Terminal AI Coding Assistants Compared: Licence, Models, Approvals

Terminal AI coding assistants include Claude Code, Codex CLI, Gemini CLI, OpenCode, Aider, Qwen Code, goose, Cline and Kilo Code. They split on five facts: interface, licence, which models you can sign in with, how approvals work, and where your code runs. This comparison sets those facts side by side from each project's own pages.

The Safeguard CLI belongs on the list for a different reason: its assistant writes and fixes code and also knows your vulnerabilities. You can switch to it without losing what you pay for today. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

There are no rankings and no benchmarks below. Each fact links to the page it came from under Sources.

How this comparison works

Every tool here reads your project, proposes or makes edits, and can run shell commands. What separates them is the set of facts a team lead or security reviewer needs before approving one:

• Interface. Terminal only, or terminal plus IDE, desktop and web surfaces that share settings.
• Licence. Open source under a named licence, or a commercial product. We confirmed every open-source licence on the project's own repository page and left out tools whose licence we could not confirm as open source.
• Models and sign-in. Whether you sign in with a subscription, an API key, a cloud provider, or a local model.
• Approvals. Which actions run without asking in the default mode, and what the most permissive mode is called.
• Where code runs. Local edits on your machine, a sandbox, or a vendor's cloud. In every case, your model provider receives the context the agent sends it.

We also note each tool's non-interactive mode where its docs describe one, because that is how an assistant ends up in CI.

The comparison table

Facts only, as published by each project.

Tool notes

Claude Code. Anthropic describes it as "an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools." Install with curl -fsSL https://claude.ai/install.sh | bash or brew install --cask claude-code, then claude opens a browser to log in. Claude's pricing page says "Claude Code is included in all paid plans" and that it shares usage limits with the rest of the plan. If ANTHROPIC_API_KEY is set and you approve it, that key is used instead of your subscription, and /status shows which credential is active.

Codex CLI. OpenAI's local coding agent, Apache-2.0, installed with npm install -g @openai/codex or brew install --cask codex. Run codex and pick Sign in with ChatGPT. The sandbox modes are read-only, workspace-write and danger-full-access, network access is off by default, and /permissions changes mode during a session. codex exec runs one task without the interactive UI and, by default, in a read-only sandbox.

Gemini CLI. Google's open-source terminal agent, Apache-2.0, installed with npm install -g @google/gemini-cli or brew install gemini-cli. MCP servers go in ~/.gemini/settings.json. The configuration reference lists default, auto_edit and plan as default approval modes and says YOLO can only be turned on from the command line; admins can disable YOLO with security.disableYoloMode. The README notes that Gemini CLI was replaced by Antigravity CLI on 18 June 2026 for unpaid tier and Google One users.

OpenCode. An MIT-licensed coding agent with a terminal UI and a desktop app in beta. /connect adds a provider; the providers page lists 75 or more, a ChatGPT Plus/Pro browser sign-in, a GitHub Copilot device-code sign-in and local models. Tab switches between build (full access) and plan (no file edits, asks before bash). MCP servers, local or remote, go under the mcp key in opencode.json.

Aider. Apache-2.0 pair programming in the terminal, installed with python -m pip install aider-install then aider-install. It commits each edit to git with a generated message, and /undo reverts the last commit it made. Chat modes are code, ask, architect and help. PyPI lists 0.86.2 as the latest release, dated 12 February 2026.

Qwen Code. An Apache-2.0 terminal agent that began as a fork of Gemini CLI v0.8.2 and has been developed independently since its v0.1. /auth configures the provider. Shift+Tab cycles through Plan, Ask Permissions, Auto-Edit, Auto and YOLO, and /approval-mode sets one directly.

goose. An Apache-2.0 agent with a CLI, desktop app and API, part of the Agentic AI Foundation at the Linux Foundation, aimed at general tasks as well as code. Its permission docs say autonomous mode is applied by default. /mode approve, /mode smart_approve and /mode chat switch to Manual Approval, Smart Approval and Chat Only.

Cline. An Apache-2.0 agent for the IDE, terminal and desktop; the CLI installs with npm i -g cline and has a headless mode with --json output for pipelines. Its README says "every file edit and terminal command requires your approval," with auto-approve available. Its JetBrains plugin is not open source.

Kilo Code. An MIT-licensed agent whose CLI is a fork of OpenCode, installed with npm install -g @kilocode/cli. The README says you can pick from 500 or more models. kilo run --auto approves permission prompts unless a rule denies the action, and the README says to use it only in trusted environments.

Non-interactive modes for CI

These are the one-shot commands each project documents.

Approvals, sandboxes and where your code goes

Three families of approval design

Reading the docs side by side, the tools fall into three patterns.

