Cursor vs Copilot vs Devin vs Qoder vs Qwen3-Coder

Five tools with one job description: read code you did not write, change it and hand you something to review. Cursor and GitHub Copilot approach it from the editor. Devin approaches it from the ticket queue. Qoder, Alibaba's agentic IDE, approaches it from documentation. Qwen3-Coder is not a product at all, it is weights you download and a CLI you point at them.

I have written before about what agentic coding actually costs once it reaches production, and nothing since has moved the conclusion: generation stopped being the constraint. Faros AI's 2026 telemetry, drawn from roughly 22,000 developers, put task throughput per developer up 33.7 percent while median time in review rose 441.5 percent and pull requests merged with no review at all rose 31.3 percent. Every tool below improves the first number. Two of them do something serious about the second.

So this is not a comparison of who writes better code. On a well-specified task with a test suite, all five produce something that compiles and mostly works. The comparison worth having is what each one does to a repository nobody on your team fully understands, and what it leaves on a reviewer's desk on a Friday afternoon.

The large unfamiliar repository

Cursor's documented answer is not embeddings, which surprises people who last read about it in 2024. The codebase indexing page now describes Instant Grep, a custom exact-match search engine Cursor claims outperforms ripgrep on large codebases, running automatically with no configuration, alongside an Explore subagent that searches in its own context window with a faster model and returns summarised findings rather than raw file contents. File paths are encrypted before reaching Cursor's servers and code content is never stored in plaintext. On a two-million-line monorepo this behaves well, because there is no index to build or keep fresh. It behaves badly when what you need is conceptual rather than lexical, because grep cannot find a pattern nobody bothered to name.

Qoder takes the opposite position and it is the most interesting design in this group. Repo Wiki reads the repository once and writes structured documentation covering function signatures, class definitions, API endpoints and overall project structure, then tracks drift and offers to regenerate affected sections when the code moves underneath it. Sections you edit by hand are marked and protected from the next automatic update. The documented ceiling is 10,000 files per project, and the repository has to be git with at least one commit. For an inherited service whose last competent maintainer left in 2023, that artefact is worth more than any code the agent writes afterwards. This is the part of Qoder that English-language coverage consistently misses, because it reads the marketing page rather than the docs.

GitHub's coding agent explores inside an ephemeral environment powered by GitHub Actions, and the scope is hard-edged: one repository per task, with no context from a second repository in the same run. That is fine for a service that owns its own boundaries and useless for the change that spans a service and its generated client library.

Devin's metering is its quiet advantage here. Repository setup, waiting on tests and waiting on you are not charged, and a session sleeps after roughly 0.1 ACUs of inactivity at zero usage, so the reconnaissance phase is close to free. Cognition's own guidance still tells you to split a large project into focused sessions rather than pointing one long-running agent at the whole thing, which is a fair admission.

Qwen3-Coder has no repository story, and pretending otherwise would be dishonest. Qwen3-Coder-Next is 80B total parameters with 3B active and a native context of 262,144 tokens. Whatever harness you wrap around it decides what the model sees. That is a burden if you want something that works on day one, and an advantage if you already have retrieval you trust.

Review burden is the actual cost

Cursor is the only tool here that ships a review artefact designed to reduce human load rather than add to it. Bugbot analyses pull request diffs, leaves inline comments with fix suggestions, reads existing comments to avoid repeating feedback and posts a CI check status of success, neutral or failure. That check status matters more than the comments: it gives you a mechanical gate to put in front of a human. The documented limits are worth knowing before you build policy on it. Individual rules truncate at 30,000 characters, combined rules at 100,000 for a single review, review triggers are rate-limited to 30 requests a minute and autofix stops after three attempts per pull request.

Copilot's coding agent produces exactly one pull request on one branch per run, with a 59-minute hard execution limit. That constraint is genuinely helpful. An agent that cannot run for six hours cannot produce a 3,000-line diff, and LinearB's analysis of 8.1 million pull requests already put AI-assisted PRs at 400-plus lines at the 75th percentile against 157 for unassisted work, against a measured human review ceiling of around 400 lines an hour. Copilot code review is a separate billable action rather than something bundled into the agent run, and on legacy request-based plans it carries a model multiplier of 13.

