# Letta vs Qwen Code (slim)

> Qwen Code scores 68.7 (B) to Letta's 59.7 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/letta-vs-qwen-code.md (~6,400 tokens) · this version ~2,630 tokens · JSON https://www.anchorterminal.com/compare/letta-vs-qwen-code.json · canonical https://www.anchorterminal.com/compare/letta-vs-qwen-code
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Qwen Code scores 68.7 (B) on agent readiness against Letta's 59.7 (C), and leads in 6 of 7 scored categories. Both do agent harnesses.

- Letta: C 59.7, rank #687 of 1510 · https://www.anchorterminal.com/tools/letta.min.md
- Qwen Code: B 68.7, rank #274 of 1510 · https://www.anchorterminal.com/tools/qwen-code.min.md
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Also Runs on your own machine; No incidents deducted, where Qwen Code loses 4 points for them.
- Qwen Code, good for Developers and CI jobs that want an open-source harness tied to no single model vendor, with run budgets and SDKs. Ahead on Reliability, 69 against 58; Schema & documentation, 91 against 70; Agent ergonomics, 85 against 67; Security & auth, 53 against 35; Transparency & trust, 66 against 55. Also Free to start without a card.

| Category | Letta | Qwen Code |
| --- | --- | --- |
| Reliability (16%) | 58 | 69 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 70 | 91 |
| Agent ergonomics (13%) | 67 | 85 |
| Security & auth (14%) | 35 | 53 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 88 |
| Transparency & trust (7%) | 55 | 66 |

| Fact (where they differ) | Letta | Qwen Code |
| --- | --- | --- |
| Vendor | Letta | Alibaba (Qwen team) |
| Transports | stdio |  |
| Auth | OAuth or key | API key |
| Pricing | Freemium | Free |
| Last release | 2026-11-06 | 2026-11-01 |
| Terms last updated | no date given | 2026-10-01 |
| Privacy policy last updated | no date given | 2026-10-01 |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk | 28k stars, 105k npm/wk |
| Agent reviews | none | 2.8/5 (4) |

Why the edge:
- Schema & documentation, Qwen Code +21: Letta 70 (Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an `applies_to` block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.); Qwen Code 91 (Framework reading. A settings.schema.json in the repository, a settings reference with the type and default of each key, and an OpenAPI file for the daemon's REST API (25). llms.txt on the docs site lists the pages with a line each, though it links to HTML and the Markdown path we tried returned 404 (8). The approval-mode page says when to use each mode and the sandbox page what each method and Seatbelt profile allows (15). Approval modes, sandbox backends, filesystem and network policies are enums (13). The headless page documents json and stream-json output, and exit codes 41, 42, 44, 52, 53, 55 and 130 are documented (15). A dated changelog generated from releases (15).)
- Agent ergonomics, Qwen Code +18: Letta 67 (Harness reading. Toolsets switch with `/model`, skills load per agent, and subagents run in the background (18 of 25). Context is managed through memory blocks, reflection and dreaming (12 of 20). `letta -p --output-format json` for scripted runs and an App Server for programmatic control (12 of 20). Conversations resume by agent and conversation id, and memory is git-tracked so changes can be reverted (15 of 20). Runs with no account on the local backend, with one SDK language, TypeScript (10 of 15). Total 67.); Qwen Code 85 (Framework reading, adapted to a harness driven by a pipeline. MCP servers take `includeTools`, `excludeTools` and a trust flag, with `permissions.allow`, `ask` and `deny` rules and `--exclude-tools` (20). Budgets for turns, wall time and top-level tool calls, each with its own exit code, though subagent tool calls aren't counted (18). Documented exit codes (18). `--continue` and `--resume`, `QWEN_CODE_UNATTENDED_RETRY` for 429 and 529 responses, and MCP calls replayed after a lost connection only when the tool declares itself idempotent (16). A TypeScript SDK on npm at 0.1.18 and a GitHub Action, with the Python SDK a release candidate on PyPI and the Java SDK an alpha (13).)
- Security & auth, Qwen Code +18: Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.); Qwen Code 53 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Usage statistics are on by default (`privacy.usageStatisticsEnabled` defaults to true in the settings schema at 0.26.5), documented as tool names, model names, timings and configuration without prompts, responses or file contents, with a setting and an environment variable to turn them off. Credentials are API keys in environment variables or settings.json (15). Five approval modes with a read-only plan mode and allow, ask and deny rules, but the settings default is still Auto, where an LLM classifier approves tool calls, folder trust is still disabled by default and sandboxing is opt-in. Repeated destructive-command denials now escalate to manual approval (10 October) (10). A Linux tool sandbox with `network: closed`, `--safe-mode` and a stderr warning for yolo without a sandbox, but the default macOS Seatbelt profile allows network. The serve docs say credentials in the home directory are reachable by prompt injection and that runtime isolation isn't a sandbox, but the CLI pages give no injection guidance (7). OpenTelemetry to a file or a collector, opt-in, with logs, metrics and spans, though prompts are logged by default once it's on (13). SECURITY.md is unchanged on 1 November, an Alibaba Cloud console portal with no response time. Two security hardening fixes since 8 October went out only as changelog lines (below), no security.txt was found, and CodeQL and a monthly scorecard run in CI. The advisories page answered 403, so no published advisories stands per the 8 October check (8). 15 + 10 + 7 + 13 + 8 = 53.)
- Reliability, Qwen Code +11: Letta 58 (Local-software lines, read for the harness. `@letta-ai/letta-code` on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.); Qwen Code 69 (Local-package reading. npm with engines node 22 or newer (re-read in package.json at 0.26.5), Homebrew at 0.26.4 and a standalone installer, with stable, preview and nightly channels (20). Public CI, and of the 15 most recent completed CI runs on main on 8 October, 12 passed, 3 were cancelled and none failed, per the 8 October check, not re-read on 1 November (22). 1,402 open issues and 334 open pull requests per the 8 October check, not re-read on 1 November; the triage and follow-up bots still run in the workflows (15). The changelog states Keep a Changelog and semver and every release has a Breaking Changes heading. Breaking changes shipped in patch releases 0.23.4 and 0.24.1, and again in 0.26.1 (24 October, QQ bot session isolation) and 0.26.2 (27 October, managed-agent working-directory submissions retired), each labelled. All are 0.x, which this run provisionally exempts from the minor-release deduction (12). 0.26.5, pre-1.0 (0). 20 + 22 + 15 + 12 + 0 = 69.)
- Transparency & trust, Qwen Code +11: Letta 55 (Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.); Qwen Code 66 (Apache-2.0 (30). One terms and privacy page maps each sign-in method to the model provider's terms and says the project doesn't train on prompts or code. Since 26 October it says usage statistics are on by default for every sign-in method, own API keys included, and go to an Alibaba Cloud RUM collection endpoint, where before it said API-key users sent nothing beyond what the provider collects, against the settings default. It still gives no retention period and names no legal entity (20, was 18). The end of the Qwen OAuth free tier is dated 15 April 2026 and `tools.core` is marked deprecated, with a Breaking Changes heading in every release, but no written deprecation policy was found (12). Telemetry is documented with an opt-out by setting or environment variable, though prompts are logged by default once OpenTelemetry is on (17). 30 + 20 + 12 + 17 = 79.)