AI Coding Agents Compared: Claude Code, Codex, Cursor, Copilot and More

AI coding agents differ less in what they can write than in how they run. Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot, OpenCode, Aider, Cline and Goose vary on licence, sign-in, where code executes, approval defaults, MCP support and admin controls. Pick on those facts, then scan whatever any agent changed before you merge.

If you want to switch, Safeguard is an alternative that keeps what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. Either way you get an assistant that knows your vulnerabilities, works on files and commands on your machine with your approval, and checks what any other agent changed before merge.

This guide compares the nine using only each vendor's or project's own docs, then gives a checklist, a decision guide and common mistakes. There are no rankings, and every fact links to a page we read on 21 October 2026.

The nine tools at a glance

Where we could not find something in a vendor's docs, we say so; that is not proof the feature is missing.

Interface, licence, models and sign-in

Where code runs, approvals, MCP and admin controls

Notes on each tool

Claude Code. Anthropic describes it as "an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools." Permission modes include Manual (the default), acceptEdits, plan, auto, dontAsk and bypassPermissions. Before adopting it, note that the OS-level Bash sandbox (Seatbelt on macOS, bubblewrap on Linux and WSL2) is off until you run /sandbox or enable it in settings.

Codex. The CLI is "a coding agent from OpenAI that runs locally on your computer." Sandbox modes are read-only, workspace-write and danger-full-access, and protected paths such as .git and .codex stay read-only inside a writable workspace. Know that the docs recommend read-only for folders that are not under version control.

Gemini CLI. Google's README calls it "an open-source AI agent that brings the power of Gemini directly into your terminal." Approval modes are default, auto_edit, plan and yolo, and YOLO can only be turned on from the command line. Before adopting it, read the notice at the top of the README: for unpaid tier and Google One users, Gemini CLI was replaced by Antigravity CLI on 18 June 2026.

Cursor. Cursor's cloud agents clone your repo into isolated VMs. Run modes are Auto-review, Allowlist and Run Everything. Its own docs say "Auto-review is not a security boundary," so treat the sandbox and your allowlist as the real controls.

GitHub Copilot. The cloud agent opens draft pull requests on GitHub. It can push to only one branch, cannot approve or merge its own pull requests, and workflows do not run until its code is reviewed. Note that --allow-all-tools in the CLI gives Copilot the same file and shell access you have.

OpenCode. OpenCode describes itself as "the open source AI coding agent" and is MIT licensed. Its default build agent has full access, and the plan agent is read only. Its providers page says plugins exist to use Claude Pro or Max models with OpenCode and that "Anthropic explicitly prohibits this," and OpenCode stopped bundling those plugins in version 1.3.0. Set permissions on purpose, since most default to allow.

Aider. Aider is "AI Pair Programming in Your Terminal," Apache 2.0, and works with almost any LLM, including local ones. It commits each change to git with a generated message, and /undo discards the last one. Before standardising on it, check activity: its latest tagged GitHub release is v0.86.0 from August 2025, and the repository was last pushed in May 2026.

Cline. The CLI installs with npm i -g cline. In Act mode "every file edit and terminal command requires your approval" unless you turn on auto-approve. The JetBrains plugin is not open source, so check which build your team installs.

Goose. Goose is "a general-purpose AI agent that runs on your machine," Apache 2.0, and part of the Agentic AI Foundation at the Linux Foundation. It connects to tools through MCP extensions. Its docs say Completely Autonomous mode, where it can change and delete files without asking, "is applied by default," so pick Manual or Smart Approval before pointing it at real code.

A checklist for security-conscious teams

Answer these from the vendor's docs or your own test before a pilot.

