Skip to content
ai-supply.store
DiscoverCategoriesLeaderboardsCommunityAgent APIFAQ
Sign inSign up free
catalog / Coding / aider
◉AgentCodingFree

aider

AI pair programming tool in your terminal — chat with LLMs to edit code across your entire git repository.

@ai-supply
Installs226k
⟳ upstream v0.86.0 · updated 11mo ago
↗ Source repository
← More CodingCoding leaderboard →How we grade security →Source ↗
! Grade B · 75/100 · ReviewSecurity assessment
✓No compromise signals32capabilities surfaced1known CVE7of 20 OWASP controls clear
External endpoints declaredBroad capability surfaceExternal endpoints declaredBroad capability surface
scanned 16d ago·osv · gitleaks · opengrep · picklescan + heuristics·full breakdown in the Security tab ↓

aider

aider is an AI pair programming tool that runs in your terminal and uses LLMs to make changes to your codebase. Unlike chat-only interfaces, aider directly edits files, creates git commits, runs tests, and can work across a whole repo simultaneously — making it ideal for feature development, refactoring, and bug fixing.

Key Features

  • Direct file editing with automatic git commits — full change history
  • Multi-file context: drop in any files and aider understands cross-file dependencies
  • Supports 60+ LLMs: GPT-4, Claude Opus/Sonnet, Gemini, DeepSeek, and local models via Ollama
  • In-chat shell commands, linting, and test running for iterative development
  • Repository map (tree-sitter based) for accurate whole-codebase awareness

Quick Start

pip install aider-chat
export ANTHROPIC_API_KEY=sk-ant-...
aider --model claude-sonnet-4-5 src/main.py src/utils.py

Inside the chat:

> Add a function to parse JSON from a URL with error handling and retry logic

npx ai-supply add aider-ai-pair-programmer

Curated mirror of the open-source aider (Apache-2.0). Get it from the source.

Rating rank
#1
of 27 in Coding
Install rank
#7
of 27 in Coding
Security score
75/100 · B
review
Security rank
#19
of 27 in Coding
Installs
226k
cat avg 157k
This listing vs category average
Installs
this
cat avg
Security (of 100)
this
cat avg
Adoption trend
See the Coding leaderboard →
! Security: Review · 7575/100 · grade Bscanned 16d ago
✓ no compromise signals33 risk-surface · 8/20 OWASP controls flagged

Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.

What this capability can do · med confidence (static)
⚑ filesystem⚑ shell⚑ network⚑ secretsinstall: script:Aider-AI-aider-5dc9490/aider/website/install.sh
egress → aider.chat, www.python.org, pycqa.github.io, black.readthedocs.io, docs.pytest.org, pre-commit.com, openrouter.ai, img.shields.io +32

Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).

