# SWE-2 Flash vs xAI API (Grok) (slim)

> xAI scores 71.7 (BB) to SWE-2 Flash's 36.4 (F) for llm inference. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/swe-2-flash-vs-xai-api.md (~6,550 tokens) · this version ~3,230 tokens · JSON https://www.anchorterminal.com/compare/swe-2-flash-vs-xai-api.json · canonical https://www.anchorterminal.com/compare/swe-2-flash-vs-xai-api
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

xAI API (Grok) scores 71.7 (BB) on agent readiness against SWE-2 Flash's 36.4 (F), and leads in 5 of 7 scored categories. Both do llm inference.

- SWE-2 Flash: F 36.4, rank #1388 of 1510 · https://www.anchorterminal.com/tools/swe-2-flash.min.md
- xAI API (Grok): BB 71.7, rank #152 of 1510 · https://www.anchorterminal.com/tools/xai-api.min.md
- SWE-2 Flash, good for People already using Devin Desktop or Devin CLI who want a cheaper, faster model for routine coding work such as automations, reviews and small changes, while it is free in November 2026.
- xAI API (Grok), good for Agents that want a capable model at a low per-token price with built-in web and X search, remote MCP and voice, and teams that need self-serve ZDR or US-only processing. Ahead on Reliability, 55 against 50; Schema & documentation, 88 against 29; Agent ergonomics, 90 against 10; Security & auth, 97 against 53; Maintenance & community, 77 against 53. Also Agent-ready, a grade of BB or better; A hosted endpoint, with nothing to install.

| Category | SWE-2 Flash | xAI API (Grok) |
| --- | --- | --- |
| Reliability (16%) | 50 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 29 | 88 |
| Agent ergonomics (13%) | 10 | 90 |
| Security & auth (14%) | 53 | 97 |
| Payments & pricing (10%) | 20 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 53 | 77 |
| Transparency & trust (7%) | 64 | 63 |

| Fact (where they differ) | SWE-2 Flash | xAI API (Grok) |
| --- | --- | --- |
| Vendor | Cognition AI, Inc. | SpaceXSI (xAI) |
| Hosted endpoint | no (local only) | `https://api.x.ai/v1` |
| Transports |  | HTTP |
| Auth | OAuth or key | API key |
| Pricing | Freemium | Pay per use |
| Licence | Proprietary model, used through Devin Desktop and Devin CLI under Cognition's Platform Terms of Service. The weights are not public; Cognition says it is building a programme to share them with industry partners and researchers | Proprietary service under xAI's enterprise terms of service. The Python SDK is Apache-2.0 |
| Last release | 2026-11-04 | 2026-11-02 |
| Terms last updated | 2026-06-30 | 2026-10-27 |
| Privacy policy last updated | 2026-03-09 | 2026-10-27 |
| Customer content may train models | yes, with an opt-out | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Popularity | none | 597 stars, 912k PyPI/wk |

