Coding Agents That Run Locally: What Local Really Means

Most coding agents run on your own machine, but "local" usually describes only the agent process. Your prompts, the code it reads and the model's answers still travel to a hosted model unless you also run the model locally. Before you trust the label, check where the agent runs, where the model runs, what it uploads and what it stores.

If you want an assistant on your machine without starting over, you can switch to Safeguard and keep what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. And when the CLI's local runner runs scan jobs, your source code stays on your machine; only SBOMs and findings are uploaded.

Every third-party fact below comes from the vendor's own docs or repository, linked at the end. No rankings, no "most private" claims.

What "local" means: five questions to ask any agent

"Runs locally" can mean very different things. These five questions separate them.

1. Where does the agent process run?

This is what most tools mean by local. Anthropic's data usage page says it directly: "Claude Code runs locally." OpenAI describes Codex CLI as "a coding agent from OpenAI that runs locally on your computer." goose is "a general-purpose AI agent that runs on your machine." The agent reads files, edits them and runs commands on your hardware.

Some of the same products also have cloud modes. Anthropic's docs say Claude Code cloud sessions "run in Anthropic-managed virtual machines by default instead of locally." OpenAI's approvals page describes cloud tasks running "in isolated OpenAI-managed containers." Kilo Code has a web-based Cloud Agent. Know which mode you are in.

2. Where does the model run?

This is the part that decides where your code goes. Anthropic's page is explicit: "To interact with the LLM, Claude Code sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+." OpenAI's approvals page warns that "Prompts can include source code and sensitive data."

A model runs on your hardware only if you run it there, typically with a local model server. Ollama's FAQ says: "Ollama runs locally. We don't see your prompts or data when you run locally." LM Studio's offline page says: "Nothing you enter into LM Studio when chatting with LLMs leaves your device."

3. What does the vendor keep, and for how long?

For hosted models, retention depends on your account type. Anthropic's data usage page gives these for Claude Code:

• Consumer (Free, Pro, Max): 30 days if you do not allow data use for model improvement, five years if you do.
• Commercial (Team, Enterprise, API): 30 days as standard, with zero data retention available to qualified Claude for Enterprise accounts.
• Training: for commercial users, "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms," unless the customer opts in to a program such as the Development Partner Program.

Gemini CLI's terms page maps each sign-in method to a different set of terms: Google account, Code Assist Standard or Enterprise, paid or unpaid Gemini API key, or Vertex AI. Ollama's cloud docs say of cloud prompts: "We do not use them to train models."

4. What else leaves the machine?

Telemetry and feedback are separate from model traffic:

• Claude Code sends usage metrics that "never include your code, prompts, or file paths," and error reports with known secret patterns redacted. DISABLE_TELEMETRY=1, DISABLE_ERROR_REPORTING=1 or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC turn these off. /feedback, /bug and /share send a copy of your conversation, including code, to Anthropic.
• Codex CLI telemetry through OpenTelemetry is off by default: "enable it explicitly in your configuration."
• Aider collects analytics only if you opt in, and says it "never collects your code, chat messages, keys or personal info."
• Cline telemetry "doesn't include your code, file contents or prompts, except for requests to the Cline and ClinePass providers," and Cline still contacts its servers to sign you in and check feature flags with telemetry off.
• Gemini CLI sends usage statistics under Google's Privacy Policy, with an opt-out in its configuration.

5. What stays on your disk?

Local also means local copies. Claude Code stores session transcripts "locally in plaintext under ~/.claude/projects/" for 30 days by default, adjustable with cleanupPeriodDays. OpenCode saves keys added with /connect to ~/.local/share/opencode/auth.json. Codex keeps settings in ~/.codex/config.toml. Ollama stores models under ~/.ollama/models on macOS. Your disk encryption and backup policy now cover these files.

Coding agents that run locally, tool by tool

Each entry answers the five questions as far as the vendor's own pages do.

Claude Code

Claude Code runs in your terminal, IDE, desktop app or browser. The CLI process runs locally and sends prompts and outputs to Claude through Anthropic's API, or through Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry if you configure those. Anthropic notes that for Foundry deployments hosted on Azure, "prompts and completions remain within Azure," with only usage metadata and content flagged by its safety systems going to Anthropic. Claude Code is not open source; its repository licence reads "All rights reserved."

OpenAI Codex CLI

Codex CLI runs locally under an operating-system sandbox. OpenAI's approvals page says the CLI and IDE extension default to "no network access and write permissions limited to the active workspace." By default it talks to OpenAI models through your ChatGPT plan or an API key. It also has an OSS mode: "Codex can run against a local 'open source' provider such as Ollama or LM Studio when you pass --oss." The repository is Apache-2.0.

Gemini CLI

Gemini CLI is an Apache 2.0 terminal agent that sends requests to Gemini through a Google account, a Gemini API key or Vertex AI. It offers optional sandboxing: macOS Seatbelt, Docker or Podman containers, gVisor and LXC, turned on with -s or --sandbox. The pages we checked do not describe a local model option. The repository notes that for unpaid tier and Google One users it "was replaced by Antigravity CLI on June 18th, 2026."

