Coding agents Continue
Is Continue safe?
Short answer: Caution. StackGrade's weekly scan of continuedev/continue gives it a Caution label for 36 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 346 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Continue is exploitable in your setup. Automated scan of commit 5522c6f on 2 Nov 2026, not a manual audit.
Updated : the last week its score, rank or safety result changed.
Open-source coding agent for your editor and CI.
- 36,397 stars
- pushed 1 Nov
- Apache-2.0
- TypeScript
#43of 52 overall#10in Coding agents▲ 4 vs Week 44
- Maintenance 30%67
- Adoption 30%31
- Docs 20%0
- Community 20%–
Score over the last 4 weeks: 25, 32, 33, 37.
36 critical-severity known vulnerabilities in runtime dependencies (OSV).
How this score works
Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.
- Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 84 days (about 3.2 per 30 days), latest release 19 Jun 2026. Median 0 h to close an issue (5 closed issues).
- Adoption: 36,397 stars (70%), 5,543 forks (30%).
- Docs: README 2,790 characters, 9 headings, 0 code blocks, install section: no.
#10 of 14 in Coding agents
Ranked by score. The yellow row is this tool.
- 1Gemini CLI#4 overall70Caution
- 2OpenCode#5 overall70No issues found
- 3OpenHands#10 overall68Caution
- 4Claude Code#11 overall65No dependencies scanned
- 5Cline#12 overall65Caution
- 6Codex#16 overall58Caution
- 7deepseek-harness#17 overall57Caution
- 8KiroCrew#27 overall52Caution
- 9magpie#28 overall51No issues found
- 10Continue#43 overall37Caution
Show the other 4
- 11goose#44 overall36Caution
- 12Aider#45 overall31Caution
- 13codex-plugin-cc#48 overall29No issues found
- 14Roo Code#51 overall23Caution
Safety scan, 2 Nov 2026
Automated scan of commit 5522c6f, 2,201 files. Not a manual audit.
Caution
- 36Critical dependency advisories346 high, 399 medium, 46 low. OSV, runtime dependencies only.
- 0Install hooksNo npm install scripts found.
- 0Remote-code patternsFor example eval(fetch(…)).
- 47Agent files checked0 phrases flagged for review.
- 3curl | sh installersIn docs or program code. Information only.
Why this label?
Why this label:
- 36 critical-severity known vulnerabilities in runtime dependencies (OSV)
Known vulnerabilities in runtime dependencies (OSV): 36 critical, 346 high, 399 medium, 46 low, 17 unrated
tar@7.5.16 (GHSA-23hp-3jrh-7fpw) in binary/package-lock.jsonhandlebars@4.7.9 (GHSA-8r5x-fm3f-whwj) in core/package-lock.jsonhandlebars@4.7.9 (GHSA-p8wg-vrv2-v86f) in core/package-lock.jsonprotobufjs@6.11.6 (GHSA-xq3m-2v4x-88gg) in core/package-lock.jsonproxy-addr@2.0.7 (GHSA-jqcg-44mw-7w3h) in core/package-lock.json
Also found (informational, does not change the label):
- 346 high-severity known vulnerabilities in runtime dependencies (OSV)
- Program code runs a curl|sh style installer (2 occurrences, e.g. extensions/cli/scripts/install.ps1)
- Documents curl|sh style installer (1 occurrence, e.g. extensions/cli/README.md)
- Critical advisories counted once per package: 49 matches across 10 lockfiles
- Skill scripts contact: github.com, api.github.com
Notes:
- 263 affected packages only in dev/test/docs manifests, not counted
- Telemetry/analytics references in code: telemetry, amplitude
Automated scan of commit 5522c6f on 2 Nov 2026, not a manual audit. 2,201 files checked. What we check
Repo activity
From the GitHub API, fetched 2 Nov 2026.
- 0Releases, 90 daysLatest v2.0.0-vscode, 19 Jun
- <1hMedian issue closeOver 5 closed issues
- 36.4kStars+72 since 26 Oct
- 5.5kForks866 open issues
- 2023Repo created24 May 2023
0 releases in the last 30 days (GitHub releases feed, last 10 entries).
Questions about Continue
Answers use this week's StackGrade data.
Is Continue safe to use?
Caution. StackGrade's weekly scan of continuedev/continue gives it a Caution label for 36 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 346 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Continue is exploitable in your setup. Automated scan of commit 5522c6f on 2 Nov 2026, not a manual audit.
How does StackGrade score Continue?
Continue scores 37 out of 100 in Week 45: #43 of 52 tracked tools overall and #10 in Coding agents. The score combines maintenance (67), adoption (31) and docs (0) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.
What are the alternatives to Continue?
The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.
What licence does Continue use?
The licence listed for continuedev/continue is Apache-2.0. Read the licence text before commercial use.
Compare and use it
Side by side
Used in 2 AI use cases
All facts and sources
- Type
- AI tool
- License
- Apache-2.0
- Language
- TypeScript
- Created
- 24 May 2023
- Owner
- continuedev (Organization)
- Forks
- 5,543
- Homepage
- continue.dev
GitHub description: “open-source coding agent”
Sources: github.com/continuedev/continue, api.github.com/repos/continuedev/continue, raw.githubusercontent.com/continuedev/continue/main/README.m. Fetched 2 Nov 2026.
Know when Continue changes label
One email a week: the new top 10, the biggest score changes and every safety label that changed.
Free. Double opt-in: you confirm by email first, unsubscribe in one click.