MiniMax Code vs OpenAI Agents API

MiniMax Code 57

Harness reading of the framework checklist. 30 for credentials and what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Provider keys are read from an environment variable and never printed, and stored in config.yaml in the data directory. All three telemetry channels are off by default and the doc lists every field sent. The default smart policy classifies actions through a cloud classifier, and what it sends isn't documented (20). Ask, Auto and Full access in the TUI. Headless defaults to smart and fails on a pending permission request instead of approving it, while full and off skip checks. A bundled sandbox runtime with macOS tests, a read-only filesystem policy for Explore subagents when sandboxing is available, but the default sandbox coverage isn't documented (12). SECURITY.md says permissions and sandboxing don't replace review of untrusted plugins, MCP servers and shell commands. No guidance found for fetched web content (6). Sessions kept locally, /export with credential redaction, /transcript and stream-json events (11). SECURITY.md takes private reports by email and GitHub's private advisories with no response SLA, history and build scans with Gitleaks run in a release-audit workflow, and OSV lists no advisories for @minimax-ai/code or @minimax-ai/code-sdk. No security.txt (8). Total 57.

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

MiniMax Code 60

Self-hosted rule. No payment protocol (0). The CLI is free under MIT with nothing to buy (20). No card or MiniMax account is needed for the software, and BYOK works without a login (20). An agent can install it from npm and run mcode exec with a provider key and no sign-up (20). M Plan and MiniMax API usage are separate purchases. Total 60.

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

MiniMax Code 63

First-party code is MIT, with the bundled sandbox runtime under Apache-2.0 and the desktop app closed. The repository says the published npm package isn't shown to be built from this source, and npm is at 0.7.4 while the source is at 0.7.2 (22 of 30). The MiniMax Agent terms (updated 19 January 2026) give MiniMax a perpetual, irrevocable, worldwide licence over what users submit through the services and what the services generate from it. The privacy policy of the same date states no retention period and says nothing on training, and the telemetry doc says server-side retention isn't defined. BYOK runs that don't touch MiniMax's services aren't covered by either (8 of 30). No deprecation policy. Removed functions are listed in the changelog without dates ahead (6 of 20). Telemetry is off by default, with each field, each destination and two environment opt-outs documented (20). Total 56.

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

MiniMax Code 51

Local-package reading, for the CLI. An install script for macOS, Linux and WSL and one for Windows, and npm @minimax-ai/code with Node.js 22.19+, 24.2+, 25 or 26 stated. The installer doesn't support Alpine or musl (20). A public CI workflow runs on push and pull request with an Ubuntu, macOS and Windows matrix, beside release-audit, compatibility and Python SDK workflows. Whether it passes on main couldn't be read, since GitHub's pages answer 403 and this run doesn't use third-party copies of GitHub data. The repository's own records show passing runs on earlier revisions and mark fresh cross-platform acceptance as not run (15). Open issue counts and replies couldn't be read. The clone shows fixes that cite the issues they close (#159, #318, #393 to #395, #433), but which open issues are crashes or regressions isn't visible (8). A dated CLI changelog with Added, Improved and Fixed headings and no breaking-change label. Its latest entry is 0.7.0 (26 October) while npm's latest is 0.7.4 (30 October) (8). 0.7.x and called a source preview (0). Total 51.

OpenAI Agents API 60

Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.

MiniMax Code 79

0.7.4 on npm on 30 October 2026 (30). Every npm release from 0.1.0 on 14 August falls in the last 90 days, 62 of them by 15 October per the 19 October check (20). The clone has 167 commits since 3 August and 32 since 2 October, with fixes that cite issues, but pull requests are taken only from collaborators, and issue counts and reply times couldn't be read (11). An official TypeScript SDK, @minimax-ai/code-sdk 0.1.0, published on 29 October, and a Python SDK in the repository with no published release found. ACP ships inside the CLI (10). CI pins its GitHub Actions by commit, and the root package pins overrides for vulnerable dependencies (8). Total 79.

OpenAI Agents API 87

Closed API. Last dated change 16 October 2026, Ultrafast mode and document skills (30). Four dated changelog entries in the 57 days since release, 10 September, 29 September, 9 October and 16 October (20). Changelog and help centre, as the openai-api listing reads them (12 of 15). Official SDKs carry beta.agents (15). SDK CI, per the openai-api listing (10). 30 + 20 + 12 + 15 + 10 = 87.

MiniMax Code 81

Harness reading. mcode exec returns a versioned ExecResult JSON document (schemaVersion 1) or versioned stream-json events, takes --output-schema for the final answer, and mcode acp speaks the Agent Client Protocol. No OpenAPI, since there's no server API (20). llms.txt indexes the docs, and each page is served as Markdown (10). The security page says when to use each permission policy and to keep full and off to isolated workspaces, and the automation page gives a CI baseline (16). An options table with defaults and enums for permission, output and prompt modes (12). Examples for each mode, a nine-row exit-code table, five result statuses and a named error for invalid structured output (13). A dated CLI changelog in the docs, whose latest entry (0.7.0, 26 October) trails npm's 0.7.4 (10). Total 81.

OpenAI Agents API 88

The reference is linked from the overview and the SDKs carry beta.agents types; we didn't confirm /agents/sessions in OpenAI's public OpenAPI file, so 15 of 25. llms.txt with every Agents API page and Markdown twins (10). The overview, architecture page and the agents guide that compares the Agents API, Agents SDK and Responses API say when to use it (20). Typed configuration with enumerated container sizes, network modes and environment types (13 of 15). Examples in six languages and an errors page with codes per HTTP status, turn and session (15). Dated changelog entries and a versioned beta header (15). 15 + 10 + 20 + 13 + 15 + 15 = 88.