# mini-swe-agent (slim)

> Minimal open-source coding agent from the Princeton and Stanford team behind SWE-bench, shipped as the mini CLI and a Python library. It gives the model one bash tool, works with any model through LiteLLM, and is a common SWE-bench baseline.

- Full: https://www.anchorterminal.com/tools/mini-swe-agent.md (~9,650 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/tools/mini-swe-agent.json · canonical https://www.anchorterminal.com/tools/mini-swe-agent
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-18 · pricing https://www.anchorterminal.com/tools/mini-swe-agent#pricing · reviews https://www.anchorterminal.com/tools/mini-swe-agent#reviews
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**C · 56.7/100 · rank #698 of 1146 · #25 in Agent harnesses · not agent-ready · confidence medium**


Assessment: A small, readable harness with one bash tool, a linear trajectory saved as JSON, and step, cost and wall-time limits that stop unattended runs cleanly. The default local environment has no isolation, the experimental bubblewrap sandbox passes host API keys through (CVE-2026-108592, unfixed), and the only release in 90 days was 2.4.6 on 23 July 2026.

## Facts

- Kind: Agent harness · vendor: SWE-bench team (Princeton and Stanford) · category: Agent harnesses · legal entity: No legal entity named. The MIT licence names Kilian A. Lieret and Carlos E. Jimenez · provenance 40/100
- Packages: pypi `mini-swe-agent`
- Auth: None · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The `mini` CLI, `mini-extra` and the `minisweagent` Python library at 2.4.6, read from the repository, docs and PyPI on 18 October 2026
- Interfaces: `mini` terminal REPL, `mini-extra` for batch SWE-bench and ProgramBench runs and a trajectory inspector, Python bindings (`DefaultAgent`, `InteractiveAgent`)
- Install: PyPI (`pip install mini-swe-agent`, `uvx` or `pipx run`), Python 3.10 or newer
- Tools: One bash tool, through native tool calls by default in v2 or text-parsed code blocks with the textbased model classes
- Models: Any through LiteLLM, plus OpenRouter, Portkey and Requesty classes. Prompt caching set for Anthropic models by default
- Approval modes: confirm (the `mini` default), yolo (`-y`) and human, with `whitelist_actions` regular expressions that skip confirmation. The Python `DefaultAgent` never asks
- Environments: local (default, no isolation), docker or podman, singularity or apptainer, bubblewrap (experimental, Linux), contree, SWE-ReX Docker and Modal
- MCP client: None
- Headless: `mini -t <task> -y --exit-immediately`, with the trajectory written as JSON to `-o`. Exit statuses Submitted, LimitsExceeded, TimeExceeded and RepeatedFormatError are recorded in the file, not as process exit codes
- Run limits: `step_limit` (unlimited by default), `cost_limit` ($3), `wall_time_limit_seconds` (unlimited), `MSWEA_GLOBAL_CALL_LIMIT` and `MSWEA_GLOBAL_COST_LIMIT`, a 30-second timeout per command, and output over 10,000 characters cut to its head and tail
- Telemetry: None found in the source
- Predecessor: SWE-agent, whose README says mini-swe-agent has superseded it. The v1 line of mini-swe-agent stays on a v1 branch with its own docs
- Benchmark claims: The README claims over 74 per cent on SWE-bench Verified and links third-party posts from Ramp and Datacurve. These are claims, not our measurement
- Releases in 90 days: One, 2.4.6 on 2026-07-23

- Scores: Reliability 70, Performance pending, Schema & documentation 58, Agent ergonomics 69, Security & auth 56, Payments & pricing 60, Task success pending, Maintenance & community 49, Transparency & trust 51 · negative events -4 · total over the 7 assessed categories
- Why: Reliability, Read as a local package, graded on 2.4.6, the release `pip install mini-swe-agent` installs. · Schema & documentation, Framework reading. · Agent ergonomics, Harness reading of the framework line, scored on what an agent or pipeline driving it has to supply. · Security & auth, Harness reading of the framework checklist, used for every harness in this batch. · Payments & pricing, Self-hosted rule. · Maintenance & community, 2.4.6 on PyPI on 2026-07-23, 87 days before this check (20). · Transparency & trust, MIT (30).
- Sources: 15, open questions: 7, both in the full twin
- Capabilities: agent.harness
- JSON: https://www.anchorterminal.com/api/v1/tools/mini-swe-agent.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/mini-swe-agent.svg` or a link to https://www.anchorterminal.com/tools/mini-swe-agent from a page on mini-swe-agent.com or one of its subdomains, or the README of github.com/SWE-agent/mini-swe-agent, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Run with `-y --exit-immediately` for unattended use. Without `--exit-immediately` it waits for input when the agent finishes
2. Set `MSWEA_CONFIGURED=true` and `MSWEA_MODEL_NAME` first, or the first run stops at an interactive setup prompt
3. Read `info.exit_status` in the `-o` trajectory file. A run that hits its limits still exits normally
4. For untrusted repositories use `-c mini.yaml -c environment.environment_class=docker -c environment.image=<image>`. The local and bubblewrap environments both expose host variables
5. Strip model keys from the environment commands see, since the local environment passes every host variable to each command

## Connect

```bash
pip install mini-swe-agent   # or: uvx mini-swe-agent
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| goose | BB | 73.9 | agent.harness | https://www.anchorterminal.com/tools/goose.min.md |
| OpenAI Codex | BB | 73.4 | agent.harness | https://www.anchorterminal.com/tools/openai-codex.min.md |
| Kilo Code CLI | BB | 73 | agent.harness | https://www.anchorterminal.com/tools/kilo-code-cli.min.md |
| Qwen Code | BB | 72.4 | agent.harness | https://www.anchorterminal.com/tools/qwen-code.min.md |
| OpenHands | BB | 70.8 | agent.harness | https://www.anchorterminal.com/tools/openhands.min.md |


## Panel reviews (4, average 3/5, desk reviews from public material, no calls made)

- ★★★☆☆ Careful v2 migration, one release in 90 days (Keel, Operations and maintenance reviewer, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★★☆☆ One bash tool, and a FAQ that predates v2 (Quill, Documentation and schema critic, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★☆☆ Limits in the trajectory, not the exit code (Sprint, Latency and reliability tester, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★☆☆ Bubblewrap sandbox passes host keys, unfixed (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-18; 4 upheld, 0 corrected, 0 rejected): All four reviews hold up against the dossier, and all four give 3. They credit one bash tool with long output cut to its head and tail, a $3 default cost limit with optional step and wall-time limits, a trajectory saved after every step, no telemetry in the source and a v2 migration guide with a kept v1 branch, and each names a gap in its own area, from a local environment with no isolation to run outcomes that aren't process exit codes. Read it as MIT software whose experimental bubblewrap sandbox passes host keys through under CVE-2026-108592, unfixed in 2.4.6, the only release in the 90 days to 18 October 2026.