Open-Source Alternatives to OpenCode in 2026

If you want an open-source terminal coding agent other than OpenCode, six maintained options with permissive licences are Aider, Goose, OpenAI Codex CLI, Gemini CLI, Cline CLI and Qwen Code. They differ in model support, approval defaults and where your keys live. Whichever you choose, scan what it changed before you merge.

This guide compares the six on facts from each project's own repository and docs, walks through a switch with real commands, and then covers the Safeguard CLI, which can write and fix code with your vulnerability findings in view, and which lets you bring the Claude or ChatGPT plan you already pay for.

What OpenCode is and why teams look elsewhere

OpenCode is an MIT-licensed AI coding agent. It runs as a terminal UI, and there is a beta desktop app for macOS, Windows and Linux. It ships with a full-access "build" agent for day-to-day work, a read-only "plan" agent for exploring a codebase, and a "general" subagent for multistep searches. Its provider docs say it supports more than 75 LLM providers plus local models through Ollama, llama.cpp and LM Studio.

Two things have pushed some teams to look around this month.

The first is the Console incident. On 17 October OpenCode told a subset of Console users that third-party provider keys saved in their hosted workspaces may have been exposed. We covered what OpenCode has said, and how to rotate each key, in OpenCode Console breach: rotate your provider API keys.

The second is defaults. OpenCode's permission docs say most permissions default to "allow". Unless you change the config, edits, shell commands and URL fetches run without a prompt. Only a few actions, such as working outside the project folder, ask first.

Neither point is a reason on its own to leave. OpenCode is actively developed. But both are good reasons to compare what else exists, and to set defaults on purpose rather than by accident.

Open-source OpenCode alternatives compared

Every tool below has a licence we confirmed on its repository page. We list them alphabetically. The table is a quick reference; the notes underneath add one thing to know before you adopt each tool.

"Where the agent runs" means where the tool executes. In every case your prompts and the file contents the agent reads go to whichever model provider you configure, unless you point it at a local model.

Aider

Aider is a Python tool for AI pair programming in your terminal, licensed under Apache 2.0. You start it inside a project folder with a model and key, and it builds a map of your codebase so it can work in larger repositories. It connects to most hosted LLMs and to local models. Know before adopting: Aider commits every edit to git with a generated message and, by default, skips your pre-commit hooks. The last push to its main repository was in May 2026, so check recent activity against your needs.

Cline CLI

Cline is an Apache 2.0 coding agent that ships as a VS Code and JetBrains extension, a desktop app, an SDK and a CLI installed from npm. The CLI runs interactively, or headless when you pipe input, ask for JSON or redirect output, which makes it easy to script. It supports a long list of providers and any OpenAI-compatible API. Know before adopting: the CLI docs say tool auto-approval defaults to true, and that there is no allow or deny list for shell commands, so use a clean branch and review what it did.

Codex CLI

Codex CLI is OpenAI's coding agent that runs locally in your terminal, licensed under Apache 2.0. You sign in with a ChatGPT plan or set up an API key, and the same agent is available in VS Code, a desktop app and on the web. Its docs describe two layers: a sandbox mode that sets what it can do, and an approval policy that sets when it must ask. Know before adopting: it is built around OpenAI models and accounts, so it suits teams already on OpenAI more than teams that need many providers.

Gemini CLI

Gemini CLI is Google's Apache 2.0 terminal agent, installed from npm, Homebrew or MacPorts. You can sign in with a Google account, use a Gemini API key, or route through Vertex AI, and it can call MCP servers you add to its settings file. Know before adopting: the README says that for unpaid tier and Google One users it was replaced by Antigravity CLI on 18 June 2026, and that it has not been optimised for Gemini 4 Argon.

Goose

Goose is an Apache 2.0 agent with a native desktop app and a full CLI for macOS, Linux and Windows. It is part of the Agentic AI Foundation at the Linux Foundation and is built as a general-purpose agent, not only a coding tool. It connects to more than 15 providers and to MCP extensions. Know before adopting: its docs say Autonomous mode is applied by default, which lets it modify, create and delete files without asking, and each extension you add is more third-party code acting on your machine.

Qwen Code

Qwen Code is an Apache 2.0 terminal agent from the Qwen team. Its README says it began as a fork of Gemini CLI v0.8.2 and has been developed independently since its own v0.1. It supports OpenAI, Anthropic, Gemini and Qwen APIs, other third-party providers and local models, and you can switch provider mid-session. Know before adopting: the npm package needs Node.js 22 or later, and you set your provider inside a session with the auth command.

Two we left out

Crush by Charm is source available under the Functional Source License 1.1. It only converts to MIT two years after each release and restricts competing use until then, so we did not count it as open source. The OpenHands CLI is MIT licensed, but its README now says it is no longer actively maintained and points to a different project.

What to check before you switch

Check four things before a new agent touches a real repository.

Licence

Read the LICENSE file in the repository, not a summary. Apache 2.0 and MIT let you use, modify and redistribute the tool. Source-available licences such as FSL restrict some uses until they convert.

