Letta vs mini-swe-agent

Letta 85

v0.34.42 on 6 November 2026 (30). Dozens of releases in 90 days (20). Pull requests are merged daily; recent issues from users have few replies (15 of 25). npm and PyPI packages and the Agent SDK track the releases (12 of 15). Lock files, CI and nightly smoke tests (8 of 10). Total 85.

mini-swe-agent 32

2.4.6 on PyPI on 2026-07-23, 104 days before this check, and still the newest tag (10). No release in the 90 days to 4 November (0). Main hasn't moved since 3 September (three commits since 23 July, one from pre-commit-ci). Outside fixes were merged within days through July, but no pull request has been merged since #917 (17 August), 77 of the 85 pull requests numbered after it still carry open merge refs on the git remote, and maintainer reply times couldn't be read; the 18 October shields.io counts are struck (5). The Python library ships in the same package as the CLI and is current (10). Dependabot and pre-commit-ci run, and CI workflows exist with their current state unconfirmed (7).

Letta 35

Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is unrestricted; standard, acceptEdits and strict are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.

mini-swe-agent 58

Harness reading of the framework checklist, used for every harness in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry in mini's own source, and prompts go only to the configured provider. LiteLLM's own network behaviour wasn't checked (28). The CLI asks before each command by default, with regex whitelists and -y to skip, but the Python DefaultAgent never asks, the default local environment has no isolation and passes the full host environment to every command, and the experimental bubblewrap sandbox leaks host variables and shares the network (CVE-2026-108592). Docker forwards no host variables unless listed (8). No prompt-injection guidance found (2). A full trajectory of every command and output saved as JSON after each step, and a trajectory inspector (13). A security policy (docs/SECURITY.md) naming four maintainers to contact by email, with no response time, which meets the disclosure-policy reading at 7 as for cowagent and tokenrip. No bounty or advisory page, and CVE-2026-108592 (VulnCheck, 10 October) still has no fix in any release or on main. Compromised LiteLLM 1.82.7 and 1.82.8 are excluded in the dependency pins since 24 March 2026 (#794) (7).

Letta 70

Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an applies_to block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.

mini-swe-agent 58

Framework reading. Typed pydantic config classes, typed protocols for agents, models and environments, py.typed, a mkdocstrings API reference and a documented trajectory format, but no machine-readable spec for configs or output (15). No llms.txt (/latest/llms.txt and /llms.txt returned 404). The docs are Markdown in the repository, readable raw, though they rely on build-time includes (3). The FAQ and environments page say when to pick mini over SWE-agent and which environment isolates, but the FAQ still says it doesn't use tool calls while the v2 guide says tool calls are now the default (12). Modes are a typed Literal and limits are typed fields, while model_kwargs passes free-form to LiteLLM (10). Hello-world and cookbook examples, a model troubleshooting page and a partial list of exit statuses (11). A dated v2 migration guide and kept v1 docs, with release notes only on GitHub, which we couldn't read (7).

Letta 58

Local-software lines, read for the harness. @letta-ai/letta-code on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.

mini-swe-agent 65

Read as a local package, graded on 2.4.6, the release pip install mini-swe-agent installs, and still the newest tag on 4 November 2026. One official PyPI package with Python 3.10 or newer stated (20). A pytest workflow runs on every push to main with Podman, bubblewrap and Apptainer installed, 41 test files and Codecov coverage, but GitHub's pages refused this run, so whether main passes is unconfirmed (15). Issue counts and types couldn't be read (the 18 October counts came from shields.io, a third-party copy, and are struck). The git remote shows outside bug fixes merged through 22 July, such as #915, #896 and #886, and nothing merged into main since apart from a pre-commit update on 17 August, while 77 of the 85 pull requests numbered after #917 still carry open merge refs (10). Versions follow semver and v2's breaking changes came with a migration guide, but there's no changelog file and tags carry only a version bump (8). 2.4.6, past 1.0, though the PyPI classifier still says 3 - Alpha (12).