OWASP Top 10 for LLM Applications
⚠LLM03Supply Chaincritical
Vulnerable/compromised dependencies, models or archives in the artifact.
•Dependency manifest — 110 pip requirements declared · Aider-AI-aider-5dc9490/requirements.txtrisk surface
•Vulnerable dependencies — 161 known vulnerabilities in: aiohttp@3.13.3, diskcache@5.6.3, gitpython@3.1.46, idna@3.11.0, litellm@1.82.3, pillow@12.1.1, pygments@2.19.2, requests@2.32.5 (CWE-1395)known CVE · -25 pts
⚠LLM02Sensitive Information Disclosurehigh
Secrets, credentials or PII shipped inside the artifact.
•Embedded credentials — found: hardcoded credential · Aider-AI-aider-5dc9490/aider/website/examples/census.md (CWE-798)expected
•Low-confidence secret match — 1 possible: generic-api-key · Aider-AI-aider-5dc9490/aider/analytics.py (CWE-798)risk surface
⚠LLM05Improper Output Handlinghigh
Code that pipes model/user output into shell, eval, SQL or paths unsafely.
•Suspicious code patterns — OS command execution · Aider-AI-aider-5dc9490/aider/commands.py (CWE-78)risk surface
•Suspicious code patterns — pipe-to-shell install · Aider-AI-aider-5dc9490/aider/website/_posts/2025-01-15-uv.md (CWE-494)risk surface
•Suspicious code patterns — dynamic code execution · Aider-AI-aider-5dc9490/aider/website/assets/asciinema/asciinema-player.min.js (CWE-95)risk surface
•Suspicious code patterns — destructive rm -rf /; pipe-to-shell install · Aider-AI-aider-5dc9490/benchmark/Dockerfile (CWE-78)risk surface
•Suspicious code patterns — destructive rm -rf /; world-writable chmod 777 · Aider-AI-aider-5dc9490/docker/Dockerfile (CWE-78)risk surface
•Suspicious code patterns — environment/secret exfiltration · Aider-AI-aider-5dc9490/tests/basic/test_model_info_manager.py (CWE-200)risk surface
•Suspicious code patterns — destructive rm -rf /; OS command execution · Aider-AI-aider-5dc9490/tests/fixtures/chat-history-search-replace-gold.txt (CWE-78)risk surface
⚠LLM06Excessive Agencyhigh
Over-broad tool/permission surface or unrestricted egress.
•External endpoints declared — 1 distinct host(s) · Aider-AI-aider-5dc9490/.github/workflows/check_pypi_version.ymlrisk surface
•Broad capability surface — 3 high-impact capability categories referenced — verify least-privilege · Aider-AI-aider-5dc9490/.github/workflows/pages.yml (CWE-272)risk surface
•External endpoints declared — 7 distinct host(s) · Aider-AI-aider-5dc9490/CONTRIBUTING.mdrisk surface
•Broad capability surface — 4 high-impact capability categories referenced — verify least-privilege · Aider-AI-aider-5dc9490/HISTORY.md (CWE-272)risk surface
•External endpoints declared — 3 distinct host(s) · Aider-AI-aider-5dc9490/HISTORY.mdrisk surface
•External endpoints declared — 13 distinct host(s) · Aider-AI-aider-5dc9490/README.mdrisk surface
•External endpoints declared — 2 distinct host(s) · Aider-AI-aider-5dc9490/aider/analytics.pyrisk surface
•External endpoints declared — 4 distinct host(s) · Aider-AI-aider-5dc9490/aider/models.pyrisk surface
•External endpoints declared — 5 distinct host(s) · Aider-AI-aider-5dc9490/aider/website/_posts/2024-06-02-main-swe-bench.mdrisk surface
•External endpoints declared — 8 distinct host(s) · Aider-AI-aider-5dc9490/aider/website/_posts/2024-11-21-quantization.mdrisk surface
•Egress to a private/loopback host — 127.0.0.1 · Aider-AI-aider-5dc9490/aider/website/_posts/2025-01-28-deepseek-down.md (CWE-918)risk surface
•External endpoints declared — 9 distinct host(s) · Aider-AI-aider-5dc9490/aider/website/_posts/2025-01-28-deepseek-down.mdrisk surface
•External endpoints declared — 15 distinct host(s) · Aider-AI-aider-5dc9490/aider/website/index.htmlrisk surface
•External endpoints declared — 6 distinct host(s) · Aider-AI-aider-5dc9490/aider/website/install.ps1risk surface
•External endpoints declared — 11 distinct host(s) · Aider-AI-aider-5dc9490/tests/fixtures/chat-history-search-replace-gold.txtrisk surface
⚠LLM07System Prompt Leakagehigh
Secrets, internal hosts or proprietary logic exposed in shipped prompts.
•Internal host / private infrastructure reference — shipped content references a private IP range or internal-only host · Aider-AI-aider-5dc9490/aider/website/docs/usage/not-code.md (CWE-200)risk surface
•Embedded credentials — found: hardcoded credential · Aider-AI-aider-5dc9490/aider/website/examples/census.md (CWE-798)expected
•Low-confidence secret match — 1 possible: generic-api-key · Aider-AI-aider-5dc9490/aider/analytics.py (CWE-798)risk surface
⚠LLM10Unbounded Consumptionmedium
Unbounded loops/recursion causing DoS or runaway cost.
Enforced at runtime by the gateway (rate limits + spend caps + size caps); static check flags unbounded loops.
•Potentially unbounded loop — an infinite loop (while True / while(1) / for(;;)) may cause runaway consumption · Aider-AI-aider-5dc9490/aider/coders/base_coder.py (CWE-835)risk surface
§LLM09MisinformationGovernance
Artifacts designed to produce false/deceptive output.
Detectable only by runtime behavioral evaluation; addressed via responsible-use attestation.
✓LLM01Prompt InjectionPassed
✓LLM04Data and Model PoisoningPassed
Backdoors/poisoning in training data or serialized models.
Behavioral poisoning needs model execution; static check covers unsafe serialization + dataset skew only.
✓LLM08Vector and Embedding WeaknessesPassed
PII or plaintext source leakage in embedding/vector exports.
Embedding inversion/poisoning is largely runtime; static check covers PII in vector exports.
OWASP Machine Learning Security Top 10
⚠ML06AI Supply Chaincritical
Compromised PyPI/npm packages, typosquats, unsafe serialized models.
•Dependency manifest — 110 pip requirements declared · Aider-AI-aider-5dc9490/requirements.txtrisk surface
•Vulnerable dependencies — 161 known vulnerabilities in: aiohttp@3.13.3, diskcache@5.6.3, gitpython@3.1.46, idna@3.11.0, litellm@1.82.3, pillow@12.1.1, pygments@2.19.2, requests@2.32.5 (CWE-1395)known CVE · -25 pts
⚠ML09Output Integrityhigh
Middleware tampering with model outputs in transit.
Gateway enforces TLS + response integrity; static check flags output-rewriting code.
•Suspicious code patterns — OS command execution · Aider-AI-aider-5dc9490/aider/commands.py (CWE-78)risk surface
•Suspicious code patterns — pipe-to-shell install · Aider-AI-aider-5dc9490/aider/website/_posts/2025-01-15-uv.md (CWE-494)risk surface
•Suspicious code patterns — dynamic code execution · Aider-AI-aider-5dc9490/aider/website/assets/asciinema/asciinema-player.min.js (CWE-95)risk surface
•Suspicious code patterns — destructive rm -rf /; pipe-to-shell install · Aider-AI-aider-5dc9490/benchmark/Dockerfile (CWE-78)risk surface
•Suspicious code patterns — destructive rm -rf /; world-writable chmod 777 · Aider-AI-aider-5dc9490/docker/Dockerfile (CWE-78)risk surface
•Suspicious code patterns — environment/secret exfiltration · Aider-AI-aider-5dc9490/tests/basic/test_model_info_manager.py (CWE-200)risk surface
•Suspicious code patterns — destructive rm -rf /; OS command execution · Aider-AI-aider-5dc9490/tests/fixtures/chat-history-search-replace-gold.txt (CWE-78)risk surface
§ML01Input Manipulation (Adversarial)Governance
Models vulnerable to adversarial perturbations.
Requires runtime robustness evaluation; addressed via publisher robustness attestation.
§ML03Model InversionGovernance