OpenCode

OpenCode is an MIT-licensed terminal and desktop agent that supports "75+ LLM providers" and local models. Its providers page documents Ollama at http://localhost:11434/v1, LM Studio at http://127.0.0.1:1234/v1 and llama.cpp's server at http://127.0.0.1:8080/v1. If tool calls fail on Ollama, the docs suggest raising num_ctx to around 16k to 32k.

Aider

Aider is an Apache-2.0 terminal pair programmer that "can connect to almost any LLM, including local models." Its Ollama page uses aider --model ollama_chat/your-model with OLLAMA_API_BASE pointing at your local server. It commits each change to git, so the record of what the agent did lives in your repository.

Cline

Cline runs in VS Code, JetBrains, a CLI and a desktop app, under Apache 2.0 (its JetBrains plugins are not open source). For local models it lists Ollama and LM Studio: "Run local models on your machine." By default every file edit and terminal command needs your approval.

goose

goose is an Apache-2.0 desktop app, CLI and API that works with 15+ providers, Ollama among them. Its permission docs say "Autonomous Mode is applied by default," so a local goose session can modify and delete files without asking unless you switch to Manual or Smart Approval.

OpenHands

OpenHands Agent Canvas is MIT licensed and self-hosted. With no sandbox, its README warns "the agent will have full access to your filesystem." Docker modes isolate execution, and OH_CONVERSATION_RUNTIME=docker gives each conversation its own container. Agents can also run on OpenHands Cloud.

Comparison table

Facts only. "Local model" means the vendor's own docs describe connecting to a model server on your machine.

Building a fully local setup, step by step

If the goal is that prompts and code never leave your hardware, both the agent and the model must be local. Here is a path using commands from the vendors' own docs.

Step 1: run a local model server and keep it private

With Ollama installed, pull a model and start the server with a larger context window:

ollama pull your-model
OLLAMA_CONTEXT_LENGTH=32768 ollama serve

Ollama "binds 127.0.0.1 port 11434 by default," which keeps it off your network. Leave OLLAMA_HOST alone unless you mean to share it.

Step 2: turn off cloud models

Ollama also offers cloud models, which run "in Ollama's cloud." To make sure nothing routes there, the FAQ gives two switches:

export OLLAMA_NO_CLOUD=1
# or in ~/.ollama/server.json
# { "disable_ollama_cloud": true }

Restart Ollama afterwards. The FAQ says the log will show Ollama cloud disabled: true.

If you use LM Studio instead, its docs say it "can operate entirely offline, just make sure to get some model files first." Searching and downloading models still need the internet.

Step 3: point the agent at the local server

# Codex CLI, one run
codex --oss --local-provider ollama

# Codex CLI, as a default in ~/.codex/config.toml
# oss_provider = "ollama"

# Aider
export OLLAMA_API_BASE=http://127.0.0.1:11434
aider --model ollama_chat/your-model

For OpenCode, add a provider in opencode.json using @ai-sdk/openai-compatible with baseURL set to http://localhost:11434/v1. For Cline, choose Ollama or LM Studio as the provider in its settings.

One CI detail from OpenAI's docs: if neither --local-provider nor oss_provider is set, "the interactive CLI prompts you to choose; codex exec exits with an error." Set it explicitly in pipelines.

Step 4: switch off the extras

Opt out of telemetry the tool offers: aider --analytics-disable, DISABLE_TELEMETRY=1 for Claude Code, the "Allow error and usage reporting" toggle in Cline. Avoid feedback commands that upload transcripts.

Step 5: set approvals before the first prompt

A local agent with full access is still full access. Use OpenCode's plan agent, goose's /mode approve, Codex's read-only sandbox or Cline's default prompts while you build trust.

Step 6: scan what changed

A local model does not make a dependency it adds any safer. Scan before and after:

safeguard scan --dir .

The results land as JSON under ./output, including vuln.json. Our guide to checking what a coding agent changed shows how to compare runs.

Common mistakes with "local" agents

• Reading "runs locally" as "nothing leaves." For Claude Code, Anthropic says prompts and model outputs go over the network. The same is true of any agent using a hosted model.
• Picking a cloud model by accident. In Ollama, the :cloud tag (for example gemma4:cloud) runs the model in Ollama's cloud. Ollama's Codex page even lists gpt-oss:120b-cloud next to local examples. Set OLLAMA_NO_CLOUD=1 if that must never happen.
• Exposing the model server. Setting OLLAMA_HOST to 0.0.0.0:11434 puts it on your network. Do that only on purpose.
• Starving the context window. Ollama's FAQ gives a default of 4096 tokens, and Aider's docs warn Ollama "silently discards context that exceeds the window." Ollama's Codex page asks for at least 64k tokens.
• Forgetting local transcripts. Claude Code keeps plaintext transcripts under ~/.claude/projects/ for 30 days by default, and OpenCode stores keys in auth.json. Treat them like any file with secrets in it.
• Sending feedback with code in it. Claude Code's /feedback, /bug and /share send your conversation, including code, to Anthropic.
• Assuming a consumer plan behaves like a commercial one. Claude Free, Pro and Max accounts follow a model-improvement setting; commercial terms do not train on Claude Code prompts by default.
• Trusting autonomy because the box is yours. goose applies Autonomous Mode by default, and OpenHands without a sandbox has full filesystem access.

