{ "data": { "a": { "slug": "cline", "name": "Cline", "vendor": "Cline Bot Inc.", "vendorUrl": "https://cline.bot", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source coding agent that runs as a VS Code extension, a JetBrains plugin, a CLI and a desktop app, all on one TypeScript SDK since extension 4.0.0 (26 June 2026).", "url": "https://www.anchorterminal.com/tools/cline", "markdownUrl": "https://www.anchorterminal.com/tools/cline.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cline.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cline.json", "repo": "https://github.com/cline/cline", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "cline" } ], "auth": "mixed", "authNotes": "Your own provider keys (kept in ~/.cline/data/settings/providers.json for the CLI), a local model, or a Cline account (Google, GitHub or email sign-in) for the Cline provider and ClinePass. The CLI's default provider is Cline's own, so it needs `-P` and a key, or `cline auth`, to use anything else.", "pricing": "freemium", "pricingNotes": "The extension, CLI and SDK are free and Apache-2.0. You pay your model provider, or buy Cline credits for pay-as-you-go access to 100+ models through the Cline provider, or ClinePass at $9.99 a month for higher limits on selected open models. Free models rotate for signed-in users. Enterprise (SSO, role-based access, audit logs, SLA) is priced by sales. We found no public per-token price list for Cline credits.", "priceSummary": "$9.99 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 67600, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://docs.cline.bot", "llmsTxt": "https://docs.cline.bot/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "freemium", "typescript", "llms-txt", "telemetry-default-on", "enterprise", "no-card" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 239, "ranked": true, "rankOf": 452, "categoryRank": 7, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 85, "payments": 50, "reliability": 80, "schema": 77, "security": 57, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -8, "negativeNotes": [ "2026-02-17. GHSA-9ppg-jx86-fqw7. An attacker used a compromised npm publish token to release cline@2.3.0 with a postinstall script that ran `npm install -g openclaw@latest`. It was live for about eight hours before 2.4.0 and a deprecation, the token was revoked and publishing moved to OIDC. A supply-chain incident that reached users, fixed and documented and seven months old, -4. https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7", "2026-05-08. GHSA-5c57-rqjx-35g2 (CVE-2026-44211, 9.6). The kanban server the CLI uses accepted WebSocket connections on 127.0.0.1:3484 without checking Origin, so any website could read workspace data and inject commands. Affects kanban before 2.13.0. Inside six months, -2. https://github.com/cline/cline/security/advisories/GHSA-5c57-rqjx-35g2", "2026-06-23. GHSA-3cj3-hqcr-g934 (CVE-2026-59723, 8.8). The Cline Hub dashboard's `/browser` WebSocket accepted cross-origin connections when ROOM_SECRET was unset, the local default, letting a website add MCP servers to the settings file and run commands. NVD lists versions before 3.0.30 as affected. Inside six months, -2. https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934" ], "verdict": "Approval before edits and commands in the IDE, with command auto-approval off by default since 4.0.0. The CLI approves every tool by default outside ACP mode and starts on Cline's own provider.", "strengths": [ "Approval before edits and commands in the IDE, with command auto-approval off by default since 4.0.0", "Checkpoints that restore files and task state, and sessions that resume by ID", "`CLINE_COMMAND_PERMISSIONS` allow and deny globs for shell commands, with deny taking precedence and redirects blocked", "Your own key for about 200 providers, or a local model, with no Cline account", "29 extension and 34 CLI releases since 3 July 2026, with tests passing on main" ], "weaknesses": [ "The CLI approves every tool by default outside ACP mode and starts on Cline's own provider", "Extension telemetry on by default, and the CLI's telemetry undocumented", "A compromised npm token shipped cline@2.3.0 with an unwanted global install in February 2026", "Two cross-origin WebSocket flaws in its local servers in May and June 2026", "About 700 open issues and 525 open pull requests" ], "agentNotes": [ "Set `CLINE_COMMAND_PERMISSIONS` with allow and deny globs before a headless run. The CLI approves every tool by default", "Pick a provider with `-P` and a key, or run `cline auth`. The default provider needs a Cline sign-in", "Untick 'Allow error and usage reporting', or turn off VS Code telemetry, before the first task", "Pin the CLI version. 