Coding agents Roo Code
Is Roo Code safe?
Short answer: Caution. StackGrade's weekly scan of RooCodeInc/Roo-Code gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV) and an archived repository. It does list 123 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Roo Code is exploitable in your setup. Automated scan of commit b867ec9 on 2 Nov 2026, not a manual audit.
Updated : the last week its score, rank or safety result changed.
Editor extension that gives you a team of AI coding agents inside VS Code.
- 24,257 stars
- pushed 15 May
- Apache-2.0
- TypeScript
#51of 52 overall#14in Coding agents▼ 1 vs Week 44
- Maintenance 30%42
- Adoption 30%16
- Docs 20%4
- Community 20%–
Score over the last 4 weeks: 23, 22, 24, 23.
13 critical-severity known vulnerabilities in runtime dependencies (OSV) (+1 more).
How this score works
Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.
- Maintenance: Last push 15 May 2026 (archived). Last 10 GitHub releases within 73 days (about 3.7 per 30 days), latest release 15 May 2026. Median 0.5 h to close an issue (5 closed issues).
- Adoption: 24,257 stars (70%), 3,423 forks (30%).
- Docs: README 3,327 characters, 6 headings, 0 code blocks, install section: yes.
#14 of 14 in Coding agents
Ranked by score. The yellow row is this tool.
- 1Gemini CLI#4 overall70Caution
- 2OpenCode#5 overall70No issues found
- 3OpenHands#10 overall68Caution
- 4Claude Code#11 overall65No dependencies scanned
- 5Cline#12 overall65Caution
- 6Codex#16 overall58Caution
- 7deepseek-harness#17 overall57Caution
- 8KiroCrew#27 overall52Caution
- 9magpie#28 overall51No issues found
- 10Continue#43 overall37Caution
- 11goose#44 overall36Caution
- 12Aider#45 overall31Caution
- 13codex-plugin-cc#48 overall29No issues found
- 14Roo Code#51 overall23Caution
Safety scan, 2 Nov 2026
Automated scan of commit b867ec9, 2,257 files. Not a manual audit.
Caution
- 13Critical dependency advisories123 high, 129 medium, 28 low. OSV, runtime dependencies only.
- 2Install hooksnpm scripts that run on install; none downloads remote content.
- 0Remote-code patternsFor example eval(fetch(…)).
- 26Agent files checked0 phrases flagged for review.
- 4curl | sh installersIn docs or program code. Information only.
Why this label?
Why this label:
- 13 critical-severity known vulnerabilities in runtime dependencies (OSV)
- Repository archived
Known vulnerabilities in runtime dependencies (OSV): 13 critical, 123 high, 129 medium, 28 low, 3 unrated
basic-ftp@5.0.5 (GHSA-5rq4-664w-9x2c) in pnpm-lock.yamlfast-xml-parser@5.2.3 (GHSA-m7jm-9gc2-mpf2) in pnpm-lock.yamlmammoth@1.9.1 (GHSA-rmjr-87wv-gf87) in pnpm-lock.yamlproxy-addr@2.0.7 (GHSA-jqcg-44mw-7w3h) in pnpm-lock.yamlshell-quote@1.8.2 (GHSA-w7jw-789q-3m8p) in pnpm-lock.yaml
Also found (informational, does not change the label):
- 123 high-severity known vulnerabilities in runtime dependencies (OSV)
- 2 npm install hooks, none downloading remote content
- Program code runs a curl|sh style installer (2 occurrences, e.g. apps/cli/install.sh)
- Documents curl|sh style installer (2 occurrences, e.g. .github/workflows/cli-release.yml)
- Critical advisories counted once per package: 15 matches across 1 lockfile
- Skill scripts contact: api.github.com, raw.githubusercontent.com
Notes:
- 2 affected packages only in dev/test/docs manifests, not counted
Automated scan of commit b867ec9 on 2 Nov 2026, not a manual audit. 2,257 files checked. What we check
Repo activity
From the GitHub API, fetched 2 Nov 2026.
- 0Releases, 90 daysLatest v3.54.0, 15 May
- <1hMedian issue closeOver 5 closed issues
- 24.3kStars-5 since 26 Oct
- 3.4kForks1,031 open issues
- 2024Repo created31 Oct 2024
0 releases in the last 30 days (GitHub releases feed, last 10 entries).
Questions about Roo Code
Answers use this week's StackGrade data.
Is Roo Code safe to use?
Caution. StackGrade's weekly scan of RooCodeInc/Roo-Code gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV) and an archived repository. It does list 123 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Roo Code is exploitable in your setup. Automated scan of commit b867ec9 on 2 Nov 2026, not a manual audit.
How does StackGrade score Roo Code?
Roo Code scores 23 out of 100 in Week 45: #51 of 52 tracked tools overall and #14 in Coding agents. The score combines maintenance (42), adoption (16) and docs (4) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.
What are the alternatives to Roo Code?
The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.
What licence does Roo Code use?
The licence listed for RooCodeInc/Roo-Code is Apache-2.0. Read the licence text before commercial use.
Compare and use it
Side by side
Used in 1 AI use case
All facts and sources
- Type
- AI tool
- License
- Apache-2.0
- Language
- TypeScript
- Created
- 31 Oct 2024
- Owner
- RooCodeInc (Organization)
- Forks
- 3,423
- Homepage
- roocode.com
GitHub description: “Roo Code gives you a whole dev team of AI agents in your code editor.”
Sources: github.com/RooCodeInc/Roo-Code, api.github.com/repos/RooCodeInc/Roo-Code, raw.githubusercontent.com/RooCodeInc/Roo-Code/main/README.md. Fetched 2 Nov 2026.
Know when Roo Code changes label
One email a week: the new top 10, the biggest score changes and every safety label that changed.
Free. Double opt-in: you confirm by email first, unsubscribe in one click.