Amazon Q Developer Alternatives: Kiro, Claude Code, Copilot and More

AWS will stop supporting the Amazon Q Developer IDE plugins on 30 April 2027 and points users to Kiro; the Q CLI is already the Kiro CLI. If you want something else, Claude Code on Amazon Bedrock, GitHub Copilot, Codex CLI, Cline, OpenCode and Aider are the main alternatives, and most of them can keep your models on Bedrock.

There is one more option, and moving to it does not mean giving up what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already work in.

Below: what AWS's own docs say about Q and the move to Kiro, a facts-only comparison, and a migration walkthrough with real commands, including what replaces the security reviews Q ran in your IDE.

What Amazon Q Developer is, and what AWS is changing

AWS describes Amazon Q Developer as a generative AI conversational assistant that helps you "understand, build, extend, and operate AWS applications." It is built on Amazon Bedrock. In an IDE it chats about code, gives inline completions, generates new code, reviews code for security issues and runs code upgrades. Outside the IDE you meet it in the AWS Management Console, the AWS documentation site, the AWS Console Mobile Application, and in Microsoft Teams or Slack.

Where it runs. The IDE plugins cover Visual Studio Code, JetBrains IDEs, Visual Studio through the AWS Toolkit, and Eclipse in preview. You sign in to the IDE plugin with an AWS Builder ID, which the docs say needs no AWS account, or as a workforce user through IAM Identity Center. In the console and in chat apps, access comes from IAM permissions on your identity.

Tiers. The pricing page lists a Free tier and a Pro tier. The Free tier includes 50 agentic requests a month for chat and agentic coding in the IDE or CLI, and 1,000 lines of Java upgrade transformation a month per user. Pro raises the agentic limits and adds an admin dashboard for user and policy management, IAM Identity Center support and IP indemnity.

Data handling. AWS says it may use some Free tier content, such as your questions and the code Q generates, for service improvement, and that it does not use content from Amazon Q Developer Pro for that purpose. For IAM Identity Center users on Pro, content for the IDE plugins, the command line and console chat is stored in the Region where your Q Developer profile was created. Free tier content is stored in a US Region.

Code reviews. This is the feature teams miss once it is gone. AWS's docs say Q reviews code for SAST issues, secrets, infrastructure as code problems, code quality, deployment risks and third-party dependencies (software composition analysis). By default it reviews the git diff of the active file. Reviews have quotas: 200 KB for auto reviews and 50 MB of source code for file or project reviews.

What is changing

Three facts from AWS and Kiro documentation matter for planning.

1. The IDE plugins reach end of support on 30 April 2027. The notice says: "For capabilities similar to Amazon Q Developer IDE plugins, explore Kiro." AWS's migration note says inline suggestions, chat and code generation are available in Kiro.
2. The CLI has already moved. The AWS docs page for Q on the command line now reads, in full, "The Q CLI has become the Kiro CLI." Kiro's upgrade guide says the Kiro CLI became available on 17 November 2025 and that Q Developer CLI installs with auto update on were moved to it on 24 November 2025. Existing q and q chat commands still work, and prompts, agents, MCP config and rules from ~/.aws/amazonq are copied to ~/.kiro.
3. The licence changed. Kiro's guide says the Q Developer CLI was licensed under Apache 2.0, and the Kiro CLI is licensed under the AWS Intellectual Property License.

The notice names the IDE plugins only. Q in the console, on the docs site and in chat apps is documented separately, so check each surface you use.

Amazon Q Developer alternatives compared

The tools below are listed with Kiro first, because AWS names it as the path forward, then the commercial tools, then open-source tools whose licence we confirmed on their repository pages. "Where the agent runs" means where the tool executes. Prompts and the files the agent reads still go to whichever model provider you configure.

Kiro

Kiro is AWS's successor for the Q Developer IDE and CLI features. The IDE is built on VS Code, so extensions, themes, keybindings and settings carry over, and JetBrains users can run Kiro inside JetBrains AI Assistant through ACP. Kiro's migration guide says it has no native Visual Studio or Eclipse plugin. Sign-in options are GitHub, Google, AWS Builder ID and IAM Identity Center, and enterprise users can also sign in with Okta or Microsoft Entra ID. Know before adopting: Kiro is a separate subscription with credits per tier, and workspaces are untrusted until you trust them, which means Kiro asks before every shell command and MCP call there.

