ST-Cute

The deciding trait is what it can read. Documents in the usual office formats are handled by built-in tools rather than by you pasting excerpts, which matters more than it sounds like in places where the specification lives in a spreadsheet and the acceptance criteria live in a slide deck. That is a lot of workplaces.

Around that it is a young project with a small following and no published install route. Pick it for the document handling. Pick something established if that is not your bottleneck.

The architecture puts an HTTP service between the user and an agent that runs commands and edits files. Nothing in the row states what interface it binds to, whether a credential is required, or what happens on a shared office network, and the mobile interface implies it is reachable from something other than localhost.

What it does right is the permission tiers. A read-only mode, a graded approval step and a path restriction are three different controls rather than one prompt pretending to be a security model.

1. Showing the actual exchange rather than a rendering of it is the single most useful diagnostic an agent can offer, because almost every strange behaviour in this category traces back to what the model was or was not given, and every other tool here asks you to infer that. 2. Child process visibility closes the other common gap, which is not knowing what is still running.

2. No evaluation of the loop itself is published, but transparency of this kind makes independent evaluation possible, which is worth more than a self-reported number.

The engineering ambition here exceeds the resources behind it, which is the most common way good projects die. A service and a separate front end is twice the maintenance of a command-line tool, and the star count says nobody has arrived to share it. There is no company, no revenue and nothing to sell.

Moat: none. Likely acquirer: none; the observability idea will be copied by someone with a team. Likely path: an impressive year followed by an unmaintained web dependency list. Position: pass, borrow the idea.

The permission design is better than most things I am shown, because restricting which directories an agent may touch is the control that actually limits damage. It governs one session, though, not an organisation, and every setting is per machine.

There is no identity integration, no directory sync and no way to export what happened for an auditor. The row lists no install command at all, so putting this on sixty machines is a packaging project, and it does not run unattended, so it never becomes a delivery stage. Not yet.

Three request formats against custom endpoints is more provider freedom than a list of vendor names, because it means anything speaking one of those shapes is reachable, including whatever gateway I put in front of it. Servers I run attach as tools, hooks let me interpose, and my existing instructions file is picked up without translation.

Permissive terms keep the fork alive. The gap is inference on my own hardware, which is not a listed destination, so the endpoint is always somewhere else.