Kilo Code

Why it's ranked here

This one earns attention for reach and openness, not polish alone: it is MIT licensed, installable a half-dozen ways, and built as a genuine multi-client platform rather than a single editor plugin with a marketing page. The catalogue's claim of specialized task modes and wide model choice is borne out in the source. What tempers the verdict is candor cutting the other way: the project's own security documentation states plainly that the agent runs with no isolation, and a fully autonomous mode exists that turns off every confirmation prompt. That combination is worth knowing before adoption, not after.

What's good

The multi-client story is real: the same engine backs an editor extension, a JetBrains plugin, a terminal program, and a hosted agent, plus automated review of pull requests. Install paths are unusually generous for a developer tool, covering package managers on every major platform down to prebuilt binaries. It connects to external tools through a standard protocol with support for local, remote, and OAuth-authenticated servers, and ships with authentication wired up for a long list of model and infrastructure providers already, rather than leaving every integration to the user.

Tradeoffs

The project is unusually blunt about a real limitation: there is no sandbox around the agent's actions, and its own documentation says the permission prompts are a convenience, not a security boundary. An autonomous mode can disable every one of those prompts outright, with a direct warning to use it only in trusted environments. The optional server mode runs without authentication unless you set a password yourself. None of this is unusual for the category, but it does mean the isolation burden sits entirely with whoever deploys it.

How to use it well

Run it interactively inside your editor or terminal for day-to-day coding, where the permission prompts give you a chance to catch bad actions before they happen. Save the fully autonomous mode for pipelines running inside a container or disposable virtual machine, never on a machine with anything you care about, since nothing else stands between the agent and your filesystem. Reach for the plugin marketplace before writing custom integration code, since a wide set of providers are already wired in. It is not the right choice if you need built-in execution isolation without adding your own containment layer.

Observed

License

MIT

Language

TypeScript monorepo built with Bun and Turborepo

Install surface

npm global install, curl install script, Homebrew tap, Arch Linux AUR package, and prebuilt binaries for Windows, macOS, and Linux (x64 and arm64)

Interfaces

CLI with terminal UI, VS Code extension, JetBrains plugin, cloud agent, and an HTTP server mode with SSE

MCP support

MCP client with stdio, StreamableHTTP, and SSE transport support, including OAuth-authenticated remote servers

Security posture

Documented as running with no sandbox by design; permission prompts are described as a UX feature, not isolation

Server auth

HTTP server mode runs unauthenticated unless a password environment variable is set

Test structure

Root-level test command is intentionally disabled; tests are run per package instead

Provenance

CLI core is a fork of the OpenCode project, with fork-specific changes tracked via inline markers