Claude Code

Claude Code is Anthropic's agentic coding tool for the terminal, VS Code, JetBrains, a desktop app and the web. For AWS shops the relevant fact is that it can run entirely against Amazon Bedrock: run claude, choose 3rd-party platform, then Amazon Bedrock, and a wizard handles credentials, region and model pins. It uses the default AWS SDK credential chain, so an SSO profile from IAM Identity Center works. Know before adopting: the licence file reads "All rights reserved" under Anthropic's Commercial Terms, so it is not open source, and the docs warn to pin model versions before rolling it out to a team.

GitHub Copilot

GitHub lists Copilot plans for individuals plus Business and Enterprise for organizations, with Business offering "centralized management and Copilot policy control." Models come from several providers, and the docs say an administrator must enable a model before users can access it. The cloud agent edits files and runs tests in an ephemeral cloud environment, pushes to a single branch, and cannot approve or merge its own pull request. Know before adopting: workflows on the agent's pull requests do not run until someone with write access reviews them.

Codex CLI

Codex CLI is OpenAI's Apache 2.0 terminal agent that "runs locally on your computer," with an IDE extension, a desktop app and Codex cloud alongside. You sign in with ChatGPT or an API key, and OpenAI's pricing docs say Codex is included in ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise. Know before adopting: the default sandbox has no network access and limits writes to the active workspace, so builds that fetch dependencies need network turned on in your configuration.

Cline

Cline is an Apache 2.0 agent with a VS Code extension, a JetBrains plugin, a desktop app for macOS and Windows, a CLI and an SDK. Its provider list includes AWS Bedrock alongside Anthropic, OpenAI, Google, OpenRouter, local models and any OpenAI-compatible API. Its README says "every file edit and terminal command requires your approval" unless you toggle auto approve. Know before adopting: the README says the JetBrains plugin is not open source.

OpenCode

OpenCode is an MIT-licensed agent with a terminal UI and a beta desktop app. Its provider docs cover Amazon Bedrock with access keys, a named profile, a Bedrock bearer token or EKS IRSA, and you can set a VPC endpoint in opencode.json. Know before adopting: its permission docs say "Most permissions default to allow," so set ask for edits and shell commands before the first run.

Aider

Aider is "AI pair programming in your terminal," licensed under Apache 2.0. It reaches Bedrock through a bedrock/ model prefix once boto3 and your AWS credentials are in place, and aider --list-models bedrock/ lists what is available. Know before adopting: it commits every change to git automatically, so work on a branch.

One tool we left out: Continue's repository now says it "is no longer actively maintained and is read-only for all users." If your team adopted it as a Q companion, plan for that too.

Moving off Amazon Q Developer, step by step

Step 1: Inventory what you use

List every Q surface your team touches. The IDE plugins and the CLI are the ones changing. Also look for scripts that call q or q chat; the Kiro guide says those still work but now run the Kiro CLI.

Step 2: Decide where inference runs

If your security team approved Q because inference stayed inside AWS, you can keep that property. Claude Code, Cline, OpenCode and Aider all document Amazon Bedrock as a provider, and Kiro is an AWS service with data stored in the Region of your Kiro profile.

Check Region rules before you switch. Q Developer Pro kept IDE and CLI content in your profile's Region for Identity Center users. If you move to Bedrock, the region and inference profile prefix you choose decide where requests go. Claude Code's docs, for example, map us-* regions to the us. prefix and eu-* to eu., and you can set ANTHROPIC_BEDROCK_REGION_PREFIX to choose.

Step 3: Set up Bedrock credentials once

Most tools read the standard AWS credential chain. With IAM Identity Center:

aws configure sso
aws sso login --profile dev-bedrock
export AWS_PROFILE=dev-bedrock
export AWS_REGION=us-east-1

Then point your chosen tool at Bedrock:

# Claude Code on Bedrock, pinned so every developer gets the same model
export CLAUDE_CODE_USE_BEDROCK=1
export ANTHROPIC_DEFAULT_SONNET_MODEL='us.anthropic.claude-sonnet-4-6'
claude

# Aider on Bedrock
python -m pip install aider-install
aider-install
aider --list-models bedrock/

# OpenCode: set region and profile in opencode.json, or use AWS_PROFILE
curl -fsSL https://opencode.ai/v2/install | bash
opencode

Enable the Anthropic models in the Bedrock console's model catalog before the first call. Claude Code's docs give an IAM policy built on bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock:ListInferenceProfiles and bedrock:GetInferenceProfile, and suggest a dedicated AWS account for cost tracking.