2.3.0 was a malicious publish", "Keep the hub on 127.0.0.1 or set ROOM_SECRET, and run 3.0.30 or later" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 67, "maintenance": 85, "payments": 50, "reliability": 80, "schema": 77, "security": 57, "transparency": 60 }, "provenanceScore": 71 }, "connect": { "install": "npm i -g cline # Node 22+; or the VS Code extension saoudrizwan.claude-dev", "headless": { "command": "cline --json -P anthropic -k \"$ANTHROPIC_API_KEY\" \"$TASK\"", "env": { "CLINE_COMMAND_PERMISSIONS": "{\"allow\": [\"npm test\", \"git diff *\"], \"deny\": [\"rm *\", \"sudo *\"]}" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/cline" }, "area": "frameworks", "unitPrices": [ { "item": "ClinePass", "unit": "month", "usd": 9.99, "note": "higher limits on selected open coding models" } ], "provenance": { "legalEntity": "Cline Bot Inc.", "domain": "cline.bot", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://cline.bot/tos", "privacy": "https://cline.bot/privacy", "statusPage": "", "changelog": "https://github.com/cline/cline/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The pricing page and the CLI's package.json name Cline Bot Inc.", "cline.bot/.well-known/security.txt lists security@cline.bot and the Bugcrowd programme, and expires on 2027-12-31.", "The privacy and terms pages render only with JavaScript, so we couldn't read them." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cline.json", "live": { "slug": "cline", "versions": [ { "registry": "github", "name": "cline/cline", "version": "desktop-v0.0.43", "released": "2026-10-02", "seenAt": "2026-10-04T16:23:50.122249988Z" }, { "registry": "npm", "name": "cline", "version": "3.0.68", "seenAt": "2026-10-04T16:23:49.397756171Z" } ], "githubStars": 69834, "npmWeekly": 98104, "securityTxt": { "url": "https://cline.bot/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T23:59:00z", "checkedAt": "2026-10-04T15:15:58.106451592Z" }, "llmsTxt": { "url": "https://docs.cline.bot/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:24.546724133Z" }, "domain": { "domain": "cline.bot", "registered": "2024-09-30", "source": "https://rdap.nominet.uk/bot/domain/cline.bot", "checkedAt": "2026-10-04T13:10:22.024872209Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cline/cline/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-04T15:47:31.26658218Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "5240a7b29fea" }, { "url": "https://cline.bot/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:41:51.666461685Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "88b6bed4b147" }, { "url": "https://cline.bot/tos", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:41:53.851263496Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "936d18e4dc18" } ], "updatedAt": "2026-10-04T16:23:50.122249988Z" } }, "b": { "slug": "goose", "name": "goose", "vendor": "Agentic AI Foundation (originally Block)", "vendorUrl": "https://goose-docs.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Open-source general-purpose agent written in Rust, with a desktop app, a CLI and an embeddable server.", "url": "https://www.anchorterminal.com/tools/goose", "markdownUrl": "https://www.anchorterminal.com/tools/goose.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/goose.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/goose.json", "repo": "https://github.com/aaif-goose/goose", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@aaif/goose-acp" }, { "registry": "oci", "name": "ghcr.io/aaif-goose/goose" } ], "auth": "none", "authNotes": "No account of its own. Model keys go in the system keyring through `goose configure`, in provider environment variables, or come from an existing Claude, ChatGPT or Gemini subscription through ACP providers.", "pricing": "free", "pricingNotes": "Free and Apache-2.0, with nothing to buy. You pay your model provider, or nothing with a local model.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 54800, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://goose-docs.ai/docs/quickstart", "llmsTxt": "https://goose-docs.