Junie CLI

# Fix list: Junie CLI

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/junie, the October 2026 research run, assessed 18 October 2026. Grade D, 53.2 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Junie CLI: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 45 out of 100, up to 11 more on the total

Why it scored 45: Local-package reading, the same as the other closed-source harnesses. Install scripts for macOS, Linux and Windows on x86-64 and ARM64, a Homebrew tap and npm, with SHA-256 sums checked against a published feed, but the script carries on without a sum for an unlisted version and npm sits five weeks behind at 3110.7.0 (17). No public CI or test suite. No source is published and the repository has no workflow files (0). The GitHub tracker the README names had 6 open and 75 closed issues and 4 open and 40 closed pull requests on 18 October, though response times couldn't be read. JetBrains' YouTrack project JUNIE, which covers the plugin too, had 1,127 unresolved of 1,928 issues, with 67 opened and 30 resolved in the 30 days to 18 October, and most recent CLI reports had no reply (12). What's New dates every build, but entries are one line and no breaking change is called out, and versions are a date plus a build number. Retired flags are listed as deprecated compatibility options (6). JetBrains said Junie left Beta on 17 June 2026, but the headless page dated 15 October still calls the CLI an EAP, and hooks and sandbox mode are EAP-only (10). 17+0+12+6+10 = 45.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Security & auth, 56 out of 100, up to 7.7 more on the total

Why it scored 56: Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. A browser login, a long-lived Junie API key with no scopes we found, or provider keys passed as flags or environment variables. The CLI's statistics default isn't stated (13). The allowlist asks before terminal commands, MCP tools, edits outside the project, reads outside it and secret files, and checks every part of chained, nested and multi-line commands. Brave mode is interactive only. Sandbox mode limits writes and hides `~/.ssh`, but it's EAP-only, off by default, missing on Windows, and leaves the network open by default (12). Interactive runs keep an untrusted project's MCP servers, hooks and skills unloaded and a project can't widen the sandbox, but one-shot, piped, ACP and Gateway runs trust every project by design, and the docs say to run them only in trusted projects (9). `/usage` shows per-session cost and sessions are stored, and PreToolUse hooks in batch runs can log or block tools, but they're EAP, and no audit log for the CLI was found (7). A coordinated disclosure policy (updated 10 October 2026) and a security.txt contact, CVEs published through NVD and a fixed-issues page (OSV lists no advisory for @jetbrains/junie, and the repository has no SECURITY.md), discretionary rewards with no formal bounty, and SOC 2 per the Junie homepage (15). 13+12+9+7+15 = 56.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 3. Agent ergonomics, 55 out of 100, up to 7.3 more on the total

Why it scored 55: Framework reading, adapted to a harness driven by a pipeline. MCP tools can be allowed per server prefix, and default MCP, skill, agent and config locations can each be switched off, with no deferred tool loading found (15). text, json and json-stream output and `--json-output-file`. Remote mode mentions a step limit, but no turn, time or spend cap for a headless run was documented (10). No exit codes. A Stop hook can end a task with a failure status, and StopFailure names the failure category (8). Sessions resume with `--session-id` or `--resume`, and worktrees isolate parallel sessions (14). One command with `--auth` and a dynamically chosen default model, a GitHub Action and GitLab CI, and no SDK (8). 15+10+8+14+8 = 55.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Payments & pricing, 42 out of 100, up to 7.2 more on the total

Why it scored 42: Harness reading of the published rubric. No payment protocol (0). Plan prices and the US$1 credit are public without a login, but per-model credit rates and Junie API key usage rates weren't found (12). Junie Lite is free with a JetBrains account and no card (20). Judgement call. The docs present BYOK keys and custom endpoints such as Ollama as alternatives to a JetBrains sign-in, so a pipeline holding a provider key needs no JetBrains signup, but the headless page says a token is required and a Junie API key is created by hand at junie.jetbrains.com/cli (10). 0+12+20+10 = 42.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 5. Schema & documentation, 62 out of 100, up to 6.2 more on the total

Why it scored 62: Framework reading. A CLI reference that lists every flag with examples, documented formats for the allowlist, config.json, custom model profiles and hook payloads, and ACP as the editor protocol. No schema for the json or json-stream output was found, and the OpenAPI covers only update metadata (12). llms.txt exists and claims Markdown by content negotiation, but docs pages came back as HTML with `Accept: text/markdown` and llms.txt doesn't index them (6). Pages say when to use ACP and when not, and how trust works in each launch mode, but the headless page doesn't say what happens when an action needs approval (13). Output formats, effort levels, channels and allowlist actions are enumerated, though the effort values differ between the CLI reference and the model page (11). Examples throughout and nine StopFailure categories in the hooks page, but no exit codes or error format (8). A dated release list and dated docs pages (12). 12+6+13+11+8+12 = 62.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 6. Maintenance & community, 72 out of 100, up to 2.5 more on the total

