Cline is a coding agent that started as a VS Code extension and now runs in four places from one engine: the VS Code extension, a JetBrains plugin, a CLI and a desktop app for macOS and Windows. It reads your project, edits files across it, runs terminal commands and watches the output, and in the editor shows every edit as a diff you approve. A Plan mode explores and proposes before an Act mode changes anything, and a .clinerules file carries a project's conventions.
Its draw is choice. Cline works with Anthropic, OpenAI, Google, OpenRouter, Bedrock, Vertex, Groq and local models through Ollama or LM Studio, and adds MCP servers, multi-agent teams, scheduled agents and connectors that let you talk to it from Slack or Telegram. The code is Apache-2.0 and run by Cline Bot Inc.; the JetBrains plugin is the one piece not open-sourced. With 330 contributors and releases most days, it is one of the busiest repositories on this list.
- Repository: github.com/cline/cline
- Licence: Apache-2.0 (Apache License 2.0)
- Language: TypeScript. Stars: 69.4K. Forks: 7,531. Last push: Sep 27, 2026.
- Scan: safe, Sep 27, 2026, commit 252082b
Who it is for
VS Code and JetBrains users who want an agent inside the editor with a model of their choosing, teams that want the same agent in CI through the headless CLI, and anyone who wants approval on each step by default.
Getting started
1. Install the CLI (the VS Code extension and JetBrains plugin are in their marketplaces; the desktop app is at cline.bot/desktop)
npm i -g cline2. Run a task headless in the current repository
cline "Run tests and fix any failures"3. Or build your own agent on the same engine
npm install @cline/sdkSafety scan
We cloned cline/cline at commit 252082b on Sep 27, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- Three secret candidates, all in tests: a placeholder private key in the CLI's CA certificate test and two fake xoxb- Slack tokens in the Slack connector's tests. No self-decoding code, no committed binaries. The one bare IP, 100.82.5.118, is a Tailscale-style address in the tests for the hub's invite links. The repository was scanned with Git LFS disabled; .gitattributes tracks only two demo GIFs through LFS, so nothing that runs was missed.
- The three pattern hits are tests too: Telegram API URLs in the Telegram connector's tests, and a PowerShell -EncodedCommand string in the shell parser's tests, which exist so Cline treats such commands with care.
- Install hooks are ordinary: husky's prepare, a prepack guard against publishing the CLI by hand, a UI build, and two Tauri build.rs files for the desktop apps. No postinstall fetches anything.
- Known advisories: 48, one critical, which is Vitest in the evals tooling. The high ones sit mostly in the docs site's build (14) and in the Tauri desktop apps' Cargo lockfiles, where quick-xml has two denial-of-service advisories; the desktop app ships from there, but it parses its own files.
- 18 workflows. Two use pull_request_target: one triggers JetBrains tests only for members or on a maintainer's comment and never checks out the pull request, the other only edits PR descriptions through the API and is pinned to a commit. 5 of 44 third-party actions pinned. Security policy, Dependabot and code of conduct present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 3 candidates found and read; see the notes above. |
| Suspicious code | 3 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 3 npm lifecycle scripts. 2 Cargo build scripts. 3 installer scripts |
| Committed binaries | None. |
| CI workflows | 18 workflows. 2 use pull_request_target, none check out the pull request head. 39 of 44 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, api.example, api.cline.bot, app.cline.bot. 3 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 48 advisories across 1,680 pinned packages: 1 critical, 25 high, 13 moderate, 1 low, 8 unrated. apps/examples/desktop-app/src-tauri/Cargo.lock: 519 packages, 13 advisories; apps/examples/menubar/src-tauri/Cargo.lock: 436 packages, 11 advisories; apps/vscode/standalone/runtime-files/package-lock.json: 84 packages, 2 advisories; docs/package-lock.json: 925 packages, 18 advisories; evals/analysis/package-lock.json: 160 packages, 13 advisories; evals/package-lock.json: 63 packages, 1 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file, contributing guide. Missing CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (3, redacted)
| Where | Rule | Match |
|---|---|---|
| apps/cli/src/bin/ca-certs.test.ts:105 | private-key | -----B…--- (27 chars) |
| apps/cli/src/connectors/adapters/slack.test.ts:323 | slack-token | xoxb-t…ken (15 chars) |
| apps/cli/src/connectors/adapters/slack.test.ts:338 | slack-token | xoxb-t…ken (15 chars) |
Pattern hits (3)
| Where | Rule | Match |
|---|---|---|
| apps/cli/src/connectors/adapters/telegram-format.test.ts:147 | exfil-host | "https://api.telegram.org/bottoken/sendMessage", |
