Rovo Dev CLI vs Sculptor

Rovo Dev CLI 15

Harness reading of the published rubric, scored on the Rovo Dev subscription the CLI needs. No payment protocol (0). Rovo Dev Standard is $20 a developer a month with 2,000 credits and extra credits are $0.01, both public. The credit multiplier for each model is shown only inside the CLI, and a task is given only as a range (5 to 50 tasks per 2,000 credits), so a run's cost can't be worked out before signing up. Judgement call between the 10 for plan-only pricing and the full 20 (15). Rovo Dev Free gives 350 credits a month, but only on Jira Standard or Premium sites, which are paid plans, and the 30-day Standard trial excludes the CLI (0). An organisation admin activates Rovo Dev and the user creates an API token in a browser (0). 0+15+0+0 = 15.

Sculptor 60

Free self-hosted software with nothing to buy, so 0 for a protocol and 20 each for public pricing, a free tier and onboarding with no sign-up, 60.

Rovo Dev CLI 61

Atlassian's AtlasCode extension, which downloads the same Rovo Dev binary for the IDE, pinned build 202610.16.1b1 in its pre-release of 16 October 2026, and the Atlassian CLI repository served 1.3.39-stable on 23 September 2026. We didn't run the CLI to read the version it installs. Judgement call (30). AtlasCode pinned eight Rovo Dev builds between 23 July and 16 October 2026 (20). No public changelog for the builds. Support is through Atlassian Support and the community, where the Rovo Dev board was last active on 16 January 2026 (5). No SDK and no registry entry. The server-mode API is kept current for the IDE extension (3). The Homebrew formula carries checksums and the Linux repositories are signed. There's no public CI (3). 30+20+5+3+3 = 61.

Sculptor 75

Commits on 6 November 2026 and frequent tagged versions (30). More than three releases in 90 days (20). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent; the README says Imbue can't take many outside contributions yet (0). Current official downloads (15). CI on pull requests (10). 30 + 20 + 0 + 15 + 10 = 75.

Rovo Dev CLI 48

Harness reading of the framework checklist, as for the other harnesses. 30 for credentials and what leaves the machine, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The CLI processes data on the device and sends prompts to Atlassian's models, whose providers don't retain or train on them, per the Rovo privacy page and the AI Terms. The scoped token the docs create carries about 50 scopes including write, delete and admin:repository:bitbucket, the pipelines guide asks for an unscoped token, and no telemetry description for the CLI was found (12). Writes and shell commands ask by default, reads are allowed, bash rules are regex, compound commands are split and file access stays in the workspace. There is no sandbox for customers (runInSandbox is macOS only and for internal users), --yolo skips file and shell prompts, and project-level skills in a cloned repository can list pre-approved tools. We found no workspace trust step (10). MCP server instructions go into the system prompt by default, with a per-server enable_instructions switch, and the MCP page says data isn't sent to third-party tools without the user's approval (7). Administrators can turn Rovo Dev on and off per organisation and site and see credit use. Logs stay local in ~/.rovodev/logs, and no audit log of CLI actions was found (5). security.txt is valid (Expires 2027-02-04), Atlassian runs a public Bugcrowd bug bounty and publishes its fix objectives. The rollout page says Rovo Dev hasn't been externally audited for ISO 27001 or SOC 2, and we didn't check whether the bounty scope names Rovo Dev (14). 12+10+7+5+14 = 48.

Sculptor 57

Harness reading. Product analytics, error reporting and session recording default to off in the user config, and the app asks for a telemetry level and privacy consent at first run; PostHog runs on the front end only for now (25 of 30). Each workspace is an isolated copy of the code (14 of 20). No prompt-injection guidance (5). No audit log (5). SECURITY.md (8). 25 + 14 + 5 + 5 + 8 = 57.

Rovo Dev CLI 35

Local-package reading, the same as the other closed-source harnesses. Rovo Dev ships inside the Atlassian CLI, which installs from a Homebrew tap with SHA-256 checksums, signed apt and yum repositories and curl downloads for macOS, Linux and Windows on amd64 and arm64, and Rovo Dev downloads itself on first use (20). No public CI or test suite, since the source isn't published (0). No public issue tracker. The Rovo Dev community board was last active on 16 January 2026, and bugs otherwise go to /feedback and Atlassian Support, so open crash reports can't be counted (8). Rovo Dev builds moved from 0.13.x to date-based versions such as 202604.30.2 and 202610.16.1b1, per AtlasCode's changelog and manifest, and have no public changelog, and the Atlassian CLI changelog stops at v1.3.15 while its repository serves 1.3.39 (2). Rovo Dev has been rolling out as a product since October 2025, but the version number carries no stability signal and Atlassian has announced that the standalone product will reach end of life. Judgement call (5). The CLI runs against Atlassian's hosted service, and the Rovo status page has no Rovo Dev component. 20+0+8+2+5 = 35.

Sculptor 43

Local software. Desktop downloads for Mac (Apple Silicon), Linux and Linux ARM64 (20). checks.yml and a PR gate run on the repository; pass state not read (15). GitHub issues and pull requests weren't read (GitHub's pages refuse these sessions), so that line is scored absent (0). sculptor-v tags up to v0.49.0, no changelog file (8). 0.x and labelled a research preview (0). 20 + 15 + 0 + 8 + 0 = 43.

Rovo Dev CLI 63

Proprietary, with clear terms. The Atlassian Customer Agreement (effective 1 October 2026) and the AI Terms (effective 17 August 2026), which say Input and Output are Customer Data and that subcontractors may not train on them (15). The Rovo privacy page keeps Chat and agent inputs and outputs for 30 days and says Rovo has SOC 2, ISO 27001 and data residency, while the Rovo Dev rollout page (modified 27 August 2026) says Rovo Dev has none of the three. We found no retention period for Rovo Dev sessions sent to Atlassian (12). The licensing FAQ promises at least 60 days' notice before Rovo Dev's end of life and dates the Code Reviewer move to 3 December 2026, but gives no date for the CLI's move to the Rovo CLI. Each Atlassian CLI version is supported for six months (14). No telemetry description or opt-out for the CLI was found. AtlasCode's changelog documents Rovo Dev telemetry events in the IDE, which this listing doesn't cover (0). 15+12+14+0 = 41.

Sculptor 57

MIT (30). Consent-based telemetry documented in the repository (18 of 30). The README warns of drastic changes during the research preview, with no deprecation policy (5). Opt-in telemetry (20). 30 + 18 + 5 + 20 = 73.