Ask by default. Cline asks about every edit and command. Gemini CLI's default mode prompts for approval. Claude Code's Manual mode (config value default) lets only reads run without asking. Qwen Code's Ask Permissions does the same for edits and shell commands.

A reviewer instead of you. Claude Code's auto mode uses a second model, the classifier, to review actions, and it is the starting mode for interactive terminal sessions from v2.1.283. Qwen Code's Auto mode uses an LLM classifier for shell commands, network calls and edits outside the workspace. Codex can send eligible approval requests to an auto-review agent with approvals_reviewer = "auto_review". goose's Smart Approval approves low-risk actions and flags the rest. The Safeguard CLI's Auto mode approves actions it recognises and asks about anything new.

Run everything. Most of these tools have one: Claude Code bypassPermissions, Codex danger-full-access, Gemini CLI and Qwen Code YOLO, goose autonomous mode, Cline auto-approve, Kilo run --auto, Aider --yes-always, Safeguard Yolo. Claude's docs say bypass mode is for isolated containers and VMs only, and OpenAI's say to use danger-full-access only in a controlled environment such as an isolated CI runner or container.

Sandboxes are a separate control

Approval prompts decide whether an action runs. A sandbox decides what a running action can reach. Codex combines both: the sandbox mode limits file and network access, and the approval policy decides when to ask. Gemini CLI has a tools.sandbox setting that accepts Docker, Podman and other options, plus tool-level sandboxing. Claude Code's docs require a container, VM or sandbox runtime for fully unattended runs. If a tool you use has no sandbox, run risky sessions inside a container you control.

Where your code goes

All of these assistants edit files on your machine when you run them in a terminal. That does not mean nothing leaves it: the model provider receives whatever context the agent sends, including file contents it reads. Some surfaces run in the vendor's cloud by design, such as Claude Code on the web, Codex Web and Kilo's Cloud Agent.

The Safeguard CLI makes one specific promise here. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded.

Setup walkthrough: compare two assistants on your own repository

A fair trial uses the same task, the same starting commit and the same checks for each tool. Here is a simple protocol.

1. Pick a small, real task with a test that proves it is done, such as a bug with a failing test.
2. Branch per tool from the same commit.

git switch main
git switch -c trial-codex
git switch main
git switch -c trial-claude

3. Record a vulnerability baseline before any agent runs:

safeguard scan --dir .
cp output/vuln.json baseline-vuln.json

4. Start each tool in its strictest useful mode. For example claude --permission-mode plan, Codex with /permissions set to read-only while it plans, Gemini CLI in default, OpenCode in plan, goose after /mode approve, or the Safeguard CLI after /permissions set to Ask.
5. Give the same prompt to each, word for word, and approve or deny each action deliberately.
6. Run the same checks on each branch: your test suite, your linter, then a scan.

npm test
safeguard scan --dir .
diff baseline-vuln.json output/vuln.json

7. Write down facts, not impressions: how many approval prompts you saw, which files changed, whether any dependency was added, and what the scan diff shows.
8. Decide with your security reviewer, using the approvals and data-flow facts above.

Worked example: the same check in CI

Once you pick a tool, the CI step follows its documented non-interactive mode, with a scan and a summary after it:

# Codex: edits allowed in the workspace only
codex exec --sandbox workspace-write "fix the failing date parser test"

# or Claude Code: only the tools you list
claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

# then, whichever agent ran
safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"

Policies and gates are evaluated in the Safeguard platform, not by the CLI.

Common mistakes

• Comparing defaults that are not equal. goose starts autonomous and Cline starts by asking. A trial that leaves both on defaults compares approval settings, not tools.
• Trusting a tool's quiet mode in CI without a sandbox. OpenAI and Anthropic both tell you to keep their most permissive modes inside containers or isolated runners.
• Leaving an API key in the environment. Claude Code uses an approved ANTHROPIC_API_KEY ahead of your subscription. Check /status.
• Plugging a consumer plan into a tool it is not meant for. OpenCode's providers page says plugins existed to use Claude Pro or Max models in OpenCode and that "Anthropic explicitly prohibits this." Read provider terms first.
• Ignoring notices. Gemini CLI's Antigravity notice and Aider's release dates are on their own pages. Read them before a rollout.
• Reviewing only the diff. A new package in a lockfile looks like one line. The scan shows what it brought with it.

The Safeguard CLI: the assistant that also knows your vulnerabilities

Every tool in the table above can write code. The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the Safeguard platform, and includes an assistant that writes code and fixes what it finds, with your findings in view. If you want to switch, you keep what you pay for: bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply.

Install

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary with no Node, Python or JVM needed, for macOS, Linux and Windows on x86_64 or arm64 (Windows is x86_64 only). The download page lists CLI 1.4.0 binaries for macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64.