Step 4: Move your rules and MCP servers

If you are going to Kiro, the CLI installer copies prompts, agents, MCP config and rules from ~/.aws/amazonq to ~/.kiro, and project .amazonq folders are read as before. For any other tool, copy your project rules into the file it reads. Claude Code reads CLAUDE.md and can read an existing AGENTS.md. Re-add each MCP server in the new tool's config and review what each one can reach.

Step 5: Replace the code reviews

Q's IDE reviews covered SAST, secrets, IaC, quality, deployment risk and dependencies. When the plugin goes, decide which of these you still need and where each will run. For dependencies, an SBOM-based scan on every branch is a direct replacement for the SCA part:

git switch -c agent/q-migration
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard scan --dir .

The scan builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. Run it before the agent starts so you have a baseline, then again after it finishes, as our guide to checking coding agent changes explains.

Step 6: Replace Q in CI

If a pipeline calls Q, it needs a new step. Each tool has a headless form:

# Kiro CLI in headless mode uses API key authentication
curl -fsSL https://cli.kiro.dev/install | bash

# Claude Code, non-interactive
git diff main --name-only | claude -p "review these changed files for security issues"

# Codex, read-only and non-interactive
codex exec --sandbox read-only --ask-for-approval never "review this diff"

# A dependency check that does not depend on any agent
safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"

Kiro's permission docs add a useful detail for CI: in headless runs every ask is treated as a deny, so only operations you explicitly allowed can run.

Common mistakes

Assuming the new tool keeps Q's defaults. OpenCode allows most actions, Aider commits automatically, and Cline's auto approve is a toggle someone may have switched on. Set approval modes before the first session.

Forgetting model access in Bedrock. Every Bedrock route fails until the models are enabled in your account. Do it once, centrally, before the rollout.

Leaving model versions unpinned. Claude Code's docs warn that without pinning, aliases resolve to its built-in default for Bedrock, which may not be enabled in your account. Pin versions for a team.

Dropping the security review without noticing. Q's reviews ran in the editor. Nothing replaces them automatically.

Do the work properly with the Safeguard CLI

The Safeguard CLI writes code too, and it starts from your Safeguard data: the vulnerabilities in your dependencies and your scan results. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. You can switch to it outright, or run it after Kiro or any other agent.

Keep the plan you already pay for

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. To connect a model, see the CLI docs or run /model in a session.

The other route runs the opposite way: connect Claude to the Safeguard MCP server and ask about your findings from the chat you already use. This demo connects Claude with OAuth and chooses which Safeguard tools Claude can use:

Click through it at your own pace, or open it full screen.

Install and first session

The CLI is a single static binary with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only.

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows (PowerShell)
irm https://cli.safeguard.sh/install.ps1 | iex

Run safeguard with no arguments to open the interactive terminal. Type /login to sign in through your browser, then /scan . to scan the folder you are in. @ attaches a file from the folder you started in, /resume picks up the last session in that folder, and /model shows or switches the AI model.

Writing and fixing code on your machine

The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. Ask it to "fix the lodash CVE in this repo" and it works from your actual findings, then writes files, edits code and runs commands, with your approval. It also works as a general terminal assistant: the docs give "what's the latest file in ~/Downloads" as an example. Find and read files, edit code and run commands, then ask "how many critical vulns do we have" in the same conversation.

This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding:

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things ask before they act. /permissions sets how often: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. Teams coming from Q's chat panel will find Ask the closest match to reviewing each suggestion before it lands.

