Open-Source AI Coding Agents Compared (Nov 2026)

Open-source AI coding agents give teams a free, inspectable alternative to commercial assistants, but each project ships a different licence, a different set of surfaces and a very different default for how much the agent may do without asking. This page compares seven projects whose source code is published on GitHub: Aider, Cline, Codex CLI, goose, Kilo Code, OpenCode and OpenHands. Every licence below was read from the repository's own LICENSE file, and every feature and default from the project's README, security policy or official documentation. It is for developers choosing a tool, platform teams writing an approved-tools list, and security reviewers who need to know what each agent can touch. Projects are listed alphabetically; order is not a ranking and the page gives no verdicts.

Last checked: 2026-11-15.

This is an independent reference page from NHI Mgmt Group based on public provider documentation; it is not sponsored or endorsed by any provider. Open-source projects change quickly, so confirm against each repository before relying on a detail.

Key takeaways

Two licence families cover all seven. Aider, Cline, Codex CLI and goose use Apache License 2.0; Kilo Code, OpenCode and OpenHands use the MIT License, according to each repository's LICENSE file on 2026-11-15.
Open source does not mean everything is open. Cline states that its JetBrains plugin is not open source, and several projects pair the open agent with hosted services such as cloud agents, code review or a paid model gateway.
Defaults range from ask-every-time to fully autonomous. goose documents Autonomous Mode as its default, Codex CLI documents workspace-write as its default local sandbox mode, and Cline asks for approval on each file edit and terminal command unless auto-approve is switched on.
Several projects say plainly that they are not a sandbox. The OpenCode and Kilo Code security policies state that their permission prompts are a user experience feature, not security isolation, and recommend a container or virtual machine for isolation.
Model choice is yours, and so is the data path. All seven can connect to more than one model provider or to local models, so the data handling that matters most is usually the chosen model provider's, plus any telemetry the agent itself sends.

What counts as an open-source coding agent on this page?

The inclusion rule is objective: the project's agent source code is published in a public GitHub repository with an OSI-style licence file at the repository root, and the project describes itself as an agent that reads code, edits files or runs commands on a developer's behalf. The seven projects were named in searches for this comparison and all meet the rule. Cloud-hosted agents that work asynchronously on a provider's infrastructure are compared separately in Cloud Coding Agents Compared, and terminal agents (open and closed) in AI Coding CLI Agents Compared. For the wider market, see the AI Coding Tools Hub.

How each project describes itself in its own README:

Aider: "AI Pair Programming in Your Terminal"; it lets you pair program with LLMs to start a new project or build on an existing codebase.
Cline: "The open source coding agent in your IDE, terminal, & desktop".
Codex CLI: "a coding agent from OpenAI that runs locally on your computer".
goose: a general-purpose AI agent that runs on your machine, for code and also for research, writing, automation and data analysis.
Kilo Code: "The open source coding agent for building with AI in VS Code, JetBrains, or the CLI".
OpenCode: "The open source AI coding agent".
OpenHands: its current README leads with Agent Canvas, "The self-hosted developer control center for coding agents and automations", which runs the OpenHands agent and other agents.

Open-source coding agents at a glance

As of 2026-11-15. Licence from the repository LICENSE file; surfaces from the README.

Project	Repository	Licence (LICENSE file)	Surfaces in README	Steward named in repository
Aider	Aider-AI/aider	Apache License 2.0	Terminal; editor integration through code comments (watch mode); copy and paste to web chat	Aider-AI organisation (no company named in README)
Cline	cline/cline	Apache License 2.0	CLI, desktop app (macOS, Windows), VS Code extension, JetBrains plugin, SDK	Cline
Codex CLI	openai/codex	Apache License 2.0	Terminal; IDE extension and desktop app referenced as separate installs	OpenAI
goose	block/goose (README links point to aaif-goose/goose)	Apache License 2.0	Desktop app (macOS, Linux, Windows), CLI, API	Agentic AI Foundation (AAIF) at the Linux Foundation
Kilo Code	Kilo-Org/kilocode	MIT License (copyright lines for Kilo Code, 2026, and opencode, 2025)	VS Code extension, JetBrains plugin, CLI; hosted Cloud Agent and code reviews	Kilo Code
OpenCode	sst/opencode (security advisories and Homebrew tap under anomalyco)	MIT License	Terminal; desktop app (beta) for macOS, Windows, Linux	OpenCode team (security escalation address at anoma.ly)
OpenHands	All-Hands-AI/OpenHands	MIT License	Agent Canvas web control centre with local, Docker, VM and cloud backends; optional OpenHands Cloud or OpenHands Enterprise	OpenHands contributors