1. Where does the model see code? Local agents still send prompts and file contents to a model provider unless you use a local model.
2. What is the approval default? Write down the default for edits, shell commands and network access. Defaults ranged from asking before everything to fully autonomous in the nine tools above.
3. Is there an OS-level sandbox, and is it on? Claude Code, Gemini CLI, Codex and Cursor document one. Two of them leave it off until you enable it.
4. Can an admin lock the settings? Look for a managed or system settings file that users cannot override, and a way to disable the most permissive mode.
5. Can you restrict sign-in? Claude Code can require logins from your organisation. Cursor and Copilot document SSO and audit logs on business plans.
6. How are MCP servers trusted? Gemini CLI marks servers untrusted by default. Copilot's cloud agent uses allowlisted MCP tools without asking, so its docs recommend read-only tools.
7. How does work reach the main branch? A draft pull request with required review is easier to audit than direct commits.
8. What checks the dependencies an agent adds? None of these agents document vulnerability matching for the packages they install. That is a separate step, covered below.
9. Is the project maintained? For open-source tools, check the last release date and the last push before you depend on it.

Choosing by team size and risk

This is a guide to fit, not a ranking. Each row points at documented behaviour that matches a situation.

Risk depends more on the mode you pick than the tool: any of these in its most permissive mode can run any command you can.

Do the work properly with the Safeguard CLI

Every agent above writes code. Safeguard is the alternative you can switch to when you also want the assistant to know your vulnerabilities, and you keep the Claude, ChatGPT or Codex you already pay for. The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan.

Install

macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

Windows:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, so you do not need Node, Python or a JVM. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only).

First session

1. Open a terminal in your project and run safeguard with no arguments.
2. Type /login to sign in through the browser.
3. Type /scan . to scan the current folder.
4. Ask in plain language, for example "how many critical vulns do we have".
5. Use @ to attach a file and /resume to continue the last session in that folder.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. You can ask "fix the lodash CVE in this repo" and it will edit the code with your approval. You can also use it as a general terminal assistant: find and read files, edit code and run commands on your machine, with your approval, plus everything security. The docs give "what's the latest file in ~/Downloads" as an example.

This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, then reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding.

Click through it at your own pace, or open it full screen.

Keep the Claude, ChatGPT or Codex you already pay for

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Use /model to see or switch the model, and the CLI docs for connecting one.

You can also stay in the chat you already use. Connect Claude or ChatGPT to the Safeguard MCP server and ask about your findings from there. This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use.

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things, such as writing a file, editing code or running a command, ask before they act. /permissions sets the mode:

• Ask prompts before every action.
• Auto approves known actions and asks for anything new. This is the default.
• Yolo approves everything.

Ask suits fixing another agent's code, since you see every edit.

Checking what another agent changed

Use the CLI as the before and after check for any agent in this guide:

safeguard scan --dir .
cp output/vuln.json vuln-before.json
# run your Claude Code, Codex, Cursor or other agent session here
safeguard scan --dir .
diff vuln-before.json output/vuln.json

Anything new came from the session; ask the assistant to fix it. The same scan works on a repository, an image or an SBOM:

safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:latest
safeguard scan --sbom sbom.cdx.json
safeguard validate sbom.cdx.json

Results land as JSON files under ./output, including vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. When the local runner handles platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.

CI with safeguard exec

For pipelines, run one non-interactive assistant turn:

safeguard exec "summarise the critical findings in this repository"

Pass or fail decisions belong to policies and gates, which are evaluated in the Safeguard platform, not by the CLI. The platform also offers reachability analysis and autonomous remediation with fix pull requests, which is off by default. For a longer walkthrough, read how to check what a coding agent changed and our overview of the Safeguard CLI as a security-aware coding assistant.

One platform on every surface

The CLI is one way in. The download page lists the same platform on every surface, so you can start in the terminal, continue on the desktop and check findings on your phone:

• CLI: one static binary for macOS, Linux and Windows, for the terminal and CI/CD.
• Desktop app for Windows, macOS and Linux (version 3.2.2 on the page), where you ask your supply chain anything in plain English in a native window.
• Mobile apps for iOS on the App Store and Android on Google Play.
• IDE extensions for VS Code, JetBrains and Open VSX editors, and a browser extension for Chrome and the other browsers the page lists.
• Cloud options with nothing to install: the Cloud CLI, which runs the CLI on Safeguard's infrastructure, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.