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "open-source", "local", "free", "no-card", "foundation", "llms-txt", "docker" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 73.9, "grade": "BB", "agentReady": true, "rank": 52, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2026-07-24. GHSA-r5pp-p5r8-466r (CVE-2026-72718, 7.0 at NVD), a repository's git `core.fsmonitor` setting ran arbitrary commands during `goose review` without approval or a sandbox. Fixed in 1.44.0 and published, inside six months, -2. https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r" ], "verdict": "Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.", "strengths": [ "Telemetry off until the user opts in, with the collected fields listed", "Four permission modes, per-tool always, ask or never rules, and an extension allowlist an administrator can host", "Headless `goose run` with `--output-format json` or `stream-json`, `--max-turns` and recipes with typed parameters, retries and success checks", "15+ providers, built-in local inference, and existing Claude, ChatGPT or Gemini subscriptions through ACP", "Weekly releases with dated notes, 12 in the 90 days to 1 October 2026" ], "weaknesses": [ "Autonomous mode, which approves every tool call, is the default", "No sandbox, and prompt-injection detection and adversary mode are off by default", "No privacy policy for goose, and the usage-data page doesn't say where data goes or how long it's kept", "No breaking-change section in any of the last ten release notes", "About 270 open issues, many recent ones unanswered" ], "agentNotes": [ "Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything", "Pass `--max-turns` with a real limit. The default is 1000", "Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories", "Use `--output-format json` and `--no-session` in CI, and check the exit code", "Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 73.9 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 60, "reliability": 77, "schema": 81, "security": 77, "transparency": 73 }, "provenanceScore": 53 }, "connect": { "install": "curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash # or: brew install block-goose-cli", "headless": { "command": "goose run --no-session --max-turns 30 --output-format json -t \"$TASK\"", "env": { "GOOSE_MODE": "smart_approve", "GOOSE_MODEL": "\u003cmodel\u003e", "GOOSE_PROVIDER": "\u003cprovider\u003e", "SECURITY_PROMPT_ENABLED": "true" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/goose" }, "area": "frameworks", "provenance": { "legalEntity": "Agentic AI Foundation (Linux Foundation)", "domain": "goose-docs.ai", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/aaif-goose/goose/releases", "securityTxt": "none", "checked": "2026-10-01", "notes": [ "The docs footer reads Copyright AAIF (Agentic AI Foundation). Block donated goose, and the escalation contact in SECURITY.md is still a block.xyz address.", "We found no terms or privacy page on goose-docs.ai and no security.txt among the docs site's static files.", "The repository moved from block/goose to aaif-goose/goose, announced on the goose blog on 7 April 2026." ], "score": 53 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/goose.json", "live": { "slug": "goose", "versions": [ { "registry": "github", "name": "aaif-goose/goose", "version": "v1.53.0", "released": "2026-10-02", "seenAt": "2026-10-04T16:29:00.933626606Z" }, { "registry": "npm", "name": "@aaif/goose-acp", "version": "1.53.0", "seenAt": "2026-10-04T16:29:00.469168357Z" } ], "githubStars": 54938, "npmWeekly": 228, "securityTxt": { "url": "https://goose-docs.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:04.830171027Z" }, "llmsTxt": { "url": "https://goose-docs.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:50.350800204Z" }, "domain": { "domain": "goose-docs.ai", "registered": "2026-03-30", "source": "https://rdap.identitydigital.services/rdap/domain/goose-docs.ai", "checkedAt": "2026-10-04T13:06:07.115541766Z" }, "updatedAt": "2026-10-04T16:29:00.933626606Z" } }, "summary": "goose has a score of 73.9 (BB) against Cline's 60.8 (C). Both do agent harness. The largest gap is security \u0026 auth, 20 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cline-vs-goose", "json": "https://www.anchorterminal.com/compare/cline-vs-goose.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cline-vs-goose.md", "slim": "https://www.anchorterminal.com/compare/cline-vs-goose.min.md" }, "markdown": "goose has a score of 73.9 (BB) against Cline's 60.8 (C). Both do agent harness. The largest gap is security \u0026 auth, 20 points.\n\n- Cline: grade C, 60.8/100, rank #239 of 452. Markdown https://www.anchorterminal.com/tools/cline.md · JSON https://www.anchorterminal.com/api/v1/tools/cline.json\n- goose: grade BB, 73.9/100, rank #52 of 452. Markdown https://www.anchorterminal.com/tools/goose.md · JSON https://www.anchorterminal.com/api/v1/tools/goose.json\n\n## Which one, for what\n\nPick Cline for nothing in particular (no category where it leads by five points or more).