Why it scored 72: Release 26.10.12 (3659.7) on 16 October 2026 (30). What's New lists builds on 6, 12, 13, 15 and 16 October alone, npm shows weekly versions from March, and the repository has 1,133 tags in 90 days, most of them nightly builds (20). A GitHub tracker with 6 open and 75 closed issues and 4 open and 40 closed pull requests, a public YouTrack project with 30 issues resolved in 30 days against 67 opened, mostly without replies on recent CLI reports, and a Discord server. Response times on GitHub couldn't be read (13). No SDK and no registry entry. The GitHub Action is at v1 and GitLab CI is documented, and ACP is kept current (6). Closed source with no workflow files in the repository, so no CI or dependency health to read. The installer checks sums, and npm is five weeks behind the release feed (3). 30+20+13+6+3 = 72.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Transparency & trust, 78 out of 100, up to 1.9 more on the total

Made of editorial 57, provenance 99.

Why it scored 78: Proprietary, with clear terms. The JetBrains AI Terms of Service (version 2.1, effective 30 September 2025) name AI Assistant and Junie, though the Junie EAP terms from December 2024 still call Junie a plugin (15). The terms rule out training on inputs without consent and list AI subcontractors with 30 days' notice of new ones (page updated 29 September 2026, naming OpenAI, Google, Anthropic and SpaceXAI for Junie). The AI FAQ says nothing persists unless detailed data collection is on, retained up to a year, and that it's on by default for non-commercial licences. Security monitoring keeps data for an unstated limited period (22). The terms promise 30 days' email notice before JetBrains AI is discontinued, but Junie Lite's model may change without notice and model aliases change without a stated period (10). A per-run override for anonymous statistics is documented, with no stated default and no list of what is sent (10). 15+22+10+10 = 57.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Privacy policy: read, states 7 of the 8 things a reader expects (9.3 of 10)

## Deductions

Each comes off the total. A fixed and documented problem counts for less at the next check.

- 2026-10-15. CVE-2026-111091, high (CVSS 7.8, CWE-829). Code execution was possible through an untrusted project's MCP server configuration in Junie CLI before 26.8.3. Fixed and published through NVD and JetBrains' fixed-issues page, inside six months (https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Junie). -2
- 2026-04-17. CVE-2026-41153, medium (CVSS 5.8 from JetBrains). Command execution through a malicious project file in JetBrains Junie before 252.549.29, a plugin build number. Judgement call, 1 point, since the IDE plugin and the CLI run the same agent per JetBrains' 17 June 2026 post. Fixed and published (https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Junie). -1

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: CI results and maintainer response times on JetBrains/junie. Counts, tags, workflow files and OSV advisories come from our GitHub record
- unchecked: per-model AI Credit rates and Junie API key usage pricing. junie.jetbrains.com/cli and the tokens page render only with JavaScript, so plan prices come from the data embedded in the JetBrains AI store page
- What a headless run does when an action needs approval, since `--brave` is interactive only and the headless page is silent
- Whether a headless run works with only a BYOK key or a custom endpoint and no JetBrains sign-in, given the headless page says a token is required
- The CLI's default for anonymous usage statistics and what it sends
- Whether the CLI is GA. JetBrains said Junie left Beta on 17 June 2026, while the headless page dated 15 October 2026 still says EAP
- What the Gateway launch mode named on the headless page is. No page for it was found
- The repository's first commit is 7 April 2025, and no tag date earlier than the npm version of 2 March 2026 was available to set firstReleased from

## Weaknesses

- One-shot, piped, ACP and Gateway runs trust the project by design and load its MCP servers, hooks, agents and skills without a prompt
- Sandbox mode is EAP-only, off by default, absent on Windows, and leaves network access open by default
- No documented exit codes, output schema or turn and spend cap for headless runs
- CVE-2026-111091 (published 15 October 2026, high) allowed code execution through an untrusted project's MCP configuration before 26.8.3
- Closed source, and the CLI's default for anonymous usage statistics isn't stated

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Run headless only in repositories you trust. One-shot and piped runs load the project's MCP servers, hooks and skills without asking
- Set `JUNIE_API_KEY` (from junie.jetbrains.com/cli) or a provider key such as `JUNIE_ANTHROPIC_API_KEY` in CI. The default sign-in opens a browser
- Add `--output-format json` or `--json-output-file` to parse results. Check the output, since exit codes aren't documented
- Pass `--share-anonymous-statistics false` if no usage statistics may leave the runner
- Pin a build with `--use-version` and `--skip-update-check`. The CLI updates itself on start by default

## What the review panel asked for

- breaking-change notes
- state the CLI's stability
- publish per-model credit rates
- a spend cap for headless runs
- output schema and exit codes
- docs indexed in llms.txt
- workspace trust for headless
- document headless approvals

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.