Devin points you at tasks of roughly three hours or less with test suites or CI checks as the success criterion. Read that as the vendor telling you where its output is reviewable. Qoder's Experts Mode splits a task across planning, implementation, testing and review agents, which produces a tidier narrative but does not change the fact that a human still signs the merge. Qwen3-Coder produces nothing at all in this category, because whatever review you get is whatever you built.

None of this shifts the underlying arithmetic. Veracode's Spring 2026 GenAI Code Security update found a 55 percent security pass rate against better than 95 percent syntax correctness across 80 tasks. Generated code is nearly always well-formed and frequently unsafe. A CI check from Bugbot and a 59-minute cap are useful precisely because they are mechanical.

Model choice, and what lock-in really means

The word lock-in gets used loosely on this subject. There are three separate things worth distinguishing: which model runs your agent, whether you can switch it, and what you keep when you stop paying.

Copilot has the widest picker in the group, spanning OpenAI, Anthropic, Google, Microsoft's MAI models, xAI and Moonshot's Kimi. Its bring-your-own-key support reaches Azure, Anthropic, Gemini, OpenAI, OpenRouter, local Ollama endpoints and custom endpoints speaking the Chat Completions, Responses or Messages APIs. The limitation stated in the documentation is the one that matters: BYOK applies to chat and utility tasks, not standard code completions. Cursor draws the same line, supporting OpenAI, Anthropic, Google, Azure OpenAI and AWS Bedrock keys for chat models while tab completion stays on Cursor's own inference, and it notes that its zero data retention policy does not apply when you use your own key.

Qoder documents BYOK on the free tier and describes paid tiers in terms of premium models without naming a picker in the pricing documentation. Devin's public docs do not document model selection at all, so you take what Cognition runs. That is a defensible product decision, since Devin sells an outcome rather than a model, but it should be priced into the risk.

Qwen3-Coder is the only entry where the question dissolves. The weights are Apache 2.0, the Qwen Code CLI is Apache 2.0, and its README advertises switching between OpenAI, Anthropic, Gemini and Qwen APIs or a local Ollama or vLLM endpoint at runtime. Apache 2.0 is irrevocable for the version you have already downloaded, which is a stronger guarantee than any enterprise agreement in this comparison. Concede the trade honestly: you are giving up Bugbot, Repo Wiki, GitHub-native permissions and a support contract to get it.

The cost models are not comparable, and that is the finding

Everything below was checked on 1 September 2026 against vendor documentation.

Cursor: Pro $20 a month, Pro Plus $60, Ultra $200, Teams $40 per user. Third-party models are charged at API rates, with a $0.25 per million token Cursor Token Rate added on Teams and Enterprise. Cursor's own Composer 2.5 runs at $0.50 input and $2.50 output per million tokens, which is why Cursor keeps steering you toward it.

GitHub Copilot: Pro $10 with 1,500 AI credits, Pro Plus $39 with 7,000, Max $100 with 20,000, Business $19 per seat with 1,900 and Enterprise $39 per seat with 3,900. One AI credit equals $0.01. Billing moved from premium requests to token-based AI credits on 1 June 2026, and the coding agent consumes GitHub Actions minutes on top of credits, which is a line item teams routinely forget to model.

Devin: Free, Pro $20, Max $200 and Teams from $80, with on-demand credits funding work past the included quota, and enterprise billed in Agent Compute Units at an order-form rate. Usage tracks the number and complexity of actions taken rather than wall-clock time, sleeping costs nothing, and a Windows session consumes about 9 percent more than an equivalent Ubuntu one.

Qoder: $20 for 2,000 credits, $60 for 6,000, $200 for 20,000, with $20 credit packs adding 1,500 credits valid for one month. Repo Wiki generation and updates consume credits like anything else. When the allocation runs out the client falls back to basic models under a daily cap, which is a worse failure mode than a hard stop because it degrades quietly mid-task.

