Cline

Why it's ranked here

Two checkable facts carry the argument: the Apache 2.0 license, whose explicit patent grant matters for companies embedding the tool in build systems, and provider reach spanning Anthropic, OpenAI, Google, Bedrock, Azure, Vertex, Groq, Ollama, LM Studio and any OpenAI-compatible endpoint. Maintenance is visible in the details: risky transitive dependencies are explicitly pinned, and the agent core is published as an installable npm package rather than locked inside an IDE build. That combination reads as an agent platform, not a chat sidebar.

What's good

Approval control lives in code, not just a settings screen: applications embedding the agent can set per-tool auto-approve policies or supply a callback that decides each request dynamically. The VS Code extension exposes just four narrow methods to other extensions rather than an open door onto its internals. The contributor guide is unusually honest, naming a known failing test and its cloud-VM cause, and flagging some end-to-end assertions as pre-existing drift. Formatting, lint and type checks run automatically on staged changes, and unit and end-to-end tests have separate targets.

Tradeoffs

The toolchain is prescriptive rather than portable: a specific Bun version is pinned, Node 22 or newer is required, and contributors are told not to use npm, yarn or pnpm. SDK packages resolve each other through compiled output, so changing SDK source means rebuilding and restarting; nothing hot-reloads. The published SDK re-exports the entire core, several hundred named symbols wide, with no narrower surface marked as the supported one. The JetBrains plugin source is not published, and the hooks documentation is a one-line pointer to another page.

How to use it well

Start exploration in Plan mode, which cannot modify files or run commands; the conversation carries into Act mode, so the constraint costs nothing. For approvals, enable automatic reading of project files but leave edits, commands, browser and MCP behind manual approval, and know that command safety rests on a model-assigned risk flag, not a fixed allowlist. Confine fully automatic mode to throwaway workspaces under version control, which its own best-practices list advises. For CI or scripted automation, drive the headless JSON output instead of the interactive terminal interface.

Observed

License

Apache 2.0, with its explicit patent grant

Language and shape

TypeScript monorepo; one agent core shared by every client surface

Install surface

Terminal client via a global npm install; the agent core is a published npm package

Interfaces

Terminal client with headless JSON output, VS Code extension, JetBrains client, web task board, and chat connectors

JetBrains plugin source

Not open-sourced, per the README index table