Muse Code vs Paseo

Muse Code 20

Harness reading of the published rubric. No payment protocol (0). Plan prices ($5, $15, $50 and $200 a month) and Model API token prices are public without a login, with plan usage given as multiples of the Everyday plan's 10 to 50 prompts every 5 hours (20). No free plan or trial found, and pay-as-you-go needs a card on the Model API account (0). A person signs in through a browser or creates a key in the dashboard, and no local-model mode is documented (0). 0 + 20 + 0 + 0 = 20.

Paseo 60

Free self-hosted software with nothing to buy, so 0 for a protocol and 20 each for public pricing, a free tier and onboarding with no sign-up, 60.

Muse Code 84

Framework reading. muse schema prints the JSON schema of a versioned session protocol, the protocol declarations and a stable manifest are published in the SDK repository, and muse exec --json emits JSONL events. No JSON Schema for settings.json was found (22 of 25). llms.txt at dev.meta.ai/llms.txt with a Markdown copy of each page (10). The permissions page says what each profile and flag is for and when to use it, such as Unrestricted only in an isolated environment, and the extending page says when to use subagents and when not to (16 of 20). Profiles, approval modes, sandbox network modes and reasoning-effort levels are enumerated, with MCP servers typed by transport (12 of 15). Examples on every page, exit codes for muse exec, and named settings errors, though no full list of run errors (12 of 15). A changelog for every version to 1.4.13, with no dates (12 of 15). 22 + 10 + 16 + 12 + 12 + 12 = 84.

Paseo 65

Harness reading. Public docs, a CLI and plugin examples in the repository (65).

Muse Code 56

Closed-source binary under the Meta Model API Terms of Service, with MIT SDKs (15). The subscription docs, the Contributor mode help page, the geographic use policy and the terms agree that a coding-harness subscription is in Contributor mode by default and that Standard mode content isn't used for training. Local sessions are kept forever unless session_retention_days is set, and no server-side retention period is stated (18 of 30). No deprecation policy. Deprecated aliases are named in undated release notes (5 of 20). Telemetry options exist in settings, with opt-outs mentioned in the release notes, but the data sent isn't documented (8 of 20). 15 + 18 + 5 + 8 = 46.

Paseo 68

Apache 2.0 for everything but third-party components (30). No telemetry and agents run on your machine (22 of 30). CHANGELOG.md, no deprecation policy (10). States no telemetry (20). 30 + 22 + 10 + 20 = 82.

Muse Code 79

Framework reading, adapted to a harness driven by a pipeline. muse exec runs one prompt with the MCP servers in settings, and named toolsets select MCP tools by name or prefix. We found no deferred tool loading in Muse Code's own docs (18 of 25). --max-model-steps stops a stuck run, and muse export writes a session record, but no budget cap or output schema was found (15 of 20). Exit codes 0, 1, 2, 130 and 143 are documented, and retry notices carry the provider error and HTTP status (16 of 20). --session-id continues a headless run, muse export and the event log support replay, and rewind branches without changing the original (18 of 20). TypeScript and Python SDKs. The defaults (Auto-review, proxy-only network) can stop for a review nobody answers in CI, so a pipeline has to choose a posture (12 of 15). 18 + 15 + 16 + 18 + 12 = 79.

Paseo 70

Harness reading. A self-hosted daemon that agents can use to create worktrees, launch other agents and talk to them, scriptable from the CLI (70).

Muse Code 67

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. A browser session or a Model API key, cleared by muse logout. Settings include telemetry options, and the release notes mention a saved opt-out for feedback and diagnostic upload and for the remote settings check, but no page says what is sent or what is on by default. Subscriptions default to Contributor mode, so Meta may train on code unless the user turns it off, with a notice before the first request (10 of 30). Ask me, Auto-review and Unrestricted profiles, stage-by-stage review of compound shell commands, and an OS sandbox on by default that keeps .git, .muse and .agents read-only and refuses to run when it can't confirm containment. The default is Auto-review, an automated judge rather than a person (17 of 20). Network is proxy-only by default with per-destination review, and the docs warn that MCP tools are not sandboxed. The 1.4.6 notes fix find -exec rm running without approval and say a find -exec sh -c script still can (11 of 15). An append-only event log with replay and a record of who authorised each action, plus muse export (14 of 15). Meta's bug bounty, named in the SDK's SECURITY.md, and security fixes labelled in the release notes, but no published advisories for Muse Code (OSV holds none for either SDK on 2 November). The 12 October reading of www.facebook.com's security.txt is struck (that host's robots.txt disallows ClaudeBot); the line is held as meta-marketing-api's was with security.txt unread (15 of 20). 10 + 17 + 11 + 14 + 15 = 67. Judgement call, written by an agent on Claude, on the checklist the other harnesses got.

Paseo 58

Harness reading. The README says no telemetry, tracking or forced log-ins (30 of 30). Worktree per agent, on your own machine (10 of 20). No prompt-injection guidance (5). No audit log (5). SECURITY.md (8). 30 + 10 + 5 + 5 + 8 = 58.

Muse Code 45

Local-package reading. Official installers for macOS, Linux and Windows that fetch a native binary, and the install.sh script checks the launcher's SHA-256 against the advertised sum (20). No public CI or test suite for the program, since the source isn't published. The SDK repository's workflows only publish to npm, PyPI and crates.io, by hand (0). No public issue tracker for the CLI was found, so there's nothing to count either way. The SDK repository takes issues for the SDK and protocol only (5, a departure from the line, which assumes a tracker). Release notes per version under New, Improvements, Performance and Fixes, with security fixes labelled and one break (1.4.8's profile refusal) announced in the 1.4.6 notes, but no dates and no breaking-change heading (5). 1.4.13 (15). Same reading as Claude Code, which is also closed source. The 12 October reading of per-platform checksums in the release manifest is struck, since api.meta.ai's robots.txt now disallows every path. 20 + 0 + 5 + 5 + 15 = 45.

Paseo 50

Local software. Desktop builds, an Android APK, a Docker image and a Nix package (20). ci.yml on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). CHANGELOG.md (15). Version 0.15.3 (0). 20 + 15 + 0 + 15 + 0 = 50.