mini-swe-agent vs Orca

mini-swe-agent 32

2.4.6 on PyPI on 2026-07-23, 104 days before this check, and still the newest tag (10). No release in the 90 days to 4 November (0). Main hasn't moved since 3 September (three commits since 23 July, one from pre-commit-ci). Outside fixes were merged within days through July, but no pull request has been merged since #917 (17 August), 77 of the 85 pull requests numbered after it still carry open merge refs on the git remote, and maintainer reply times couldn't be read; the 18 October shields.io counts are struck (5). The Python library ships in the same package as the CLI and is current (10). Dependabot and pre-commit-ci run, and CI workflows exist with their current state unconfirmed (7).

Orca 75

Tags to v1.4.251 and commits on 6 November 2026 (30). Many releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Current builds (15). Extensive CI (10). 30 + 20 + 0 + 15 + 10 = 75.

mini-swe-agent 60

Self-hosted rule. No payment protocol (0). Free under MIT with nothing to buy (20). No card or account for the software, and it runs against a local model (20). An agent can install it from PyPI and run a task with no sign-up, given a model endpoint (20).

Orca 40

Scored on the cloud option. No protocol (0). The cloud price wasn't found on the pages read (0). The desktop app is free and MIT with no card (20). The local app needs no sign-up that we found (20). 0 + 0 + 20 + 20 = 40.

mini-swe-agent 58

Harness reading of the framework checklist, used for every harness in this batch. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry in mini's own source, and prompts go only to the configured provider. LiteLLM's own network behaviour wasn't checked (28). The CLI asks before each command by default, with regex whitelists and -y to skip, but the Python DefaultAgent never asks, the default local environment has no isolation and passes the full host environment to every command, and the experimental bubblewrap sandbox leaks host variables and shares the network (CVE-2026-108592). Docker forwards no host variables unless listed (8). No prompt-injection guidance found (2). A full trajectory of every command and output saved as JSON after each step, and a trajectory inspector (13). A security policy (docs/SECURITY.md) naming four maintainers to contact by email, with no response time, which meets the disclosure-policy reading at 7 as for cowagent and tokenrip. No bounty or advisory page, and CVE-2026-108592 (VulnCheck, 10 October) still has no fix in any release or on main. Compromised LiteLLM 1.82.7 and 1.82.8 are excluded in the dependency pins since 24 March 2026 (#794) (7).

Orca 43

Harness reading. Anonymous usage data with an opt-out, per the README's link to its telemetry docs (15 of 30). Worktrees per agent and a sandboxed Linux build (12 of 20). No prompt-injection guidance (5). No audit log (5). A dependency-security workflow (6 of 20). 15 + 12 + 5 + 5 + 6 = 43.

mini-swe-agent 65

Read as a local package, graded on 2.4.6, the release pip install mini-swe-agent installs, and still the newest tag on 4 November 2026. One official PyPI package with Python 3.10 or newer stated (20). A pytest workflow runs on every push to main with Podman, bubblewrap and Apptainer installed, 41 test files and Codecov coverage, but GitHub's pages refused this run, so whether main passes is unconfirmed (15). Issue counts and types couldn't be read (the 18 October counts came from shields.io, a third-party copy, and are struck). The git remote shows outside bug fixes merged through 22 July, such as #915, #896 and #886, and nothing merged into main since apart from a pre-commit update on 17 August, while 77 of the 85 pull requests numbered after #917 still carry open merge refs (10). Versions follow semver and v2's breaking changes came with a migration guide, but there's no changelog file and tags carry only a version bump (8). 2.4.6, past 1.0, though the PyPI classifier still says 3 - Alpha (12).

Orca 58

Local software. Desktop and mobile builds and a Homebrew cask (20). Unit, end-to-end and platform test workflows; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). Tags to v1.4.251, no changelog file (8). Version 1.4 (15). 20 + 15 + 0 + 8 + 15 = 58.

mini-swe-agent 58

Framework reading. Typed pydantic config classes, typed protocols for agents, models and environments, py.typed, a mkdocstrings API reference and a documented trajectory format, but no machine-readable spec for configs or output (15). No llms.txt (/latest/llms.txt and /llms.txt returned 404). The docs are Markdown in the repository, readable raw, though they rely on build-time includes (3). The FAQ and environments page say when to pick mini over SWE-agent and which environment isolates, but the FAQ still says it doesn't use tool calls while the v2 guide says tool calls are now the default (12). Modes are a typed Literal and limits are typed fields, while model_kwargs passes free-form to LiteLLM (10). Hello-world and cookbook examples, a model troubleshooting page and a partial list of exit statuses (11). A dated v2 migration guide and kept v1 docs, with release notes only on GitHub, which we couldn't read (7).

Orca 65

Harness reading. A docs site with CLI orchestration and native chat pages (65).