Training data reconstructable from a model's outputs.
Runtime/evaluation property; addressed via model-card data-provenance + DP attestation.
§ML04Membership InferenceGovernance
Determining whether a record was in the training set.
Runtime/evaluation property; addressed via overfitting disclosure + DP attestation.
§ML08Model SkewingGovernance
Models trained on skewed data producing biased output.
Requires fairness evaluation; addressed via model-card bias/limitations disclosure.
✓ML02Data PoisoningPassed
Poisoned training datasets with triggers or anomalous distributions.
Static check covers trigger phrasing, PII and label skew; full poisoning detection is runtime.
✓ML05Model TheftPassed
Unlicensed re-distribution / license-incompatible derivatives.
Static check verifies license declaration; extraction throttling is runtime.
✓ML07Transfer Learning AttackPassed
Backdoored base models / LoRA adapters propagating to derivatives.
Backdoor detection needs behavioral probing; static check covers unsafe serialization + provenance.
✓ML10Model Poisoning (Weights)Passed
Tampered model weight files; integrity must be verifiable.
Static check enforces safe formats + records a content hash for downstream verification.
Other findings (50) · hygiene / uncategorized
•Unrecognized file type — '.dockerignore' is not on the allowlist · Aider-AI-aider-5dc9490/.dockerignorerisk surface
•Unrecognized file type — '.flake8' is not on the allowlist · Aider-AI-aider-5dc9490/.flake8risk surface
•Unrecognized file type — '.gitignore' is not on the allowlist · Aider-AI-aider-5dc9490/.gitignorerisk surface
•Unrecognized file type — '.?' is not on the allowlist · Aider-AI-aider-5dc9490/CNAMErisk surface
•Unrecognized file type — '.in' is not on the allowlist · Aider-AI-aider-5dc9490/MANIFEST.inrisk surface
•Unrecognized file type — '.scm' is not on the allowlist · Aider-AI-aider-5dc9490/aider/queries/tree-sitter-language-pack/arduino-tags.scmrisk surface
•Suspicious network references — suspicious TLD (1 URLs) · Aider-AI-aider-5dc9490/aider/website/_data/deepseek-down.ymlrisk surface
•Suspicious network references — suspicious TLD (2 URLs) · Aider-AI-aider-5dc9490/aider/website/_data/quant.ymlrisk surface
•Suspicious network references — URL shortener (9 URLs) · Aider-AI-aider-5dc9490/aider/website/_posts/2024-11-21-quantization.mdrisk surface
•Suspicious network references — raw IP URL, suspicious TLD (12 URLs) · Aider-AI-aider-5dc9490/aider/website/_posts/2025-01-28-deepseek-down.mdrisk surface
•Unrecognized file type — '.scss' is not on the allowlist · Aider-AI-aider-5dc9490/aider/website/_sass/custom/custom.scssrisk surface
•Unrecognized file type — '.webmanifest' is not on the allowlist · Aider-AI-aider-5dc9490/aider/website/assets/icons/site.webmanifestrisk surface
•Unrecognized file type — '.jsonl' is not on the allowlist · Aider-AI-aider-5dc9490/aider/website/assets/sample-analytics.jsonlrisk surface
•Unrecognized file type — '.env' is not on the allowlist · Aider-AI-aider-5dc9490/aider/website/assets/sample.envrisk surface
•Suspicious network references — raw IP URL (4 URLs) · Aider-AI-aider-5dc9490/aider/website/docs/llms/ollama.mdrisk surface
•Disallowed file type — '.ps1' executables are not permitted · Aider-AI-aider-5dc9490/aider/website/install.ps1 (CWE-434)risk surface
•Unrecognized file type — '.ini' is not on the allowlist · Aider-AI-aider-5dc9490/pytest.inirisk surface
•Unrecognized file type — '.jekyll' is not on the allowlist · Aider-AI-aider-5dc9490/scripts/Dockerfile.jekyllrisk surface
•Suspicious network references — raw IP URL (36 URLs) · Aider-AI-aider-5dc9490/tests/basic/test_coder.pyrisk surface
•Unrecognized file type — '.ino' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/arduino/test.inorisk surface
•Unrecognized file type — '.c' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/c/test.crisk surface
•Unrecognized file type — '.chatito' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/chatito/test.chatitorisk surface
•Unrecognized file type — '.clj' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/clojure/test.cljrisk surface
•Unrecognized file type — '.lisp' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/commonlisp/test.lisprisk surface
•Unrecognized file type — '.cpp' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/cpp/test.cpprisk surface
•Unrecognized file type — '.cs' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/csharp/test.csrisk surface
•Unrecognized file type — '.d' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/d/test.drisk surface
•Unrecognized file type — '.dart' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/dart/test.dartrisk surface
•Unrecognized file type — '.el' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/elisp/test.elrisk surface
•Unrecognized file type — '.ex' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/elixir/test.exrisk surface
•Unrecognized file type — '.elm' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/elm/test.elmrisk surface
•Unrecognized file type — '.gleam' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/gleam/test.gleamrisk surface
•Unrecognized file type — '.hs' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/haskell/test.hsrisk surface
•Unrecognized file type — '.tf' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/hcl/test.tfrisk surface
•Unrecognized file type — '.kt' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/kotlin/test.ktrisk surface
•Unrecognized file type — '.lua' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/lua/test.luarisk surface
•Unrecognized file type — '.m' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/matlab/test.mrisk surface
•Unrecognized file type — '.ml' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/ocaml/test.mlrisk surface
•Unrecognized file type — '.mli' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/ocaml_interface/test.mlirisk surface
•Unrecognized file type — '.php' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/php/test.phprisk surface
•Unrecognized file type — '.pony' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/pony/test.ponyrisk surface
•Unrecognized file type — '.properties' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/properties/test.propertiesrisk surface
•Unrecognized file type — '.ql' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/ql/test.qlrisk surface
•Unrecognized file type — '.r' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/r/test.rrisk surface
•Unrecognized file type — '.rkt' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/racket/test.rktrisk surface
•Unrecognized file type — '.scala' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/scala/test.scalarisk surface
•Unrecognized file type — '.sol' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/solidity/test.solrisk surface
•Unrecognized file type — '.swift' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/swift/test.swiftrisk surface
•Unrecognized file type — '.rules' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/udev/test.rulesrisk surface
•Unrecognized file type — '.zig' is not on the allowlist · Aider-AI-aider-5dc9490/tests/fixtures/languages/zig/test.zigrisk surface
✔ verified source · pinned Aider-AI-aider-5dc9490
Check against a policy

