# OpenRouter vs SWE-2 Flash (slim)

> OpenRouter scores 66.6 (B) to SWE-2 Flash's 36.4 (F) for llm inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/openrouter-vs-swe-2-flash.md (~5,850 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/openrouter-vs-swe-2-flash.json · canonical https://www.anchorterminal.com/compare/openrouter-vs-swe-2-flash
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenRouter scores 66.6 (B) on agent readiness against SWE-2 Flash's 36.4 (F), and leads in every scored category. Both do llm inference.

- OpenRouter: B 66.6, rank #331 of 1350 · https://www.anchorterminal.com/tools/openrouter.min.md
- SWE-2 Flash: F 36.4, rank #1243 of 1350 · https://www.anchorterminal.com/tools/swe-2-flash.min.md
- OpenRouter, good for Agents that need many models behind one key, provider failover and a hard price ceiling per request. Ahead on Reliability, 55 against 50; Schema & documentation, 90 against 29; Agent ergonomics, 85 against 10; Security & auth, 67 against 53; Payments & pricing, 40 against 20; Maintenance & community, 82 against 53; Transparency & trust, 72 against 64. Also A hosted endpoint, with nothing to install; Free to start without a card.
- SWE-2 Flash, good for People already using Devin Desktop or Devin CLI who want a cheaper, faster model for routine coding work such as automations, reviews and small changes, while it is free in November 2026.

| Category | OpenRouter | SWE-2 Flash |
| --- | --- | --- |
| Reliability (16%) | 55 | 50 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 90 | 29 |
| Agent ergonomics (13%) | 85 | 10 |
| Security & auth (14%) | 67 | 53 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 82 | 53 |
| Transparency & trust (7%) | 72 | 64 |

