Qwen Code: Open-Source AI Coding Agent for the Terminal (GitHub, Scanned)

Qwen Code is a coding agent that runs in your terminal: open it in a project, describe what you want, and it reads files, edits code and runs commands and tests, asking for approval as it goes. It started as a fork of Google's Gemini CLI and has since been developed on its own by the Qwen team, adding subagents, skills, hooks, MCP servers, plan mode, a sandbox and an auto mode.

Its draw is that it is not tied to one vendor. It speaks the OpenAI, Anthropic, Gemini and Qwen APIs, so you can point it at a Qwen model on Alibaba Cloud, another provider, or a local model through Ollama or vLLM, and switch at runtime. Beyond the terminal there are VS Code, Zed and JetBrains plugins, a desktop app, an experimental web UI (qwen serve), SDKs for TypeScript, Python and Java, and chat bridges for Telegram, DingTalk, WeChat and Feishu.

It is Apache-2.0, with about 28,700 stars and 620 contributors, and it moves very fast. One change to know about: the free tier of the Qwen OAuth login ended on 15 April 2026, so you now bring an API key or a paid plan.

• Repository: github.com/QwenLM/qwen-code
• Licence: Apache-2.0 (Apache License 2.0)
• Language: TypeScript. Stars: 28.7K. Forks: 3,262. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit e3bdc0f

Who it is for

Developers who want a Claude Code style agent with the choice of model left to them, including teams that want to run it against a self-hosted or local model.

Getting started

1. Install with npm (Node.js 22 or later; brew install qwen-code also works)

npm install -g @qwen-code/qwen-code@latest

2. Start it in your project, then run /auth inside the session to set a provider and key

cd /path/to/your-project && qwen

3. Or run it headless from a script

qwen -p "Explain this repository and show me where to start."

The README's one-line installers (a shell script for macOS and Linux, a PowerShell one for Windows) are fetched from Alibaba Cloud storage, can install Node.js for you, and add a line to your shell profile. The npm and Homebrew routes do none of that.

Safety scan

We cloned QwenLM/qwen-code at commit e3bdc0f on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The 31 secret hits are all in tests and in the agent's own secret scanner: fake Slack, GitHub and AWS tokens and BEGIN PRIVATE KEY markers used to check that Qwen Code redacts them. The 39 bare-IP URLs are test fixtures, mostly in the reserved documentation ranges.
• Most of the 66 pattern hits are the agent's safety code and its tests, which quote commands such as curl | sh and /dev/tcp redirects in order to block them. The real ones: the self-update path reruns the official installer with curl | bash, and the optional computer-use driver (packages/cua-driver) registers macOS LaunchAgents or a systemd user service for its daemon and updater, with uninstall scripts that remove them. Its installer can use sudo.
• Usage statistics are enabled by default for every login method, per the project's own privacy notice; set usageStatisticsEnabled to false in its settings to turn them off. Prompts and code go to whichever model provider you configure.
• 8 committed binaries: ripgrep for five platforms (the agent's search tool), a small landlock-run sandbox helper for Linux, and an Android Gradle wrapper. The install hooks set permissions on those binaries, build an optional microphone addon, and download the computer-use driver from the project's own GitHub releases.
• 328 known advisories, 13 critical, across ten lockfiles. Many sit in test tooling (Vitest, Tinypool) and example apps, but the main pnpm-lock.yaml (125, 10 critical) also flags runtime libraries such as simple-git and shell-quote, so keep it updated.
• 65 workflows. Eight run on pull_request_target, and the AI triage and review jobs do build pull-request code, but only after checking that the PR author has write access, inside containers, with tokens withheld from the steps that run it. 17 of 28 third-party actions are pinned; Dependabot, CodeQL and a security policy are present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 4.4M, Markdown 415.3K, Java 409.6K, Rust 257.3K, JavaScript 231.2K, JSON 205.3K.

Questions

Is Qwen Code free?

The software is free and Apache-2.0. Model use may not be: the free Qwen OAuth tier ended on 15 April 2026, so you either pay a provider (Alibaba Cloud's Coding Plan, OpenAI, Anthropic and others) or point it at a model you run yourself, which costs nothing beyond your hardware.

Can Qwen Code use a local model?

Yes. It talks to any OpenAI-compatible endpoint, so Ollama, vLLM, LM Studio or llama.cpp's server all work. Agent work needs a capable model with tool calling; small local models tend to struggle with long, multi-step edits.

How is Qwen Code related to Gemini CLI?

It was forked from Google's Gemini CLI at version 0.8.2 and stopped syncing with it from Qwen Code 0.1. The commands will feel familiar, but providers, features and settings have diverged since.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.