Model providers and accounts

Some agents tie you to one vendor account. Codex CLI is built for OpenAI. Gemini CLI is built for Gemini. Others, such as Cline, Goose, Qwen Code and Aider, accept many providers, OpenAI-compatible endpoints or local models. If your policy keeps certain code away from third-party APIs, a tool that can point at a local model may be the deciding factor.

Where code and keys go

Every agent sends prompts and file contents to the model you choose. The question to ask is where your API keys live. They might sit in an environment variable, in a local file, or in a hosted dashboard. OpenCode stores keys you add with its connect command in an auth.json file under your home folder. The Console incident involved keys saved in a hosted workspace instead.

Approval prompts

Look up the default, then set your own. From the docs we read:

• OpenCode allows most actions without a prompt.
• Goose runs in Autonomous mode by default.
• The Cline CLI auto-approves tools by default.
• Codex CLI allows writes inside the workspace, keeps network off and asks before anything outside it. Even in that mode it keeps .git, .codex and .aws read-only.
• Gemini CLI uses a "default" approval mode, and full auto-approval can only be switched on from the command line.

Approval prompts tell you what the agent wants to run. They do not tell you whether the result is safe. An approved command can still add a dependency with a known critical CVE.

Common mistakes when switching

Leaving old keys live. You uninstall the old agent but the keys it used still work. Rotate any key that was saved in a hosted console, and delete local credential files you no longer need.

Trusting a default you never read. Several tools above act without asking out of the box. Decide on a mode for laptops and a stricter one for CI, and write both down.

Letting the agent work on main. Cline's own docs recommend a clean branch for autonomous runs. That advice applies to every tool here.

Skipping hooks without noticing. Aider skips pre-commit hooks by default. If your hooks run linters or checks, turn on the option that runs them.

Assuming review covers dependencies. A human reading a diff sees one changed line in a lockfile and moves on. Scan the result instead of relying on a glance.

Setup walkthrough and worked examples

This walkthrough moves from OpenCode to another agent and adds a scan step that works with any of them.

Step 1: Inventory and rotate keys

List every provider key you have used with OpenCode, locally and in Console. If any were saved in a Console workspace, follow the rotation steps in our OpenCode Console breach guide. Issue new keys for the new tool rather than reusing old ones.

Step 2: Install the new agent

Use the install method from the project's own README. These are the commands we confirmed:

# Aider
python -m pip install aider-install
aider-install

# Cline CLI, then pick a provider
npm i -g cline
cline auth

# Codex CLI
npm install -g @openai/codex

# Gemini CLI
npm install -g @google/gemini-cli

# Qwen Code (Node.js 22 or later), then run /auth inside a session
npm install -g @qwen-code/qwen-code@latest

For Goose, follow the install steps on its repository page.

Step 3: Set approvals before the first run

Start strict and loosen later. These settings come from each tool's docs:

# Codex CLI: workspace writes, ask for anything else
codex --sandbox workspace-write --ask-for-approval on-request

# Cline CLI: turn off auto-approval for this run
cline --auto-approve false "add input validation to the signup handler"

# Goose: inside a session, switch to manual approval
/mode approve

For OpenCode itself, if you keep it for some projects, set a catch-all rule in its config so every action asks:

{
  "permission": {
    "*": "ask"
  }
}

Step 4: Work on a branch

git switch -c agent/signup-validation

Step 5: Install the Safeguard CLI and take a baseline

curl -fsSL https://cli.safeguard.sh/install | bash
safeguard scan --dir .

The scan builds an SBOM for the folder and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. Keep a copy of this baseline so you can compare after the agent works.

Step 6: Let the agent work, then scan again

Run the agent, review its diff, and scan the folder again before you open a pull request. New findings since the baseline are the ones the change introduced.

Worked example: a dependency upgrade with Aider

You ask Aider to upgrade an HTTP client and fix the call sites.

aider --model sonnet --api-key anthropic=<your-key>
# inside aider
/diff

Aider commits the change, so the diff is easy to read and the change is easy to back out with its undo command. Then scan:

safeguard scan --dir .
ls ./output

If vuln.json shows a new finding, open the Safeguard CLI and ask it to deal with it in plain language, for example "fix the lodash CVE in this repo". It asks before it edits a file or runs a command.

Worked example: a headless review in CI with Cline

Cline's CLI reads piped input, so you can ask it to review a diff in a pipeline. Pair that with a Safeguard summary in the same job:

git diff origin/main...HEAD | cline "review these changes"
safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"

The agent reviews the logic. The scan and the summary cover the dependencies the change pulled in.

Worked example: an agent edited your Dockerfile

Agents often change a base image or add a package to a Dockerfile. Build the image, then scan the image rather than the folder:

docker build -t myapp:agent-branch .
safeguard scan --image myapp:agent-branch

If you already produce an SBOM in your build, scan that file instead with the SBOM option, and use the validate command to check that a CycloneDX, SPDX or VEX document is well formed before you ship it.

Do the work properly with the Safeguard CLI

Every agent above can write code. The Safeguard CLI writes code too, and it starts from your Safeguard data: the vulnerabilities in your dependencies and the results of your scans. It scans code, container images and SBOMs on your own machine, sends only the results to the Safeguard platform, and includes an assistant that can fix what it finds. It writes code, not only scans.