Scans and CI with safeguard exec

The scan command takes a folder, a repository URL, a container image or an SBOM file, and safeguard validate checks CycloneDX, SPDX and VEX documents. safeguard exec runs one non-interactive assistant turn, which is how you put the assistant in a pipeline:

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom bom.json
safeguard exec "summarise the critical findings in this repository"

Policies and gates are evaluated in the Safeguard platform, not by the CLI. When the local runner handles platform scan jobs, your source code never leaves your machine; only SBOMs and findings are uploaded. The platform adds reachability analysis and autonomous remediation with fix pull requests, which is off by default. For a longer tour, read the Safeguard CLI as a security-aware coding assistant.

One platform on every surface

Q spread across the IDE, the console, chat apps and a phone app. Safeguard does too, and the download page lists each surface. Start in the terminal with the CLI, which also runs in CI/CD. Continue in the desktop app for Windows, macOS and Linux and ask your supply chain anything in plain English. Check findings on your phone with the iOS or Android app. In your editor, use the VS Code, JetBrains or Open VSX extension; in Chrome, the browser extension. To install nothing, use the web interface, the Cloud CLI on Safeguard's infrastructure, or the cloud sandbox: an isolated tenant against a seeded demo repo, free for seven days with no card.

FAQ

Is Amazon Q Developer being discontinued?

AWS says it will discontinue support for the Amazon Q Developer IDE plugins on 30 April 2027 and points to Kiro. The Q CLI has already become the Kiro CLI. The end of support notice names the IDE plugins, so check AWS's pages for the console and chat app surfaces you use.

Is Kiro the same as Amazon Q Developer?

No. Kiro is a separate product with its own subscription, its own IDE built on VS Code, and a CLI under the AWS Intellectual Property License. AWS's note says the inline suggestions, chat and code generation you used in Q are available in Kiro.

Can I keep inference inside AWS with a non-AWS tool?

Yes, if the tool supports Amazon Bedrock. Claude Code, Cline, OpenCode and Aider all document Bedrock as a provider, using your AWS credentials and the region you choose.

What replaces Q's security reviews in the IDE?

Nothing replaces them automatically. Q reviewed SAST, secrets, IaC, quality, deployment risk and dependencies. Pick a tool for each part you still need. For dependencies, safeguard scan --dir . builds an SBOM and matches it against vulnerability databases on your machine.

If I switch to Safeguard, do I lose my Claude, ChatGPT or Codex plan?

No. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Does the Safeguard CLI replace Kiro or Copilot?

It is not a feature-for-feature replacement for any tool here. It writes and fixes code with an assistant that knows your findings, and it scans what any agent changed. You can switch to it, or keep your agent and add it before merge.

Does my source code leave my machine?

With any coding agent, prompts and the files it reads go to the model provider you configure, which might be Bedrock in your own account. With Safeguard scans, results go to the platform, and when the local runner handles platform scan jobs only SBOMs and findings are uploaded.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Moving off Q is a good moment to put a check in front of every merge. Download Safeguard, connect the Claude, ChatGPT or Codex plan you already have, and read the CLI docs. Still choosing an agent? See our Claude Code alternatives and OpenAI Codex alternatives.

Quick check

Sources

• AWS: What is Amazon Q Developer?
• AWS: Amazon Q Developer IDE plugins end of support
• AWS: Using Amazon Q Developer on the command line
• AWS: Amazon Q Developer pricing
• AWS: Amazon Q Developer service improvement
• AWS: Data storage in Amazon Q Developer
• AWS: Reviewing code with Amazon Q Developer
• AWS: Amazon Q Developer Pro subscriptions
• Kiro: Migrating from Amazon Q Developer
• Kiro: Migrating from Q Developer CLI
• Kiro: CLI
• Kiro: Permissions
• Kiro: Enterprise concepts
• Claude Code docs: Overview
• Claude Code docs: Amazon Bedrock
• Claude Code licence
• GitHub Docs: Copilot plans
• GitHub Docs: Copilot cloud agent risks and mitigations
• GitHub Docs: Supported AI models in Copilot
• OpenAI Codex repository
• Codex docs: Pricing and plans
• Codex docs: Agent approvals and security
• Cline repository
• OpenCode repository
• OpenCode docs: Providers
• OpenCode docs: Permissions
• Aider repository
• Aider docs: Amazon Bedrock
• Continue repository
• Safeguard download page
• Safeguard CLI docs
• Safeguard CLI docs: Interactive terminal

Last reviewed: 21 October 2026.