VTCode
github.com/vinhnx/vtcode- Category
- Developer Tools
- Rank
- No. 932Tools index
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Coding
- Interfaces
- CLI
- Builder
- vinhnx
- GitHub
- 874 stars
- Latest release
- 0.175.4
- Date
About
VTCode is an open-source Rust terminal coding agent that combines an interactive TUI, safe file/terminal tools, multi-provider LLM support (30+ providers plus local inference via Ollama, LM Studio, and llama.cpp), and extensibility through Agent Skills, MCP, plugins, and lifecycle hooks. It supports both interactive coding sessions and long-running autonomous workflows with sandboxing, audit logging, and approval gates for safety.
What it does
VT Code is one Rust program that runs an AI coding agent in your terminal. You pick a model provider, ask for a change, and the agent proposes edits and shell commands that pass through a policy layer before anything runs. The full-screen terminal interface, one-shot headless runs, cron-style scheduled prompts and editor integrations all drive the same loop, and every run leaves a log you can replay, resume or fork. Workspace snapshots let you roll back what the agent changed.
Why it's ranked here
The safety story is code, not a slogan. Commands are checked deny rules first, and anything that matches no allow rule is refused. On Linux the binary itself enforces restrictive sandboxes through the kernel's Landlock and seccomp features and fails closed where the kernel lacks them, and locally launched MCP servers (Model Context Protocol, the standard plug for outside tools) inherit the same sandbox. The code is split into 22 crates with separate homes for policy, providers and extensions, and it is dual licensed MIT or Apache 2.0. Few open terminal agents document where their sandbox stops this candidly.
What's good
The limits are written down. Restrictive sandboxing on Windows returns an explicit unsupported error instead of pretending, and macOS refuses hostname allowlists rather than quietly widening them to whole ports. Sandboxed commands lose credential, token and cloud-provider environment variables, and a per-command override cannot put them back. Inline-code flags for Python, Node, Ruby, PHP and PowerShell count as code execution that needs a sandbox or approval. Headless runs are accepted as done only when the task tracker is complete and verification commands pass, and a built-in eval runner reports pass@k results.
Tradeoffs
Breadth is the cost. Building from source means a Rust toolchain at 1.93 or newer and a workspace of over twenty internal crates, with a pinned terminal UI library and locally patched dependencies. ChatGPT and GitHub Copilot sign-in reuses the Codex CLI's public client identity, which the README itself calls unofficial; bring your own API key if that matters. The security policy still lists 0.133 as the latest supported line while the manifest sits at 0.169, and its report address carries a placeholder note. Several core crates silence dead-code and unused-import warnings wholesale, and some automation flows are labelled experimental.
How to use it well
Pick it if you want a terminal agent you can audit. Run it on Linux to get the kernel sandbox, keep provider keys in the OS keyring through its secret command, and read the generated project instructions before committing them. Use read-only planning for large changes, then check the per-turn diffs. Headless mode plus scheduled prompts suits recurring chores such as a weekly dependency audit. It is not an IDE plugin first: editor use goes through the Agent Client Protocol bridge, and on Windows there is no restrictive sandbox at all.
Technical notes+
Cargo.toml declares a resolver 3 workspace of 22 members (edition 2024, rust-version 1.93.0), pins ratatui at =0.30.2, patches crossterm and simdutf from local paths, and sets workspace clippy lints that warn on unwrap, expect, panic and unchecked indexing. src/main.rs applies pre-main process hardening (core dumps off, RLIMIT_STACK capped at 8 MiB, ptrace attach blocked), runs on a 16 MiB spawned thread, short-circuits into a hidden sandbox-exec helper mode on Linux before config loading, and sets VTCODE=1 so huggingface_hub attributes Hub traffic to it. crates/codegen/vtcode-safety/src/lib.rs exposes command_safety, exec_policy, sandboxing, mcp_sandbox and audit_log modules, all under a crate-level allow for dead_code and unused_imports. crates/codegen/vtcode-mcp/src/lib.rs says its protocol layer is adapted from openai/codex under Apache-2.0, accepts MCP protocol versions back to 2024-11-05, and rejects startup timeouts above 300 seconds and tool timeouts above 3600 seconds. docs/development/COMMAND_SECURITY_MODEL.md describes deny-first validation with fail-closed default and Landlock plus seccomp enforcement; docs/SECURITY.md still lists 0.133.x as the latest supported version.
Observed
- License
- MIT OR Apache-2.0 (dual)
- Language
- Rust, edition 2024, minimum toolchain 1.93.0
- Install
- curl install script, Homebrew tap, or cargo install vtcode
- Interfaces
- Terminal UI, headless CLI (exec, ask, review, eval), scheduled prompts, Agent Client Protocol editor bridge, MCP client
- Workspace
- 22 member crates declared in Cargo.toml
- Sandbox platform support
- Linux via Landlock and seccomp; Windows restrictive policies unsupported; macOS without hostname allowlists
- OAuth sign-in
- Reuses the Codex CLI public client identity, described in README as unofficial
- MCP client code
- Protocol layer adapted from openai/codex under Apache-2.0
Read from README.md, Cargo.toml, LICENSE, docs/ARCHITECTURE.md, docs/SECURITY.md, docs/development/COMMAND_SECURITY_MODEL.md, src/main.rs, src/agent/runloop/mod.rs, crates/codegen/vtcode-safety/src/lib.rs, crates/codegen/vtcode-llm/src/lib.rs, crates/codegen/vtcode-mcp/src/lib.rs.
What it can do
Connect to multiple LLM providers including local inference engines (Ollama, LM Studio, llama.cpp)
Provider configuration/API keys → LLM responses
Execute file and terminal operations through safe tooling
File/terminal commands → Command results
Extend agent functionality via Agent Skills, MCP, and plugins
Skill/plugin/MCP definitions → Extended agent capabilities
Run long-running autonomous coding workflows
Task description → Completed coding workflow
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.