Why the edge:
- Agent ergonomics, xAI API (Grok) +80: SWE-2 Flash 10 (Model reading (tool use, structured output, caching, context, batch, SDKs). Tool use is Devin's harness, not something a caller configures; no context length, output limit or cache price is published for SWE-2 Flash (5 of 25). No documented output-size or reasoning controls for this model; SWE-2's effort levels aren't stated for Flash (0 of 20). No model-level error documentation (0 of 20). No idempotency or retry guidance (0 of 20). One flag or picker selects it and `devin -p` runs a single turn and prints to stdout, but there is no SDK or direct endpoint (5 of 15). 5 + 0 + 0 + 0 + 5 = 10.); xAI API (Grok) 90 (Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and `tool_choice` of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, `xai-sdk` for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).)
- Schema & documentation, xAI API (Grok) +59: SWE-2 Flash 29 (Model reading. No model API, so no OpenAPI entry; the Devin v3 OpenAPI file lists SWE-2 agents only, and no model card was found (0). docs.devin.ai serves llms.txt and Markdown copies of every page (10). The launch post says what it is for (automations, code review, feature development, documentation) and the CLI docs say when to pick a SWE model, but the models pages don't list SWE-2 Flash yet (6 of 20). No documented model ID, reasoning settings, context or output limits to type (0 of 15). The CLI pages show `--model` and `/model` examples, with no model-specific errors (3 of 15). Named, dated model versions on Cognition's blog and public release notes, but no release note for SWE-2 Flash yet; the newest is 2 November (10 of 15). 0 + 10 + 6 + 0 + 3 + 10 = 29.); xAI API (Grok) 88 (OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with `strict` implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).)
- Security & auth, xAI API (Grok) +44: SWE-2 Flash 53 (Read as a hosted model reached through Devin's local clients. The CLI signs in through a browser, or the enterprise identity provider, and stores an API token in credentials.toml that by default is persistent and does not expire and carries the user's access, with no scopes found for it (10 of 30). Devin CLI documents an OS-level sandbox with network filtering, hooks that can block tool calls, and enterprise model allowlists and team settings (14 of 20). Guardrails against prompt injection are Enterprise only and cover user messages, as on the devin listing (8 of 15). Enterprise analytics count tool calls and consumption by model and user; no per-user audit log for the CLI was found (8 of 15). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address, no bug bounty and no security.txt, per the devin listing (13 of 20). Training: self-serve customer data may train Cognition's models by default, with an opt-out on paid plans that also turns on zero data retention at model providers. Cognition withheld the weights over cyber misuse, which is recorded as a fact, not scored. 10 + 14 + 8 + 8 + 13 = 53.); xAI API (Grok) 97 (Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an `x-zero-data-retention` header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support `require_approval`, which the model checklist doesn't score but reviewers should see. New in October, a `guidelines` array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.)
- Maintenance & community, xAI API (Grok) +24: SWE-2 Flash 53 (Model reading. Released 4 November 2026 (30). Churn and notice in place of release counts: SWE-1.6, SWE-1.7, SWE-1.7 Lightning, SWE-2 (10 September) and now SWE-2 Flash in a few months, with no model deprecation notice period found and short names that move to the newest model (10 of 20). Public release notes and a support address, no public tracker (10 of 25). No official SDK for the model (0 of 15). The docs are kept current but don't yet cover this model (3 of 10). 30 + 10 + 10 + 0 + 3 = 53.); xAI API (Grok) 77 (Model reading. grok-imagine-image-quality and grok-imagine-image-pro retired on 2 November 2026 as announced in September, Grok Voice 3.0 and custom moderation controls in October, Grok 4.7 on 21 September (30). No minimum notice period found. Retirements come as dated migration guides, retired slugs redirect to a replacement rather than failing, billed at the replacement's price, and grok-voice-2.0 was deprecated in October with no end date (4 of 12). Shutdowns in the last 90 days with dates given in advance, `grok-voice-transcribe-1.0` on 2 October and `grok-imagine-image-quality` on 2 November (8 of 8). Release notes several times a month but dated only by month, support by email and a Discord #help channel, not tested. On xai-sdk-python a collaborator commented on 2 of the 16 most recent threads with replies, and most outside pull requests since 23 October are open without a maintainer reply (10 of 15, down from 12). The repository has CI, release and version-bump workflows (5 of 10). One current first-party SDK, `xai-sdk` 1.21.0 tagged on 23 October, Python only (10 of 15). Supported runtimes stated, Python 3.10 or later (10).)
- Reliability, xAI API (Grok) +5: SWE-2 Flash 50 (Model reading, for the surface it runs on, Devin Desktop and Devin CLI. Status page at www.devinstatus.com (Atlassian Statuspage) with Desktop Agent and Desktop Tab components besides the cloud ones, read on 4 November 2026 (20). The history feed for the 90 days from 6 August lists 'Devin unavailable' for 20 minutes on 13 August with no component named, read as across the board and a major as on the devin listing; Devin Cloud unavailable on 13 August and the web app down on 24 September name cloud surfaces this model doesn't use; the rest are degraded-performance incidents (new sessions on 3 September, 'multiple services' on 17 September, Ask Devin on 26 October, automation triggers on 4 November) and session queuing on 10 and 11 August, read as minor and a scheduled Devin Desktop extension marketplace upgrade on 7 August, read as maintenance. One major (10). No rate limit figures for the model or the CLI; usage is a daily and weekly quota with no numbers (0). No 429, backoff or retry guidance for this surface (0). Cognition publishes an SLA (25 February 2026) with uptime and response times that applies when included in an order form, read as a contractual SLA on Enterprise, as on other listings (10). The launch post makes it available today with no preview or beta label (10). 20 + 10 + 0 + 0 + 10 + 10 = 50.); xAI API (Grok) 55 (Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).)