual and enterprise users, names US East (N. Virginia) for storage, and gives 60 days for Free Tier abuse detection and 30 days for some models. It agrees with sections 50.3 and 50.14 of the AWS Service Terms, read on 8 October. No general retention period for stored content was found (22). The models page has a model lifecycle section with Experimental, Active and EOL stages and dates, and Claude Sonnet 4 ended on 14 October 2026. 3.0.0 made V3 the default as 2.30.0 announced and retired the Classic interface 34 days after the 2.26.0 deprecation notice, but the desktop app and inline autocomplete were retired in the same release with no earlier notice found, and no minimum notice period is stated (14). Telemetry types are listed and kiro-cli settings telemetry.enabled turns them off, with collection on by default. The data protection page's CLI steps still point to the desktop app's Preferences, which 3.0.0 retired (15). 15+22+14+15 = 66.

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

Kiro CLI 67

Framework reading, adapted to a harness driven by a pipeline. --trust-tools limits approved tools, disabledTools removes MCP tools per server, tool search loads MCP tools on demand, and custom agents carry their own tool set (20). Compaction and a workflow timeout (KIRO_HEADLESS_WORKFLOW_TIMEOUT_SECS, six hours by default) exist, but no cap on turns or run time for a plain headless run was found (10). Distinct exit codes for MCP startup failure and a missing agent, --require-mcp-startup, and a final interruption record in stream-json, with exit 1 for everything else (14). Sessions are saved every turn, with --resume, --resume-id and checkpoints with rewind (15). No SDK. The programmatic interfaces are the headless command and the ACP server, and a headless run needs a paid-plan API key and explicit trust flags (8).

OpenAI Agents API 80

Read as an API an agent drives. Context is compacted automatically, and session budgets and streamed events keep output sized (20 of 25). Sessions can be listed, continued and steered, events streamed or sent by webhook, artifacts fetched (15 of 20). Actionable error codes with recovery steps (20). No idempotency key; a documented check-then-retry procedure (10 of 20). One session call with defaults (medium sandbox, network enabled), SDKs in five languages (15). 20 + 15 + 20 + 10 + 15 = 80.

Kiro CLI 40

Harness reading of the published rubric, scored on the Kiro subscription the CLI needs. No payment protocol (0). Plan prices, the $0.04 credit price and per-model credit multipliers are public without a login (20). Kiro Free has 50 credits a month, and the pricing page asks for a card only on upgrade (20). A person signs in through a browser or device flow, and the API key for headless runs is created by hand at app.kiro.dev on a paid plan (0).

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

Kiro CLI 79

Framework reading. A command reference, a settings reference, an exit-code page and a documented rule format for permissions, plus the Agent Client Protocol methods the CLI implements. No published schema for the stream-json events was found (14). kiro.dev/llms.txt indexes every docs page and each has a Markdown twin, though robots.txt disallows both for crawlers (10). The permissions page states the defaults, what each preset allows and when to pick it, and that headless runs treat ask as deny (16). Rules are validated, an unknown preset rejects the session request, and a malformed managed policy fails closed (12). CI examples, exit codes 0, 1, 3 and 4 and hook exit codes are documented, but code 1 covers every other failure (12). Versioned releases with a dated changelog and a 2.x reference kept beside V3 (15).

OpenAI Agents API 88

The reference is linked from the overview and the SDKs carry beta.agents types; we didn't confirm /agents/sessions in OpenAI's public OpenAPI file, so 15 of 25. llms.txt with every Agents API page and Markdown twins (10). The overview, architecture page and the agents guide that compares the Agents API, Agents SDK and Responses API say when to use it (20). Typed configuration with enumerated container sizes, network modes and environment types (13 of 15). Examples in six languages and an errors page with codes per HTTP status, turn and session (15). Dated changelog entries and a versioned beta header (15). 15 + 10 + 20 + 13 + 15 + 15 = 88.