These tools are not glorified autocomplete plugins. Claude Code, Aider, OpenCode, and their peers are agent loops that read your filesystem, execute shell commands, manage git history, call external APIs, spawn subprocesses, and act across multi-file codebases with minimal human intervention. According to JetBrains' 2025 State of Developer stack survey, 62% of developers rely on at least one AI coding assistant or agent, and 85% use AI tools for coding regularly. But Stack Overflow's 2025 survey found positive sentiment has dropped from 70%+ in prior years to 60%, as developers hit real-world friction. That friction is mostly about trust, permissions, and unexpected side effects. This post gives you a map of the available tools and a practical framework for using them without losing control of your codebase.
Not all "agentic" tools are equally autonomous, and conflating them causes real problems. The spectrum breaks down roughly like this:
- Enhanced autocomplete (GitHub Copilot legacy mode, Tabnine): suggest lines and blocks, require constant human steering.
- Interactive assistants (ChatGPT web, Claude.ai): generate full functions or explain code, but don't execute anything independently.
- Supervised agents (Cursor, Windsurf, Cline): read and write multiple files, run commands, but request permission at each significant step.
- Autonomous agents (Claude Code, Aider, Devin AI): execute multi-step plans with minimal supervision, iterate on failures, and can complete entire features end-to-end.
The autonomous tier is where the safety conversation gets serious. These tools can do remarkable work. They can also silently read your .env file, attempt a curl to an external host, or make sweeping refactors across 40 files while you're grabbing coffee. Know which tier you're operating in before you configure anything.
Between February 2025 and early 2026, every major AI lab shipped a terminal-native agent runtime. The open-source stack expanded in parallel. Here's the full list of verified CLI-based coding agents, followed by a comparison table.
The tools:
- Claude Code (Anthropic)
- OpenAI Codex CLI
- Gemini CLI (Google)
- Aider
- Goose (Block / Linux Foundation)
- OpenCode
- Plandex
- Amp (Sourcegraph)
- GitHub Copilot CLI
- Amazon Q Developer CLI
- Pi (pi.dev)
Comparison table
| Tool | Model support | Standout strength | Notable weakness |
|---|---|---|---|
| Claude Code | Anthropic only (Sonnet, Opus) | Hooks, subagents, SDK; ~82% SWE-bench with Opus 4.7; session checkpoints | Locked to Anthropic models; can get expensive at scale |
| OpenAI Codex CLI | GPT-5 series only | OS-level sandboxing; fastest execution at 240+ tok/s; no separate billing beyond ChatGPT subscription | Hard model lock-in; requires GPT-5 series |
| Gemini CLI | Google Gemini | 1M-token context window; 1,000 free requests/day; fully open source; built-in Google Search grounding | Being retired June 18, 2026; replaced by closed-source Antigravity CLI |
| Aider | Claude, GPT, DeepSeek, Ollama (100+ models) | Git-native; intelligent auto-commits; 39k GitHub stars; 15B tokens/week; completely free and open source | Release velocity has slowed; no tagged release since August 2025 |
| Goose | 15+ providers | 70+ MCP extensions; YAML recipes for portable workflows; donated to Linux Foundation | General-purpose agent, not coding-specific; broader scope can mean less polish for pure coding tasks |
| OpenCode | 75+ providers via Models.dev | 165k+ GitHub stars; LSP integration; multi-session parallel agents; privacy-first (no code stored); free and open source | Newest major entrant; stack still maturing |
| Plandex | Multiple | 2M-token effective context via cumulative-diff sandbox; 20M+ token Tree-sitter indexing; best for large monorepo refactors | Effectively in maintenance mode; no commits since October 2025 |
| Amp | Multiple | Free to start (ad-supported) | Limited public documentation on deeper agent capabilities |
| GitHub Copilot CLI | Multiple (Copilot platform) | Fleet mode for parallel subtasks; tight GitHub stack integration; cloud delegation | Best value only if you're already deep in the GitHub stack |
| Amazon Q Developer CLI | AWS models | AWS-native; covers build, security, and operations across the dev lifecycle | Strongest value proposition is AWS shops; limited appeal outside that context |
| Pi (pi.dev) | Multiple | Security-first; sandboxed execution; granular file system permissions; built by Armin Ronacher (Flask, Jinja2); 54k GitHub stars; runs on a system prompt under 1,000 tokens | Approval toggles add friction; slower than fully autonomous agents |
A few things worth calling out. Gemini CLI's retirement is not a rumor: Google confirmed it stops serving AI Pro, Ultra, and free users on June 18, 2026, replaced by a closed-source successor called Antigravity CLI. If you want the open-source Gemini CLI experience to continue, Qwen Code is the active fork. Plandex is a similar story: technically impressive, but with no commits since October 2025, self-hosting is the safer bet over relying on Plandex Cloud. And OpenCode's growth is hard to ignore: it crossed 165,000 GitHub stars in 2026, making it the most-starred open-source coding agent by a wide margin.