| apps/cli/src/connectors/adapters/telegram.test.ts:311 | exfil-host | "https://api.telegram.org/bot123:test/getMe", |
| sdk/packages/shared/src/parse/shell.test.ts:234 | powershell-encoded | "powershell -NoProfile -EncodedCommand VwByAGkAdABlAA==", |
URLs to bare IP addresses (3)
| Where | Rule | Match |
|---|---|---|
| apps/cline-hub/src/validate-options.ts:47 | ip-literal-url | PUBLIC_URL: "http://100.82.5.118", |
| apps/cline-hub/src/validate-options.ts:52 | ip-literal-url | "http://100.82.5.118:8787", |
| apps/cline-hub/src/validate-options.ts:57 | ip-literal-url | "http://100.82.5.118:8787/?roomSecret=invite-123", |
npm lifecycle scripts (3)
apps/cli/package.jsonprepack:bun script/guard-direct-publish.tspackage.jsonprepare:huskysdk/packages/ui/package.jsonprepack:bun run build
Installer scripts (3)
- apps/vscode/scripts/run-extension-host.ps1, 93 lines
- apps/vscode/scripts/run-extension-host.sh, 73 lines
- apps/vscode/scripts/runclinecore.sh, 51 lines
Worst known vulnerabilities (24 of 48)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-5xrq-8626-4rwp | critical | vitest@1.6.1 | When Vitest UI server is listening, arbitrary file can be read and executed |
| RUSTSEC-2026-0194 | high | quick-xml@0.38.4 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.38.4 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-5375-pq7m-f5r2 | high | @grpc/grpc-js@1.13.3 | @grpc/grpc-js: A malformed request can cause a server crash |
| GHSA-99f4-grh7-6pcq | high | @grpc/grpc-js@1.13.3 | @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash |
| GHSA-7q85-xj36-vmfc | high | adm-zip@0.5.16 | adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) |
| GHSA-xcpc-8h2w-3j85 | high | adm-zip@0.5.16 | adm-zip: Crafted ZIP file triggers 4GB memory allocation |
| GHSA-7pqw-9j4j-h8q3 | high | extract-zip@2.0.1 | extract-zip allows arbitrary file writes through symlink archive entries |
| GHSA-jmr9-qjv8-65gv | high | extract-zip@2.0.1 | extract-zip unvalidated symlink path traversal |
| GHSA-5jgf-p345-68v8 | high | fast-uri@3.1.5 | fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references |
| GHSA-f65p-4m7j-42xc | high | fast-uri@3.1.5 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
| GHSA-fph4-wmhf-6fwf | high | fast-uri@3.1.5 | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
| GHSA-jqff-g426-hqxp | high | fast-uri@3.1.5 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.3.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.17 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-37ch-88jc-xwx2 | high | path-to-regexp@0.1.12 | path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.14 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.33.5 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.33.5 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
| GHSA-28wg-ghj8-5hjv | high | nanoid@3.3.11 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.11 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-xwg4-73v4-xw9w | high | nanoid@3.3.11 | nanoid: Integer Overflow or Wraparound |
| GHSA-6g55-p6wh-862q | high | postcss@8.5.6 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.6 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
Workflows worth a look
- .github/workflows/ext-jb-test-integration.yml: pull_request_target
- .github/workflows/repo-strip-agent-badges.yml: pull_request_target
By the numbers
| Stars | 69.4K |
|---|---|
| Forks | 7,531 |
| Contributors | 330 |
| Commits | 7,453 |
| Open issues | 843 |
| Open pull requests | 624 |
| Releases | 432 |
| Latest release | desktop-v0.0.37 |
| Licence | Apache-2.0 |
| Main language | TypeScript |
| Project age | 2 years |
| Last push | Sep 27, 2026 |
| Tracked files | 4,135 |
| Lines of code | 896.3K |
| Checkout size | 70 MB |
Lines by language: TypeScript 792.5K, Markdown 56.4K, JSON 16.4K, JavaScript 8,880, YAML 6,037, CSS 4,741.
Questions
Is Cline free?
The extension, CLI, desktop app and SDK are Apache-2.0 and free. You bring a model: an API key billed per token, a subscription some providers accept, or a local model through Ollama or LM Studio. Cline also sells credits through its own provider account, which is optional. Agent sessions are token-hungry, so a hosted-model bill is the real cost.
Does Cline run commands without asking?
Not by default. Every file edit and terminal command asks for approval, and in the editor each edit appears as a diff first. You can turn on auto-approve for some or all actions, and the headless CLI runs without prompts by design. Commands run in your own terminal with your permissions, so give it a branch and no production keys.
Does Cline send my code anywhere?
Your code goes to the model provider you choose, as context, which is how every hosted-model agent works; with a local model it stays on your machine. Separately, the extension asks whether to send anonymous usage telemetry, described as event data without code or file contents, and respects VS Code's global telemetry switch.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.