Keep source on your machine with the Safeguard CLI

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the Safeguard platform, and includes an assistant that writes code and fixes what it finds. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.

Switching does not mean dropping what you pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Or connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

Install

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows PowerShell
irm https://cli.safeguard.sh/install.ps1 | iex

A single static binary, no Node, Python or JVM. macOS, Linux and Windows, on x86_64 or arm64 (Windows x86_64 only).

First session

Run safeguard with no arguments to open the interactive terminal. /login signs in through the browser and /scan . scans the folder you are in. Then ask in plain language, for example "how many critical vulns do we have" or "fix the lodash CVE in this repo." @ attaches a file from the folder you started in, and /resume picks up the last session there.

Working on your own machine

The assistant has tools for your local files and for your Safeguard data, and picks whichever the question needs. The docs' examples include "what's the latest file in ~/Downloads" next to the security questions. It can write files, edit code and run commands, with your approval, so it doubles as a general terminal assistant that also knows your vulnerabilities.

This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding.

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks about anything new (the default), and Yolo approves everything. Start with Ask on code you care about.

Choosing the model

/model shows or switches the AI model; see the CLI docs for connecting your Claude, ChatGPT or Codex plan. Apply the same five questions to whichever model you pick.

In the Safeguard platform you also choose the model per conversation. This demo shows Zero z20, which answers with no language model at all by turning the question into a platform query; Griffin, Eagle and Lion, which are Safeguard's models; a tenant admin choosing which model families people may use; and bringing your own model on your own provider account, routing jobs such as chat or summaries to it.

Click through it at your own pace, or open it full screen.

Scans and CI

safeguard scan --dir ., --repo, --image or --sbom builds an SBOM and matches it against vulnerability databases, writing vuln.json, license.json and other files under ./output. safeguard validate checks CycloneDX, SPDX and VEX documents. For pipelines:

safeguard exec "summarise the critical findings in this repository"

That runs one non-interactive assistant turn. Policies and gates are evaluated in the platform, which also offers reachability analysis and autonomous remediation with fix PRs (off by default).

Every surface

Start in the terminal, continue in the desktop app (3.2.2 for Windows, macOS and Linux) to ask your supply chain anything in plain English, and check findings on your iPhone, iPad or Android phone. There are IDE extensions for VS Code, JetBrains and Open VSX, and a browser extension. If you would rather install nothing, the cloud sandbox gives you a tenant against a seeded demo repo, free for seven days with no card. More in our post on the Safeguard CLI as an AI assistant on your machine.

Download Safeguard and run /scan . in the repository you work in today.

FAQ

Do local coding agents send my code to the cloud?

Usually, yes, to the model provider. Anthropic says Claude Code sends "all user prompts and model outputs" over the network to the LLM. Only when the model also runs on your hardware, through Ollama, LM Studio or similar, do prompts stay local.

Which coding agents can use a local model?

From their own docs: Codex CLI (--oss with Ollama or LM Studio), OpenCode (Ollama, LM Studio, llama.cpp), Aider (Ollama), Cline (Ollama, LM Studio), goose (Ollama) and Qwen Code (Ollama, vLLM).

Does Ollama see my prompts?

Not for local models. Its FAQ says: "We don't see your prompts or data when you run locally." Cloud models are different; they run in Ollama's cloud.

Can I switch to Safeguard and keep my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server.

Does the Safeguard CLI upload my source code?

When the local runner runs platform scan jobs, no: source code never leaves the machine, and only SBOMs and findings are uploaded. Scans run on your machine and send only results to the platform.

Is Claude Code local?

The process is. Anthropic's docs say "Claude Code runs locally" and that it sends prompts and model outputs over the network to the LLM. Cloud sessions run in Anthropic-managed VMs.

What is the safest approval setting for a local agent?

The most restrictive one each tool offers while you evaluate it: Claude Code's Manual mode, Codex read-only, OpenCode plan, goose Manual Approval, or Safeguard Ask.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Claude Code data usage, Anthropic docs
• Claude Code overview, Anthropic docs
• Claude Code permission modes, Anthropic docs
• Claude Code LICENSE.md
• OpenAI Codex repository
• Codex agent approvals and security
• Codex advanced config, OSS mode
• Codex config basics
• Gemini CLI repository
• Gemini CLI sandboxing
• Gemini CLI terms and privacy
• OpenCode providers docs
• Aider repository
• Aider with Ollama
• Aider analytics
• Cline repository
• Cline telemetry
• goose repository
• goose permission modes
• Qwen Code repository
• Kilo Code repository
• OpenHands repository
• Ollama FAQ
• Ollama cloud models
• Ollama integration docs for Codex
• LM Studio offline operation
• Safeguard download page
• Safeguard CLI docs
• Safeguard CLI interactive terminal docs

Last reviewed: 21 October 2026.