Compare

Posture and primitives at-a-glance across every harness covered here. Use it to pick a starting tab, or to spot which harness exposes a surface yours does not.

Harness Surface Auth Sandbox MCP Marketplace Headline CVE License
Claude Code CLI Local only Opt-in
Seatbelt / bubblewrap
 Yes Skills CVE-2026-21852 Commercial
Codex CLI CLI OAuth / API key Default-on
Seatbelt / Landlock+seccomp
 Yes — CVE-2025-61260, CVE-2025-59532 Apache-2.0
Aider CLI Local only None
Container DIY
 No — — Apache-2.0
Cursor IDE Local + SSO Off
Workspace Trust disabled
 Yes Open VSX CVE-2025-54135 Commercial
Cline VS Code ext VS Code Secrets Off
DevContainer rec.
 Yes Marketplace CVE-2026-44211 Apache-2.0
Continue VS Code + JetBrains ext VS Code Secrets / Hub SSO Off
DevContainer rec.
 Yes
Agent mode only
 Continue Hub — Apache-2.0
GitHub Copilot IDE + web + Coding Agent GitHub SSO + SCIM Ephemeral Actions runner
Agent only
 Allowlist Marketplace + MCP CamoLeak CVSS 9.6 Commercial
Amazon Q IDE ext + q chat CLI IAM Identity Center
Builder ID = weak
 None
microVM DIY
 Per-tool VS Code Marketplace CVE-2025-8217 (wiper) Commercial
opencode TUI + HTTP Optional pwd
OPENCODE_SERVER_PASSWORD
 Off
Container rec.
 Yes Plugins CVE-2026-22812 MIT
Pi CLI / TUI Local only None
Container DIY
 No Extensions — MIT
Goose CLI + Desktop OS keyring None
Container DIY
 Yes (70+) Goose Hub — Apache-2.0
Roo Code VS Code ext VS Code Secrets Off
DevContainer rec.
 Yes Cline-class 10× GHSA 2025
Archived 2026-05-15
 Apache-2.0
Replit Agent Cloud web IDE SSO + SCIM (Enterprise) Cloud VM
Replit-managed
 Plan mode Replit-managed SaaStr DB wipe (Jul 2025) Commercial
Devin Cloud autonomous SAML / OIDC / SCIM microVM/session
SOC 2 Type II
 Skills + Knowledge Approved integrations ETR injection chain (2025) Commercial
Manus Cloud autonomous Google / Apple OAuth Cloud VM
deploy_expose_port exposed
 No allowlist Connectors VS Code Server kill-chain (Mar 2025) Commercial
OpenHands Web :3000 None
jwt_secret only
 Docker
E2B / Modal opt-in
 Yes Microagents CVE-2026-33718 MIT
OpenClaw Gateway :18789 Token / pwd / proxy Opt-in
Docker / SSH / OpenShell
 Yes ClawHub — Source-avail.
Hermes Agent CLI + Gateway + ACP Channel allowlist
Pairing codes
 Off (local)
Docker / E2B opt-in
 Yes Skills Hub CVE-2026-7396 MIT
NanoClaw Host + per-agent Docker Channel ID + role Docker
Apple/μ-VM opt-in
 Skill-only Skill branches CVE-2026-7875 MIT
n8n Web :5678 + webhooks User mgmt + 2FA/SSO Task runners opt-in
Distroless
 AI Agent node Community nodes CVE-2025-68613
CVSS 9.9
 Fair-code
Strong non-bypassable by default Mixed optional or shared-secret Weak no built-in protection / known CVE N/A or — not applicable
i

How to Read This Table

  • Surface — the primary attack-reachable interface. CLI/TUI implies local-only; "Gateway" / "Web UI" / "webhook" implies anything that touches the network.
  • Auth (default) — green where the harness ships with a non-bypassable identity check, amber where it's optional or shared-secret, red where there is no built-in auth on the network surface.
  • Sandbox (default) — green if container/VM isolation is the out-of-the-box runtime; amber if available but opt-in; red if the agent runs with full user privileges unless you wrap it yourself.
  • Plugin marketplace — every entry here is also a confirmed supply-chain attack vector. Treat marketplace installs the same way you treat npm install in production.
  • Notable CVE — links go to vendor advisories / vendor write-ups in each per-platform tab. Absence (—) means no public CVE at time of writing; not a clean bill of health.