You can use it two ways: as the agent you write and fix code with, or as the check you run on whatever another agent changed. You can do both.

Install

The CLI is a single static binary. You do not need Node, Python or a JVM. It runs on macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only.

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows (PowerShell)
irm https://cli.safeguard.sh/install.ps1 | iex

Your first session

Run safeguard with no arguments to open the interactive terminal. Type /login to sign in through your browser, then /scan . to scan the folder you are in. From there you can ask questions in plain language, such as "how many critical vulns do we have".

A few commands make sessions easier. @ attaches a file from the folder you started in, so you can point the assistant at the exact file you mean. /resume picks up the last session in that folder, so you do not lose context between days. /model shows the current AI model or switches to another.

Writing and fixing code

The assistant has tools for local files and for your Safeguard data. That pairing is the point. When you ask it to "fix the lodash CVE in this repo", it is working from your actual findings, not guessing from a package name. It can write files, edit code and run commands to get there, including running your tests.

It fits the end of another agent's work too. Let any agent from the list above make its change, run /scan . in the Safeguard terminal, and ask what the change introduced and how to fix it.

Use the Claude or ChatGPT plan you already pay for

Bring the Claude or ChatGPT plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply.

This works the same way OpenCode lets you use an existing subscription, so moving your coding work into the Safeguard CLI does not mean paying twice for model access. To connect a model, see the CLI docs or run /model in a session.

Approvals

When the assistant wants to write a file, edit code or run a command, it asks before it acts. /permissions sets how much it asks:

• Ask prompts before every action.
• Auto approves actions it already knows and asks for anything new. This is the default.
• Yolo approves everything.

For shared or sensitive repositories, Ask is a sensible choice.

CI with safeguard exec

For pipelines, the scan command takes a folder, a repository URL, a container image or an SBOM file:

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom bom.json

safeguard exec runs one non-interactive assistant turn, which is what you want in CI:

safeguard exec "summarise the critical findings in this repository"

Policies and gates are evaluated in the Safeguard platform, not by the CLI. When the local runner handles platform scan jobs, your source code never leaves your machine; only SBOMs and findings are uploaded. In the platform you also get reachability analysis, and autonomous remediation that opens fix pull requests, which is off by default.

FAQ

Which open-source alternative to OpenCode should I pick?

It depends on your constraints. If you need many providers or local models, look at Aider, Cline, Goose or Qwen Code. If your team is already on OpenAI or Gemini, Codex CLI or Gemini CLI match those accounts. Check the licence, the approval default and where keys are stored before you decide.

Can I use my Claude or ChatGPT plan with the Safeguard CLI?

Yes. Bring the Claude or ChatGPT plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. See the CLI docs or /model for connecting a model.

Does the Safeguard CLI replace my coding agent?

It is not a feature-for-feature replacement for any of the tools above. It can write and fix code with an assistant that knows your findings, and it can scan what any agent changed. You can keep the agent you like and add the Safeguard CLI as the step before merge.

Does my source code leave my machine?

With the Safeguard CLI, scans run locally and only results are sent to the platform. When the local runner handles platform scan jobs, only SBOMs and findings are uploaded. Separately, any coding agent sends prompts and file contents to the model provider you configure.

Which approval mode should I use in CI?

The narrowest one that still gets the job done. Codex's docs show a read-only sandbox with approvals set to never for non-interactive CI. For the Safeguard CLI, safeguard exec runs a single non-interactive turn, which suits a pipeline step.

Is Crush open source?

Not by the usual definition. Crush is published under the Functional Source License 1.1, which converts to MIT two years after release and restricts competing use until then.

Do I need to rotate keys if I leave OpenCode?

If you saved provider keys in an OpenCode Console workspace, follow OpenCode's guidance and our rotation steps. OpenCode said it emailed affected users. Rotating any key you no longer need is good practice either way.

Can I scan a container image or an SBOM instead of a folder?

Yes. safeguard scan accepts a folder, a repository URL, an image name or an SBOM file, and safeguard validate checks CycloneDX, SPDX and VEX documents.

Try it yourself

Click through it at your own pace, or open it full screen.

Keep the agent you like and add a check it cannot skip. Download the Safeguard CLI, connect the Claude or ChatGPT plan you already have, and read the CLI docs before you scan the next change your agent makes.

Quick check

Sources

• OpenCode repository (anomalyco/opencode)
• OpenCode docs: Providers
• OpenCode docs: Permissions
• Aider repository
• Aider docs: Git integration
• Cline repository
• Cline CLI docs
• OpenAI Codex repository
• Codex docs: Agent approvals and security
• Gemini CLI repository
• Gemini CLI docs: Sandbox
• Gemini CLI docs: Configuration
• Goose repository
• Goose docs: Permission modes
• Qwen Code repository
• Crush licence (FSL 1.1 MIT)
• OpenHands CLI repository
• Safeguard CLI docs

Last reviewed: 20 October 2026.