Notes on the licences. Apache License 2.0 includes an express patent licence and requires that modified files carry notices of change; the MIT License is shorter and requires the copyright and permission notice to be kept. Both permit commercial use. The Kilo Code LICENSE file carries an opencode copyright line alongside its own, which reflects shared code history; anyone redistributing Kilo Code keeps both notices. Read the full licence before redistribution; this page is not legal advice.

Features and agent modes

As of 2026-11-15, from each README unless stated.

Project	Agent modes	Project rules or instructions	Extensions	Headless or CI use
Aider	Chat-driven editing; repository map of the whole codebase; automatic lint and test after changes	Configuration options documented at aider.chat	Not stated in README	Not stated in README
Cline	Plan mode (explores and proposes a strategy) and Act mode (executes)	`.clinerules` files, picked up by the CLI, VS Code extension and JetBrains plugin	Plugins through the SDK; MCP servers	CLI has an interactive mode and a fully headless mode for CI/CD and scripting
Codex CLI	Local agent with sandbox modes and approval policies (see next section)	Configuration in `config.toml`; admin requirements in `requirements.toml`	Lifecycle hooks; admins can set `allow_managed_hooks_only = true` in `requirements.toml`	Not stated in README
goose	Four permission modes: Completely Autonomous, Manual Approval, Smart Approval, Chat Only	Not stated in README	70+ extensions; custom distributions with preconfigured providers and extensions	CLI and API
Kilo Code	Code (default), Plan, Ask (no file changes), Debug; custom agents	Not stated in README	Kilo Marketplace for agents, skills, MCP servers and plugins	`kilo run --auto` for fully autonomous CI/CD use
OpenCode	build (default, full access) and plan (read-only: denies file edits by default, asks before bash commands); a general subagent	Not stated in README	MCP servers (named as outside the project's trust boundary)	Opt-in server mode
OpenHands	OpenHands agent plus any Agent Client Protocol (ACP) agent, including Claude Code, Codex, Gemini, Pi and OpenCode	Not stated in README	Automations with Slack, GitHub, Linear, Notion and others, on a schedule or webhook	Agent server backend; automations run without a user present

Model and provider support

Aider: connects to "almost any LLM, including local models"; the README examples use DeepSeek, Anthropic and OpenAI models with API keys.
Cline: lists Anthropic, OpenAI, Google, OpenRouter, Vercel AI Gateway, AWS Bedrock, Azure, GCP Vertex, Cerebras, Groq, Ollama, LM Studio and any OpenAI-compatible API, plus its own Cline provider.
Codex CLI: sign in with ChatGPT to use Codex as part of a Plus, Pro, Business, Edu or Enterprise plan, or use an OpenAI API key with additional setup.
goose: 15+ providers including Anthropic, OpenAI, Google, Ollama, OpenRouter, Azure and Bedrock; existing Claude, ChatGPT or Gemini subscriptions can be used through ACP.
Kilo Code: 500+ models with mid-task switching, through a Kilo account.
OpenCode: provider configuration is in its documentation; LLM provider data handling is stated to be governed by the provider's own policies.
OpenHands: "Use with any LLM", with LLM profiles in settings.

How much can each agent do without asking?

This is the field that most changes risk. As of 2026-11-15, from security policies and documentation.