Common mistakes

Comparing demos instead of defaults. Two agents can produce the same diff while one asked before every command and the other asked before none. Record the approval default during the trial.

Assuming a sandbox is on. Claude Code's Bash sandbox is off by default, and Gemini CLI's is opt-in. Turn it on, then test that a write outside the project fails.

Plugging a subscription into a tool the provider has not approved. OpenCode's docs say Anthropic prohibits using Claude Pro or Max plans through third-party plugins. Read the provider's terms before connecting any plan to any tool.

Running autonomous modes on a laptop with real credentials. Claude Code's docs point bypass mode at containers or VMs. Use an isolated environment for that work.

Reviewing the diff but not the dependencies. A line-by-line review does not show that a new package version has a known CVE. Scan before and after.

Picking an abandoned project. Check release dates for open-source agents before you write team guidance around one.

FAQ

Which of these AI coding agents are open source?

From the licence files we checked: Codex CLI, Gemini CLI, Aider, Cline and Goose are Apache 2.0, and OpenCode is MIT. Claude Code's repository licence reserves all rights, Copilot CLI's licence does not allow modification, and Cursor's public repository does not contain its source. Cline's JetBrains plugin is not open source.

Do these agents send my code to the cloud?

Local agents run on your machine but send prompts and relevant file contents to the model provider you configure, unless you use a local model. Cloud agents such as Codex Cloud, Cursor cloud agents, Copilot cloud agent and Claude Code on the web also work on a copy of your repository in the vendor's environment.

Can I switch to Safeguard and keep my Claude, ChatGPT or Codex?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Which agents ask before running commands by default?

Claude Code in Manual mode, Gemini CLI in default mode, Cline in Act mode and Copilot CLI all ask before commands by default. Codex's Auto preset runs commands inside the workspace sandbox and asks before leaving it. Cursor's recommended default uses a sandbox and a classifier. OpenCode and Goose default to allowing most actions.

Does the Safeguard CLI replace Claude Code, Codex or Cursor?

It is not a feature-for-feature copy of any of them. You can switch to it to write and fix code on your machine with an assistant that knows your vulnerabilities, or keep another agent and use Safeguard to scan what it changed before merge.

Can the Safeguard CLI run without asking me?

It has a Yolo mode that approves everything, but the default is Auto, which asks for anything new, and Ask prompts before every action. Choose with /permissions.

Does my source code leave my machine with the Safeguard CLI?

When the local runner handles platform scan jobs, your code stays on the machine and only SBOMs and findings are uploaded.

Try it yourself

This demo sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

To install the CLI, go to safeguard.sh/download, then read the CLI docs. If you are weighing open-source agents, see our guides to OpenCode alternatives and T3 Code alternatives.

Quick check

Sources

• Safeguard CLI documentation
• Safeguard CLI interactive terminal
• Safeguard download page
• Claude Code overview
• Claude Code authentication
• Claude Code permissions
• Claude Code sandboxing
• Claude Code licence file
• Codex docs
• Codex agent approvals and security
• Codex pricing and plans
• Codex MCP
• Codex repository
• Gemini CLI repository
• Gemini CLI sandbox
• Gemini CLI configuration
• Gemini CLI MCP servers
• Cursor docs
• Cursor run modes
• Cursor CLI overview
• Cursor CLI authentication
• Cursor cloud agents
• Cursor MCP
• Cursor enterprise
• Cursor privacy
• Cursor public GitHub repository
• About GitHub Copilot CLI
• About Copilot cloud agent
• Copilot cloud agent risks and mitigations
• Copilot cloud agent and MCP
• GitHub Copilot plans
• GitHub Copilot CLI licence
• OpenCode repository
• OpenCode providers
• OpenCode permissions
• OpenCode MCP servers
• Aider repository
• Aider git integration
• Aider supported LLMs
• Cline repository
• Goose repository
• Goose permission modes

Last reviewed: 21 October 2026.