\n\nPick goose for agent ergonomics (+15), security \u0026 auth (+20), payments \u0026 pricing (+10).\n\n## Score by category\n\n| Category | Weight | Cline | goose | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 80 | 77 | Cline +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 81 | goose +4 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 82 | goose +15 |\n| Security \u0026 auth | 14% (17.5 this run) | 57 | 77 | goose +20 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 60 | goose +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 86 | goose +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 66 | 63 | Cline +3 |\n| Negative events | ≤15 | -8 | -2 | |\n| **Total** | | **60.8 · C** | **73.9 · BB** | |\n\n## Facts side by side\n\n| Fact | Cline | goose |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Cline Bot Inc. | Agentic AI Foundation (originally Block) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-10-01 | 2026-09-23 |\n| Popularity | 68k stars | 55k stars |\n| Agent reviews | 2/5 (2) | 2.5/5 (2) |\n\n## Verdicts\n\n**Cline.** Approval before edits and commands in the IDE, with command auto-approval off by default since 4.0.0. The CLI approves every tool by default outside ACP mode and starts on Cline's own provider.\n\n**goose.** Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.\n\n## Before you call either\n\n### Cline\n\n1. Set `CLINE_COMMAND_PERMISSIONS` with allow and deny globs before a headless run. The CLI approves every tool by default\n2. Pick a provider with `-P` and a key, or run `cline auth`. The default provider needs a Cline sign-in\n3. Untick 'Allow error and usage reporting', or turn off VS Code telemetry, before the first task\n4. Pin the CLI version. 2.3.0 was a malicious publish\n5. Keep the hub on 127.0.0.1 or set ROOM_SECRET, and run 3.0.30 or later\n\n### goose\n\n1. Set `GOOSE_MODE=smart_approve` or `approve` before a run. The default approves everything\n2. Pass `--max-turns` with a real limit. The default is 1000\n3. Set `SECURITY_PROMPT_ENABLED=true` when the task reads web pages or untrusted repositories\n4. Use `--output-format json` and `--no-session` in CI, and check the exit code\n5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect\n\n## Other comparisons with Cline or goose\n\n- [Aider vs Cline](https://www.anchorterminal.com/compare/aider-vs-cline.md)\n- [Aider vs goose](https://www.anchorterminal.com/compare/aider-vs-goose.md)\n- [Claude Code vs Cline](https://www.anchorterminal.com/compare/claude-code-vs-cline.md)\n- [Claude Code vs goose](https://www.anchorterminal.com/compare/claude-code-vs-goose.md)\n- [Cline vs Cursor CLI](https://www.anchorterminal.com/compare/cline-vs-cursor-cli.md)\n- [Cline vs Gemini CLI](https://www.anchorterminal.com/compare/cline-vs-gemini-cli.md)\n- [Cline vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/cline-vs-github-copilot-cli.md)\n- [Cline vs OpenAI Codex](https://www.anchorterminal.com/compare/cline-vs-openai-codex.md)\n- [Cline vs OpenCode](https://www.anchorterminal.com/compare/cline-vs-opencode.md)\n- [Cline vs OpenHands](https://www.anchorterminal.com/compare/cline-vs-openhands.md)\n- [Cursor CLI vs goose](https://www.anchorterminal.com/compare/cursor-cli-vs-goose.md)\n- [Gemini CLI vs goose](https://www.anchorterminal.com/compare/gemini-cli-vs-goose.md)\n- [GitHub Copilot CLI vs goose](https://www.anchorterminal.com/compare/github-copilot-cli-vs-goose.md)\n- [goose vs OpenAI Codex](https://www.anchorterminal.com/compare/goose-vs-openai-codex.md)\n- [goose vs OpenCode](https://www.anchorterminal.com/compare/goose-vs-opencode.md)\n- [goose vs OpenHands](https://www.anchorterminal.com/compare/goose-vs-openhands.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cline vs goose", "url": "" } ], "description": "goose has a score of 73.9 (BB) against Cline's 60.8 (C). Both do agent harness. The largest gap is security \u0026 auth, 20 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Cline C 60.8", "goose BB 73.9", "scores" ], "h1": "Cline vs goose", "image": "https://www.anchorterminal.com/assets/og/compare-cline-vs-goose.png", "path": "/compare/cline-vs-goose", "published": "2026-10-01", "section": "tools", "title": "Cline vs goose for AI agents, C 60.8 vs BB 73.9 | Anchor Terminal", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/cline-vs-goose" }, "tokens": { "markdown": 1450, "slim": 330 }, "version": 1 }