Project	Documented default	Most autonomous setting	Isolation statement
Aider	Edits are applied to files and each change is committed to git with a descriptive message; pre-existing uncommitted changes are committed first	Not stated in pages checked	Not stated in pages checked
Cline	Every file edit and terminal command requires approval	Auto-approve toggle "and let Cline run autonomously"	Not stated in pages checked
Codex CLI	`workspace-write` sandbox: read and edit inside the workspace and run routine local commands there	`danger-full-access` with approval policy `never` (no filesystem or network boundary, no prompts)	OS sandbox: Seatbelt on macOS, native Windows sandbox, Bubblewrap (`bwrap`) on Linux and WSL2
goose	Autonomous Mode is applied by default	Completely Autonomous: modifies and deletes files and uses extensions without approval	Security policy advises a dedicated VM or container with limited privileges
Kilo Code	Permission prompts before commands and file writes	`--auto` auto-approves prompts unless a rule explicitly denies the action; "Only use it in trusted environments"	"does not sandbox the agent"; use Docker or a VM for isolation
OpenCode	build agent has full access; plan agent denies edits and asks before bash	build agent	"does not sandbox the agent"; permission system "is not designed to provide security isolation"
OpenHands	Two quickstart options: without a sandbox (agent has full access to the host filesystem) or with a Docker sandbox	Agent server reachable remotely in public mode	Docker sandbox option; VM self-hosting guide says to treat the VM like a machine holding production credentials

For the security model behind these settings, see the Agent Sandboxing vs Tool Allowlisting guide and the AI Agent Sandboxing and Code Execution Guide.

Network listeners and remote access

Three projects can expose the agent over a network, which turns a local tool into a server that needs authentication.

OpenCode: server mode is opt-in; set OPENCODE_SERVER_PASSWORD to require HTTP Basic Auth, otherwise it runs unauthenticated with a warning.
Kilo Code: the same model, with KILO_SERVER_PASSWORD.
OpenHands: public mode requires every /api/* call to carry an X-Session-API-Key header matching LOCAL_BACKEND_API_KEY, and the self-hosting guide says to lock down the network firewall before the first start.

Data handling and telemetry

Because these tools send prompts and code context to whichever model provider you configure, the provider's terms decide retention and training use. The OpenCode and Kilo Code security policies say so directly. What the agent itself collects differs.

Project	Agent telemetry (as documented)	How to turn it off
Aider	Opt-in anonymous analytics tied to a random UUID; a random subset of users is asked to opt in; never collects code, chat messages, keys or personal information, per its analytics page	`aider --analytics-disable` (permanent); `--no-analytics` per session; `--analytics-log` to inspect events
Cline	On by default in VS Code, JetBrains, Desktop and CLI: features used, task events, errors, token counts, model and provider names, device identifier; code, files and prompts excluded except on the Cline and ClinePass providers	Settings, General, clear "Allow error and usage reporting"; CLI `"telemetryOptOut": true`; organisation admins can set `telemetryEnabled` for the extensions
Codex CLI	Not stated in pages checked	Not stated in pages checked
goose	Not stated in pages checked	Not stated in pages checked
Kilo Code	Not stated in pages checked	Not stated in pages checked
OpenCode	Not stated in pages checked	Not stated in pages checked
OpenHands	Not stated in pages checked	Not stated in pages checked

"Not stated in pages checked" means the README, LICENSE and security policy read for this page did not cover it; check the project documentation before approval. For how model provider retention compares across commercial tools, see the AI Coding Tools Data Retention and Training Tracker.

Security reporting and project governance

Codex CLI: repository includes a SECURITY.md; licensed Apache 2.0.
goose: private vulnerability reporting through GitHub; a GOVERNANCE.md defines Maintainers (write access to create branches) and Core Maintainers (admin access, escalation and appointments).
Kilo Code: reports to a security email address; AI-generated security reports are not accepted and lead to a ban.
OpenCode: reports through GitHub Security Advisories, with email escalation if no acknowledgement in 6 business days; AI-generated reports are not accepted.
Out of scope by policy: OpenCode and Kilo Code both list sandbox escapes, LLM provider data handling, MCP server behaviour and malicious config files as out of scope, because the user controls those.

The last point matters for reviewers: a poisoned project configuration or a malicious MCP server is treated by these projects as your problem, not a vulnerability in the tool. See Coding Agent Configuration File Attacks and the MCP Security Guide.