| Fact (where they differ) | OpenRouter | SWE-2 Flash |
| --- | --- | --- |
| Kind | Model router | Model API |
| Vendor | OpenRouter | Cognition AI, Inc. |
| Hosted endpoint | `https://openrouter.ai/api/v1` | no (local only) |
| Transports | HTTP |  |
| Auth | API key | OAuth or key |
| Pricing | Pay per use | Freemium |
| Licence | Apache-2.0 (SDKs) | Proprietary model, used through Devin Desktop and Devin CLI under Cognition's Platform Terms of Service. The weights are not public; Cognition says it is building a programme to share them with industry partners and researchers |
| Last release | 2026-10-31 | 2026-11-04 |
| Terms last updated | 2026-08-31 | 2026-06-30 |
| Privacy policy last updated | 2026-08-31 | 2026-03-09 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 226 stars | none |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Agent ergonomics, OpenRouter +75: OpenRouter 85 (Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).); SWE-2 Flash 10 (Model reading (tool use, structured output, caching, context, batch, SDKs). Tool use is Devin's harness, not something a caller configures; no context length, output limit or cache price is published for SWE-2 Flash (5 of 25). No documented output-size or reasoning controls for this model; SWE-2's effort levels aren't stated for Flash (0 of 20). No model-level error documentation (0 of 20). No idempotency or retry guidance (0 of 20). One flag or picker selects it and `devin -p` runs a single turn and prints to stdout, but there is no SDK or direct endpoint (5 of 15). 5 + 0 + 0 + 0 + 5 = 10.)
- Schema & documentation, OpenRouter +61: OpenRouter 90 (Public OpenAPI document at openrouter.ai/docs/openapi/openapi.yaml (25). llms.txt with Markdown twins (10). Reference not read in full (15 of 20). Structured outputs documented, enforcement depends on the upstream model (10 of 15). Errors and debugging page and examples throughout (15). An API changelog generated from OpenAPI diffs on every release, with a human-reviewed Breaking section and migration notes, dated entries to 29 October 2026, and an API versioning page (15).); SWE-2 Flash 29 (Model reading. No model API, so no OpenAPI entry; the Devin v3 OpenAPI file lists SWE-2 agents only, and no model card was found (0). docs.devin.ai serves llms.txt and Markdown copies of every page (10). The launch post says what it is for (automations, code review, feature development, documentation) and the CLI docs say when to pick a SWE model, but the models pages don't list SWE-2 Flash yet (6 of 20). No documented model ID, reasoning settings, context or output limits to type (0 of 15). The CLI pages show `--model` and `/model` examples, with no model-specific errors (3 of 15). Named, dated model versions on Cognition's blog and public release notes, but no release note for SWE-2 Flash yet; the newest is 2 November (10 of 15). 0 + 10 + 6 + 0 + 3 + 10 = 29.)
- Maintenance & community, OpenRouter +29: OpenRouter 82 (Model reading. The TypeScript and Python SDKs were tagged on 31 October 2026, v1.5.33 and v1.3.106, and the API changelog's newest entry is 29 October (30). The versioning page says breaking changes are reviewed by a person and published in the changelog with migration notes, and that removing a deprecated part of the API follows that process, but it states no notice period. The 25 July Responses GA entry still promises a sunset date before the beta aliases go (6 of 12). Several removals of OpenRouter's own surface in the 90 days from 3 August, each published the day it shipped, `sleep_after_seconds` and the `ncompass` provider on 8 September, the `/interns` endpoints on 23 October, and the Python SDK's `end_users` namespace in 1.3.70 on 21 October (4 of 8). Dated changelog for every release that changes the spec, support not checked (12 of 15). SDK issue replies not sampled (5 of 10). Official SDKs in TypeScript and Python (and Go, not re-read on 1 November), generated from the OpenAPI document with Speakeasy, 242 and 279 tags since 3 August (15). Each SDK repository runs PR validation and publish workflows, per the 2 October check (10).); SWE-2 Flash 53 (Model reading. Released 4 November 2026 (30). Churn and notice in place of release counts: SWE-1.6, SWE-1.7, SWE-1.7 Lightning, SWE-2 (10 September) and now SWE-2 Flash in a few months, with no model deprecation notice period found and short names that move to the newest model (10 of 20). Public release notes and a support address, no public tracker (10 of 25). No official SDK for the model (0 of 15). The docs are kept current but don't yet cover this model (3 of 10). 30 + 10 + 10 + 0 + 3 = 53.)
- Payments & pricing, OpenRouter +20: OpenRouter 40 (No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.); SWE-2 Flash 20 (Published rubric. No payment protocol (0). Plan prices are public, but no per-token price for SWE-2 Flash is on a readable page; the docs' cost table loads in the browser and the post gives only 'one-fifth the price' of SWE-2 (10). Free through 30 November 2026 on Devin Desktop and CLI, but the docs say Free tier users only have SWE-1.6, so whether the Free plan reaches it, and without a card, isn't confirmed; the in-between value used on the devin listing (10). A person signs in through a browser (0). 0 + 10 + 10 + 0 = 20.)
- Security & auth, OpenRouter +14: OpenRouter 67 (Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets `data_collection` to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request `zdr` filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).); SWE-2 Flash 53 (Read as a hosted model reached through Devin's local clients. The CLI signs in through a browser, or the enterprise identity provider, and stores an API token in credentials.toml that by default is persistent and does not expire and carries the user's access, with no scopes found for it (10 of 30). Devin CLI documents an OS-level sandbox with network filtering, hooks that can block tool calls, and enterprise model allowlists and team settings (14 of 20). Guardrails against prompt injection are Enterprise only and cover user messages, as on the devin listing (8 of 15). Enterprise analytics count tool calls and consumption by model and user; no per-user audit log for the CLI was found (8 of 15). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address, no bug bounty and no security.txt, per the devin listing (13 of 20). Training: self-serve customer data may train Cognition's models by default, with an opt-out on paid plans that also turns on zero data retention at model providers. Cognition withheld the weights over cyber misuse, which is recorded as a fact, not scored. 10 + 14 + 8 + 8 + 13 = 53.)
- Transparency & trust, OpenRouter +8: OpenRouter 72 (Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).); SWE-2 Flash 64 (Editorial half. Closed model under Cognition's platform terms; the weights aren't public and the sharing programme isn't described yet (15). Terms, privacy policy, security page and DPA agree, with training on self-serve data by default and no retention periods, as read for the devin listing (18). The API versioning policy covers API endpoints, not models, and no model deprecation notice was found (5 of 20). Sub-processors listed with purpose and country, per the devin listing's 8 October check (18). 15 + 18 + 5 + 18 = 56.)