Week 45, updated 2 Nov 2026

Coding agents Cline

Is Cline safe?

Short answer: Caution. StackGrade's weekly scan of cline/cline gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 46 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Cline is exploitable in your setup. Automated scan of commit a6507a6 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Autonomous coding agent available as an SDK, IDE extension or CLI.

  • 71,190 stars
  • pushed 2 Nov
  • Apache-2.0
  • TypeScript

github.com/cline/cline · cline.bot

65score out of 100

#12of 52 overall#5in Coding agents▲ 1 vs Week 44

  • Maintenance 30%75
  • Adoption 30%51
  • Docs 20%69
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 64, 68, 64, 65.

Caution

13 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 5 days (about 57 per 30 days), latest release 30 Oct 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 71,190 stars (70%), 7,828 forks (30%).
  • Docs: README 9,243 characters, 21 headings, 7 code blocks, install section: yes.

Methodology

#5 of 14 in Coding agents

Ranked by score. The yellow row is this tool.

Coding agents, Week 45score 0–100, safety
  1. 1Gemini CLI#4 overall70Caution
  2. 2OpenCode#5 overall70No issues found
  3. 3OpenHands#10 overall68Caution
  4. 4Claude Code#11 overall65No dependencies scanned
  5. 5Cline#12 overall65Caution
  6. 6Codex#16 overall58Caution
Show the other 8
  1. 7deepseek-harness#17 overall57Caution
  2. 8KiroCrew#27 overall52Caution
  3. 9magpie#28 overall51No issues found
  4. 10Continue#43 overall37Caution
  5. 11goose#44 overall36Caution
  6. 12Aider#45 overall31Caution
  7. 13codex-plugin-cc#48 overall29No issues found
  8. 14Roo Code#51 overall23Caution

Safety scan, 2 Nov 2026

Automated scan of commit a6507a6, 3,948 files. Not a manual audit.

Caution

  • 13Critical dependency advisories46 high, 42 medium, 13 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 133Agent files checked0 phrases flagged for review.
  • 1curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 13 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 13 critical, 46 high, 42 medium, 13 low, 2 unrated

  • @simple-git/argv-parser@1.1.1 (GHSA-v5rq-49vh-5v5c) in bun.lock
  • dompurify@3.4.14 (GHSA-cg2g-xh64-v4q7) in bun.lock
  • next@16.2.11 (GHSA-2464-fhr4-w9xw) in bun.lock
  • next@16.2.11 (GHSA-2xp9-vwfh-vxw4) in bun.lock
  • next@16.2.11 (GHSA-673q-mjm6-r5xr) in bun.lock

Also found (informational, does not change the label):

  • 46 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Documents curl|sh style installer (1 occurrence, e.g. apps/examples/desktop-app/webview/components/views/settings/local-runtime-setup.tsx)
  • Skill scripts contact: api.github.com, github.com, registry.npmjs.org

Notes:

  • 53 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: telemetry, posthog

Automated scan of commit a6507a6 on 2 Nov 2026, not a manual audit. 3,948 files checked. What we check

Cline safety in detail

Scan result: StackGrade's automated weekly scan of the public cline/cline repo (commit a6507a6, scanned 2 Nov 2026, 3,948 files checked) gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV). It is an automated check, not a manual security audit.

Read the full answer

Cline scores 65/100 this week (#12 of 52 overall, #5 in Coding agents). Highest-scored alternatives in Coding agents: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned).

Approval settings matter more than the label

  • Cline: Auto Approve is set per category (read, edit, run commands, browser, MCP). Cline's docs recommend starting with only “Read project files” and leaving the rest off until you have a reason. For commands, the model itself flags whether approval is needed; Cline “does not use a fixed allowlist”. YOLO mode approves everything, including terminal commands.
  • Claude Code: Manual mode starts read-only and asks before edits and commands; network commands are not auto-approved by default; bash can be sandboxed with /sandbox.

Sources: Cline docs, Auto Approve · Claude Code security docs.

Cline vs Claude Code

Cline scores 65 and Claude Code 65 this week. Cline leads on README docs (69 vs 20), Claude Code leads on adoption (82 vs 51) and Claude Code leads on maintenance (77 vs 75). Cline is Apache-2.0, open source; Claude Code is Proprietary (Anthropic Commercial Terms). Safety: Cline “Caution”, Claude Code “No dependencies scanned” (no dependency list in the public repo to check). Neither was tested hands-on.

  • You want an agent inside your editor, or an open-source one: Cline, with Auto Approve kept narrow.
  • You want Anthropic's terminal agent with managed team settings: Claude Code.

More: Gemini CLI vs Claude Code · OpenCode vs Claude Code · all coding agents

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest desktop-nightly-2026103…, 30 Oct
  • –Median issue closeFewer than 5 closed issues
  • 71.2kStars+339 since 26 Oct
  • 7.8kForks1,743 open issues
  • 2024Repo created6 Jul 2024
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Cline

Answers use this week's StackGrade data.

Is Cline safe to use?

Caution. StackGrade's weekly scan of cline/cline gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 46 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Cline is exploitable in your setup. Automated scan of commit a6507a6 on 2 Nov 2026, not a manual audit.

How does StackGrade score Cline?

Cline scores 65 out of 100 in Week 45: #12 of 52 tracked tools overall and #5 in Coding agents. The score combines maintenance (75), adoption (51) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Cline?

The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.

What licence does Cline use?

The licence listed for cline/cline is Apache-2.0. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Apache-2.0
Language
TypeScript
Created
6 Jul 2024
Owner
cline (Organization)
Forks
7,828
Homepage
cline.bot

GitHub description: “Autonomous coding agent as an SDK, IDE extension, or CLI assistant.”

Sources: github.com/cline/cline, api.github.com/repos/cline/cline, raw.githubusercontent.com/cline/cline/main/README.md. Fetched 2 Nov 2026.

Know when Cline changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.