Week 45, updated 2 Nov 2026

Coding agents Claude Code

Is Claude Code safe?

Short answer: No issues in the code checks, but dependencies were not checked. StackGrade's weekly scan of anthropics/claude-code found no issues in the code and agent instruction files of the public repo, but there was no dependency list to check: osv-scanner found no runtime lockfile or package manifest, so the label is “No dependencies scanned”, not a passed dependency check. Automated scan of commit 80c6959 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Anthropic's terminal coding agent that understands your codebase, runs routine tasks, explains code and handles git via natural language.

  • 154,199 stars
  • pushed 1 Nov
  • Proprietary (Anthropic Commercial Terms)
  • TypeScript

github.com/anthropics/claude-code · code.claude.com/docs/en/overview

65score out of 100

#11of 52 overall#4in Coding agents▼ 2 vs Week 44

  • Maintenance 30%77
  • Adoption 30%82
  • Docs 20%20
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 65, 65, 67, 65.

No dependencies scanned

Code checks clean. No runtime lockfile or manifest, so dependencies could not be checked.

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 10 days (about 27 per 30 days), latest release 31 Oct 2026. Median 0 h to close an issue (20 closed issues).
  • Adoption: 154,199 stars (70%), 25,520 forks (30%).
  • Docs: README 2,867 characters, 8 headings, 5 code blocks, install section: yes.

Methodology

#4 of 14 in Coding agents

Ranked by score. The yellow row is this tool.

Coding agents, Week 45score 0–100, safety
  1. 1Gemini CLI#4 overall70Caution
  2. 2OpenCode#5 overall70No issues found
  3. 3OpenHands#10 overall68Caution
  4. 4Claude Code#11 overall65No dependencies scanned
  5. 5Cline#12 overall65Caution
  6. 6Codex#16 overall58Caution
Show the other 8
  1. 7deepseek-harness#17 overall57Caution
  2. 8KiroCrew#27 overall52Caution
  3. 9magpie#28 overall51No issues found
  4. 10Continue#43 overall37Caution
  5. 11goose#44 overall36Caution
  6. 12Aider#45 overall31Caution
  7. 13codex-plugin-cc#48 overall29No issues found
  8. 14Roo Code#51 overall23Caution

Safety scan, 2 Nov 2026

Automated scan of commit 80c6959, 1,446 files. Not a manual audit.

No dependencies scanned

  • –DependenciesNo runtime lockfile or manifest, so nothing to check.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 4Agent files checked0 phrases flagged for review.
  • 1curl | sh installersIn docs or program code. Information only.
Why this label?

No issues found by the code checks. osv-scanner found no lockfile or package manifest, so no dependency check was possible. So “no issues” here does not cover dependencies.

Known vulnerabilities in runtime dependencies (OSV): no lockfiles/manifests detected by osv-scanner

Also found (informational, does not change the label):

  • Documents curl|sh style installer (1 occurrence, e.g. README.md)

Notes:

  • Telemetry/analytics references in code: telemetry

Automated scan of commit 80c6959 on 2 Nov 2026, not a manual audit. 1,446 files checked. What we check

Claude Code safety in detail

Scan result: StackGrade's automated weekly scan of the public anthropics/claude-code repo (commit 80c6959, scanned 2 Nov 2026, 1,446 files checked) found no issues in the code and agent instruction files of the public repo, but there was no dependency list to check: osv-scanner found no runtime lockfile or package manifest, so the label is “No dependencies scanned”, not a passed dependency check. It is an automated check, not a manual security audit, and Claude Code is Proprietary (Anthropic Commercial Terms), so we can only scan what is published on GitHub.

Read the full answer

Claude Code scores 65/100 this week (#11 of 52 overall, #4 in Coding agents). Highest-scored alternatives in Coding agents: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Cline (65, Caution).

Is Claude Code safe to use at work? What Anthropic documents

  • Permission modes. In Manual mode Claude Code starts with read-only permissions and asks before it edits files, runs tests or executes commands. Auto mode uses a separate classifier model to review actions instead of you; your organization can turn auto mode off.
  • Sandboxed bash. Bash commands can run with filesystem and network isolation (/sandbox).
  • Network commands such as curl and wget are not auto-approved by default.
  • MCP servers in a project's .mcp.json get their own approval prompt. Anthropic says it reviews connectors for its directory but “does not security-audit or manage any MCP server.”
  • Managed settings let teams enforce permission rules organization-wide.

Source: Anthropic, Claude Code security docs.

Docs score 20: our docs criterion reads the GitHub README (2,867 characters), not Anthropic's separate documentation site. Compare: Claude Code vs Codex · OpenCode vs Claude Code · Gemini CLI vs Claude Code · Claude Code vs OpenHands · all coding agents

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest v2.1.316, 31 Oct
  • <1hMedian issue closeOver 20 closed issues
  • 154kStars+815 since 26 Oct
  • 25.5kForks16,179 open issues
  • 2025Repo created22 Feb 2025
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Claude Code

Answers use this week's StackGrade data.

Is Claude Code safe to use?

No issues in the code checks, but dependencies were not checked. StackGrade's weekly scan of anthropics/claude-code found no issues in the code and agent instruction files of the public repo, but there was no dependency list to check: osv-scanner found no runtime lockfile or package manifest, so the label is “No dependencies scanned”, not a passed dependency check. Automated scan of commit 80c6959 on 2 Nov 2026, not a manual audit.

How does StackGrade score Claude Code?

Claude Code scores 65 out of 100 in Week 45: #11 of 52 tracked tools overall and #4 in Coding agents. The score combines maintenance (77), adoption (82) and docs (20) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Claude Code?

The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Cline (65, Caution). StackGrade has not tested them hands-on.

What licence does Claude Code use?

The licence listed for anthropics/claude-code is Proprietary (Anthropic Commercial Terms). Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Proprietary (Anthropic Commercial Terms)
Language
TypeScript
Created
22 Feb 2025
Owner
anthropics (Organization)
Forks
25,520

GitHub description: “Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.”

Sources: github.com/anthropics/claude-code, api.github.com/repos/anthropics/claude-code, raw.githubusercontent.com/anthropics/claude-code/main/README. Fetched 2 Nov 2026.

Know when Claude Code changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.