Qwen3-Coder: no licence cost and a real infrastructure cost. The model card's own deployment examples use four GPUs with tensor parallelism in BF16, and suggest tensor parallel size 2 for the full 256K context. Run the break-even honestly against a $19 seat before treating free weights as free.

Where each one stops being useful

Cursor stops when the work leaves the editor. Cloud agents exist, but the product's centre of gravity is a human sitting in a file, and BYOK not covering tab completion means you never fully detach from Cursor's inference even when you are paying another provider for everything else. If your engineers are not in an IDE all day, you are buying an editor to get an agent.

Copilot stops at its own ceilings, and they are printed on the tin: 59 minutes, one branch, one pull request, one repository. It is also incompatible with rulesets that restrict by author unless you configure a bypass, which is exactly the ruleset a regulated team is most likely to have. A change spanning three repositories is three runs and a coordination problem that belongs to you.

Devin stops where the success criterion stops being machine-checkable. The documentation's own framing, tasks of three hours or less with test suites or CI checks, is a precise description of the boundary. Give it a task whose correctness lives in a product manager's head and it returns something plausible and expensive.

Qoder stops above 10,000 files, and it stops when your credits do. The 10,000-file cap is generous for a service and inadequate for the kind of monolith that most needs documenting. There is also no self-hosted option documented, which rules it out for a lot of the work I see in Shenzhen where the code cannot leave the corporate network.

Qwen3-Coder stops at your operations budget and at its own mode: Qwen3-Coder-Next runs non-thinking only and emits no reasoning blocks. For agentic loops that is often fine and sometimes exactly wrong, and going past 256K context requires extrapolation rather than native support.

When none of these is the right answer

There is a case where the honest recommendation is to buy nothing. METR's 2025 randomised controlled trial put 16 experienced open-source developers on 246 real tasks in repositories they knew well and found them 19 percent slower when allowed AI tools, while they estimated afterwards that they had been 20 percent faster. METR frames that as a snapshot of early-2025 tooling in one setting rather than a general law, and the tooling has improved since. The narrow lesson holds anyway: an expert working in code they already hold in their head is the condition where an agent has least to add and the most opportunity to interrupt.

The second case is a team already at review saturation. If your pull requests are queuing and reviewers are skimming, adding any of these five makes the bottleneck worse in exchange for a throughput number that will look good in a quarterly deck and bad in an incident review. Fix the review capacity first, with static analysis and tests ahead of the human, then buy the agent.

The third case is genuinely novel design work. All five are excellent at code whose correctness a machine can check and mediocre at code whose correctness lives in judgement. That boundary has not moved in two years, and no pricing page on this list mentions it.

Questions

Sources

1. Cursor Pricing cursor.com
2. Cursor Docs, Models and Pricing cursor.com
3. Cursor Docs, Bring your own API key cursor.com
4. Cursor Docs, Codebase indexing and Instant Grep cursor.com
5. Cursor Docs, Bugbot cursor.com
6. GitHub Docs, Plans for GitHub Copilot docs.github.com
7. GitHub Docs, Models and pricing for GitHub Copilot docs.github.com
8. GitHub Docs, About Copilot coding agent docs.github.com
9. GitHub Docs, Bring your own key for GitHub Copilot docs.github.com
10. Devin Docs, Self-serve billing docs.devin.ai
11. Devin Docs, Usage metering docs.devin.ai
12. Devin Docs, When to use Devin docs.devin.ai
13. Qoder Docs, Pricing docs.qoder.com
14. Qoder Docs, Repo Wiki docs.qoder.com
15. Qwen3-Coder-Next model card, Hugging Face huggingface.co
16. Qwen Code CLI repository github.com
17. Field note: Reviewing AI-generated code, the review bottleneck francisokafor.com
18. Field note: Claude Code in production, what it earns and what it costs francisokafor.com