Claude Code launched in February 2025 and reached general availability in May 2025. By November 2025 it had hit $1 billion in annualized revenue. It's worth understanding its permission system in detail, because it's the most configurable of the autonomous agents and the one most teams will encounter first.
By default, Claude Code uses strict read-only permissions. Actions like ls, cat, and git status run without prompting. File edits, shell command execution, and git operations require explicit user approval before proceeding. You can approve actions once or configure automatic approval for specific commands. Permissions are managed with allow, ask, and deny rules, and deny rules take precedence over everything else.
Rules can be scoped to specific tools, commands, files, domains, MCP servers, or working directories. That granularity matters. You can tell Claude Code it's allowed to run npm test and tsc --noEmit but never curl, and that rule will hold for every session in that directory.
Claude Code is also designed as a composable Unix utility. You can pipe data into it, run multiple instances in parallel, and wire it into CI/CD pipelines. The version 2.0 release added a VS Code extension, session checkpoints for autonomous operation, and a hooks system for workflow automation.
The single most important framing comes from practitioners who've run these tools on real codebases: treat Claude Code like a brilliant but untrusted intern. It can do remarkable work. You still have to supervise it and double-check everything before it ships.
Without git integration, a codebase is exposed to uncontrolled modifications that are difficult to undo. The first rule is simple: always ask Claude to create a new branch before each task. One task, one branch. Claude's work never touches main directly, which means you can inspect the full diff, run CI against it, and reject or squash it cleanly.
Default to a restrictive permission mode for sensitive repositories. Allowlist only commands you've reviewed and trust. Safe allowlist candidates include npm test, npm run lint, and tsc --noEmit. Commands like curl, fetch, and any direct access to .env files should be on your deny list.
Never use --dangerously-skip-permissions on repositories that contain production code, secrets, or infrastructure definitions. And never grant broad shell access on projects where production credentials live.
Attack surfaces:
- Command injection: malicious inputs or crafted prompts could convince an autonomous agent to run destructive commands.
- Credential exposure: if not restricted, Claude Code can read
.env, AWS credentials, orsecrets.jsonand surface them through "helpful" suggestions or logs. - Persistent hooks: poorly configured hooks or MCP servers can reintroduce malicious code every time you restart your IDE.
- Supply chain: in March 2026, a backdoor sat on PyPI for three hours and accumulated nearly 47,000 downloads. The compromised package, LiteLLM, serves as the language-model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks. Any project pulling that package during that window was exposed. Agentic tools that auto-install dependencies without pinning versions are a real supply chain risk.
- Windows-specific: Anthropic explicitly recommends against letting WebDAV when running Claude Code on Windows. WebDAV has been deprecated by Microsoft due to security risks, and letting it may allow Claude Code to trigger network requests to remote hosts, bypassing the permission system entirely.
For most teams, a safe Claude Code setup looks like this:
- Disable all hooks until you've reviewed what they do.
- Explicitly approve only MCP servers you've vetted.
- Use deny rules aggressively: block
curl,fetch, and.envaccess by default. - Keep transcript retention short (7 to 14 days).
- Sandbox Claude Code in a VM or containerized dev environment.
- Never run as root.
- Audit your allowlist monthly as your project changes.
For critical systems, isolate the agent completely: no direct access to production credentials, mandatory code review on every PR it generates, signed commits, and CI validation before anything merges.
Before you point any of these tools at a real repository, read the default permission model. Codex CLI sandboxes shell calls at the OS level by default. Claude Code prompts before destructive operations. OpenCode and Aider extend more trust to the model by default. Those differences matter on day one.
If your team is already on the Anthropic API, Claude Code is the most full-featured option with the strongest benchmark results. If you need model flexibility and want to avoid vendor lock-in, OpenCode's 75+ provider support and active development velocity make it hard to ignore. For git-heavy workflows where auto-commit quality matters, Aider is still the reference implementation, even with slower recent release cadence. If security compliance is a hard requirement, Pi is the only tool in the list that was built from the ground up around approval-first operation.
The tools in the autonomous tier are genuinely useful. They're also running with real filesystem access, real shell access, and real network access. Read the defaults, configure deny rules before you need them, and keep a human in the loop for anything that touches production.