Editorial status: Human-reviewed, source-researched directory. Product capabilities and commercial relationships remain subject to change; check the linked first-party documentation before making a purchase decision.
AI coding agents range from terminal assistants to autonomous cloud workers. A long feature checklist can hide the most important distinction: where code runs and what the agent is allowed to do.
This directory does not rank products. It groups them by workflow so readers can build a shortlist and then apply the same security questions to every candidate.
Widely used general-purpose agents
| Tool | Typical interface | Start by reviewing |
|---|---|---|
| OpenAI Codex | CLI, IDE, app, and cloud workflows | Sandbox mode, approvals, network access, project instructions |
| Claude Code | Terminal and supported editor integrations | Filesystem/network sandboxing, tool permissions, MCP servers |
| Gemini CLI | Terminal | Folder trust, sandbox mode, tool allowlists, authentication |
| GitHub Copilot | IDE, GitHub, and command-line workflows | Repository permissions, agent policies, extension access, review gates |
| Cursor Agent | AI-native editor plus cloud/background agents | Workspace trust, local sandbox, network policy, cloud-agent credentials |
| Windsurf Cascade | AI-native editor | Command execution, workspace scope, terminal approvals, external integrations |
Open and extensible agents
| Tool | Why developers consider it | Security review starting point |
|---|---|---|
| Cline | Editor agent with model and provider choice | Auto-approval scope, browser/terminal tools, MCP configuration |
| Roo Code | Extensible editor agent with modes | Per-mode permissions, command execution, MCP access |
| OpenCode | Open-source terminal agent | Agent permissions, shell access, provider credentials |
| Aider | Git-oriented terminal pair programming | Repository boundary, command execution, model API keys |
| Continue | Open-source IDE assistants and agents | Model endpoints, tool policies, shared configuration |
| Goose | Open-source local agent and extension system | Extension trust, shell permissions, secrets, network access |
Platform and enterprise-oriented options
| Tool | Operating model | Questions to verify |
|---|---|---|
| Amazon Q Developer CLI | AWS-linked command-line development assistant | IAM scope, account boundary, telemetry, command approvals |
| JetBrains Junie | Agent integrated into JetBrains IDEs | Project access, terminal execution, organization policy controls |
| Replit Agent | Browser-based hosted development environment | Workspace isolation, deployment permissions, secret handling |
| Devin | Hosted software-engineering agent | Repository and SaaS scopes, environment isolation, audit trail |
| OpenHands | Open platform for software agents | Runtime isolation, confirmation policy, credential injection |
| SWE-agent | Research-oriented software-engineering agent | Container boundary, repository trust, evaluation versus production use |
A security checklist that works across products
Before enabling any agent, answer these questions:
- Filesystem: Can it read only the intended repository, or the whole machine?
- Commands: Which commands run automatically, and which require approval?
- Network: Is outbound access blocked, unrestricted, or allowlisted?
- Credentials: Can the model or subprocesses read plaintext secrets?
- External actions: Can it push code, merge pull requests, deploy, send messages, or spend money?
- Extensions: Which MCP servers, plugins, hooks, and third-party packages execute?
- Cloud execution: Where does the code run, how long is it retained, and who can access logs?
- Recovery: Are changes isolated in Git, and can every external action be audited or reversed?
Choosing without a misleading winner
A local terminal agent may be a good fit when data locality and an existing toolchain matter. A hosted agent may suit long-running jobs and reproducible environments. An IDE-native agent may reduce context switching. None of those interface choices proves that one product is safer.
Compare the exact configuration you will deploy—not the product’s most permissive demo. Start with a disposable repository, test denied actions, inspect network behavior, and grant additional access only when a real workflow requires it.
About affiliate links
AgentField may eventually earn commissions from eligible tools or adjacent services. Commercial availability will be verified with each vendor, disclosed next to qualifying links, and kept separate from editorial evaluation. A product does not receive favorable placement because it has a referral program.
Planned deep dives
The first configuration guides cover OpenAI Codex, Claude Code, and Gemini CLI. Follow-up guides will prioritize Cursor, GitHub Copilot, Cline, Roo Code, OpenCode, Aider, Continue, Goose, Amazon Q Developer, Junie, Replit Agent, OpenHands, and SWE-agent. Each guide will use official documentation, an explicit review date, and hands-on testing where practical.