First session

Run safeguard with no arguments to open the interactive terminal. /login signs in through the browser and /scan . scans the current folder. Then ask in plain language, for example "how many critical vulns do we have" or "fix the lodash CVE in this repo." @ attaches a file from the folder you started in, and /resume picks up the last session in that folder.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. It can write files, edit code and run commands, with your approval, so it doubles as a general terminal assistant; the docs list "what's the latest file in ~/Downloads" as an example. Read more in our post on the Safeguard CLI as an AI assistant on your machine.

Choosing the model

/model shows or switches the AI model; see the CLI docs for connecting a model. In the Safeguard platform you can also choose the model per conversation. This demo shows that choice: Zero z20 answers with no language model at all by turning the question into a platform query, Griffin, Eagle and Lion are Safeguard's models, a tenant admin chooses which model families people may use, and you can bring your own model on your own provider account and route jobs such as chat or summaries to it.

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks about anything new (the default), and Yolo approves everything. In the table above, that puts the Safeguard CLI's default in the "reviewer" family and Ask in the "ask by default" family.

Keep Claude or ChatGPT, add Safeguard through MCP

If you like the chat you already use, connect Claude or ChatGPT to the Safeguard MCP server and ask about projects and findings from there. This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use.

Click through it at your own pace, or open it full screen.

Scan what any assistant changed

safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:latest
safeguard scan --sbom ./sbom.cdx.json

Each scan builds an SBOM, matches it against vulnerability databases and writes JSON files such as vuln.json and license.json under ./output. safeguard validate checks CycloneDX, SPDX and VEX documents. The platform adds reachability analysis, policies and gates, and autonomous remediation with fix PRs, which is off by default. Our guide to checking coding agent changes walks through it.

CI with safeguard exec

safeguard exec "summarise the critical findings in this repository" runs one non-interactive assistant turn, so it sits after any agent step in a pipeline.

On every surface

Start in the terminal, continue in the desktop app 3.2.2 for Windows, macOS and Linux, where you ask your supply chain anything in plain English, and check findings on your phone with the iOS and Android apps. The IDE extension covers VS Code, JetBrains and Open VSX editors, and the browser extension covers Chrome. With nothing to install, there is the Cloud CLI on Safeguard's infrastructure, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.

Download Safeguard and run /scan . in the repository you are working on.

FAQ

Which terminal AI coding assistants are open source?

Codex CLI, Gemini CLI, Aider, Qwen Code, goose and Cline are Apache-2.0 (Cline's JetBrains plugin is not open source). OpenCode and Kilo Code are MIT. Claude Code is a commercial product.

Which assistants can I use with my ChatGPT plan?

Codex CLI recommends Sign in with ChatGPT for Plus, Pro, Business, Edu and Enterprise plans, and OpenCode offers a ChatGPT Plus/Pro sign-in through /connect. You can also bring your ChatGPT plan to the Safeguard CLI.

Which plans include Claude Code?

Claude's pricing page says Claude Code is included in all paid plans, Pro, Max, Team and Enterprise, and not in Free. Claude Code also works with a Console account or Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry.

Can I switch to Safeguard and keep my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Which assistant asks before every command by default?

Cline says every file edit and terminal command requires approval by default. Gemini CLI's default mode prompts for approval. Claude Code's Manual mode and Safeguard's Ask mode prompt too, but neither is the starting mode: Claude Code starts in auto mode from v2.1.283, and the Safeguard CLI starts in Auto.

Which assistants work with local models?

OpenCode, Aider, Qwen Code, goose and Cline document local options such as Ollama, LM Studio or vLLM.

Does any terminal assistant keep my code off the model provider?

No assistant that uses a hosted model can do its job without sending context to that provider. What you can control is which provider, which mode, and what else leaves the machine. With the Safeguard local runner, scan jobs keep source on your machine and upload only SBOMs and findings.

Can I run these assistants in CI safely?

Use each tool's documented non-interactive mode with the narrowest permissions it offers, such as codex exec in its default read-only sandbox or claude -p with dontAsk and an allowlist, inside an isolated runner. Then scan the result and run safeguard exec for a summary.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Claude Code overview
• Claude Code authentication
• Claude Code permission modes
• Claude pricing
• OpenAI Codex repository
• Codex approvals and security
• Codex non-interactive mode
• Gemini CLI repository
• Gemini CLI configuration reference
• OpenCode repository
• OpenCode providers docs
• OpenCode MCP servers docs
• Aider repository
• aider-chat on PyPI
• Aider options reference
• Qwen Code repository
• Qwen Code approval modes
• goose repository
• goose permission modes
• Cline repository
• Kilo Code repository
• Safeguard CLI docs
• Safeguard CLI interactive terminal docs
• Safeguard download page

Last reviewed: 21 October 2026.