mini-swe-agent vs Qoder CLI

mini-swe-agent

A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

Qoder CLI

A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy.

mini-swe-agent

1. Run with -y --exit-immediately for unattended use. Without --exit-immediately it waits for input when the agent finishes
2. Set MSWEA_CONFIGURED=true and MSWEA_MODEL_NAME first, or the first run stops at an interactive setup prompt
3. Read info.exit_status in the -o trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use -c mini.yaml -c environment.environment_class=docker -c environment.image=<image>. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command

Qoder CLI

1. Set QODER_PERSONAL_ACCESS_TOKEN in CI. The browser sign-in can't complete in a headless run
2. Pass --permission-mode with --allowed-tools in headless runs. Every ask is denied, and --yolo removes all checks
3. Set --max-turns on unattended runs, and branch on exit codes 41 (authentication) and 53 (turn limit)
4. Set privacy.usageStatisticsEnabled and aiCodeStatistics.enabled to false in ~/.qoder/settings.json if usage data must stay local
5. Don't pass --model lite. The Lite tier was removed on 18 September 2026 and headless requests naming it fail