How to choose an open-source coding agent: factual criteria

Licence fit: if your legal team prefers an express patent grant, the Apache 2.0 projects provide one; if you want the shortest permissive terms, the MIT projects fit. Both allow internal commercial use.
Surface: terminal only (Aider, Codex CLI, OpenCode), editor plus terminal (Cline, Kilo Code), desktop app (Cline, goose, OpenCode beta) or a self-hosted multi-agent web control centre (OpenHands).
Built-in isolation: Codex CLI documents an operating system sandbox; OpenHands offers a Docker sandbox; OpenCode and Kilo Code state they have none and point to containers or VMs.
Default autonomy: choose the default your users will actually keep. A tool that asks before every command (Cline) and a tool that is autonomous by default (goose) need different guardrails.
Central policy: Codex CLI supports admin requirements.toml and managed hooks; Cline lets organisation admins enforce telemetry settings in the extensions; others document no central policy file in the pages checked.
Fully open stack: if every component must be open source, note Cline's closed JetBrains plugin and the hosted services (cloud agents, code review, model gateways) that sit beside several projects.
Small vs large organisations: an individual developer can run any of these in a container with a personal API key; a large organisation will want a central model gateway, a managed configuration and an approved version pin, which favours tools with a documented policy file or SDK hooks.

Rolling out an open-source agent safely

Pick and pin a version. Approve a specific release and install from the project's documented channel (package manager or GitHub Releases), not a moving script URL on production hosts.
Isolate first. Run the agent in a dev container or VM with only the repository mounted, no cloud credentials in the environment and no access to ~/.ssh or ~/.aws.
Set the least autonomous mode that works. For example plan or Ask modes for exploration, Manual or Smart Approval in goose, workspace-write with on-request in Codex CLI.
Route models through an approved provider. Use a provider account with agreed retention and training terms, and scoped, short-lived API keys owned by a named person. See AI Coding Tools and Secrets Sprawl.
Review extensions and MCP servers. Allow only reviewed servers, as goose's security policy advises.
Pilot with a small ring. One team, two to four weeks, with git history and agent logs reviewed weekly.
Keep rollback simple. Agents that commit each change (Aider) or work on branches make rollback a git operation; protect main with required reviews so no agent change lands unreviewed.

Detection and measurement

Inventory: number of developer machines with each agent binary or extension installed, compared with the approved list. See Unsanctioned AI Coding Assistants.
Autonomy share: proportion of sessions running in an auto-approve, --auto, Autonomous or full-access mode.
Exposed listeners: count of agent servers (OpenCode, Kilo Code, OpenHands) reachable on a network interface without a password or API key; the target is zero.
Secrets in agent context: secret scanning hits in agent-authored commits and transcripts.
Review coverage: percentage of agent-authored changes merged with a human review.

Common failure patterns

Treating permission prompts as a sandbox. Two projects say outright that theirs are not; the agent runs with the user's own rights.
Leaving an autonomous default in place. goose ships in Autonomous Mode; teams that never change the default accept file deletion without approval.
Exposing a server without authentication. Server modes run unauthenticated unless a password or key is set.
Running in CI with full auto-approval and broad tokens. --auto or headless modes with a repository token that can push to main remove the human checkpoint. See Self-hosted CI/CD Runners and Build Agents.
Assuming "open source" means no data leaves. Prompts and code still go to the configured model provider, and some agents send telemetry by default.
Trusting repository content. goose's policy warns the agent may follow commands embedded in content; untrusted repositories and issues are a prompt injection route. See the Prompt Injection Guide.

Where identity fits

Every one of these agents acts with a borrowed identity: the developer's operating system account, their git credentials and one or more model provider API keys. In CI or on a shared OpenHands server the agent may run under a service account or repository token instead. Treat each of those as a non-human identity with an owner, a scope and a rotation date, and keep provider keys out of the repository and the agent's context. See the AI IDE and Coding Agent Security Guide and How to audit AI coding assistant tokens and config files.

Practitioner checklist

Confirm the licence from the repository LICENSE file for the exact version you approve.
Record which components are closed or hosted (plugins, cloud agents, model gateways) before calling the stack open source.
Change autonomous defaults to an approval or read-only mode for general users.
Run agents in a container or VM where the project states it has no sandbox.
Set a password or API key on every agent server mode and keep it off public interfaces.
Allow only reviewed MCP servers and extensions.
Decide telemetry settings per tool and enforce them centrally where the tool supports it.
Use scoped, owned, rotated model provider keys rather than personal keys in shared environments.
Require human review before agent-authored changes reach protected branches.

Open-Source AI Coding Agents: Licences, Surfaces and Safety Controls Compared