The same gate an agent runs before installing (POST /api/v1/trust/aider-ai-pair-programmer/check). Click a policy:

Consume aider programmatically. Authenticate with an API key or session — see Authorize an agent.

# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/aider-ai-pair-programmer

# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/aider-ai-pair-programmer/check \
  -H "Content-Type: application/json" \
  -d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'

# CLI
npx ai-supply add aider-ai-pair-programmer

# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/aider-ai-pair-programmer/install \
  -H "Authorization: Bearer $AIM_KEY"

# MCP tool
install_listing({ "slug": "aider-ai-pair-programmer" })
OpenAPI spec →
vlatest
! Security: Review · 751mo ago

Curated mirror — latest upstream source. See the repository for tagged releases.

Sign in and install this listing to leave a review.

More from @ai-supply

View profile →
◉Agent
MetaGPT
Multi-agent framework that assigns GPT roles (PM, engineer, QA) to solve complex software tasks end-to-end.
↓ 1.0M
⇄Connector
vLLM
High-throughput, memory-efficient LLM inference engine with PagedAttention and continuous batching.
↓ 892k
⇄Connector
Meilisearch
Lightning-fast open-source search engine with typo-tolerance, semantic hybrid search, and sub-50ms response times.
↓ 811k
△Eval
Weights & Biases (wandb)
ML experiment tracking and visualization — log metrics, hyperparameters, models, and media in real time.
↓ 784k
ai-supply.store

Free, security-vetted AI capabilities — skills, MCPs, plugins, agents, datasets and more, each graded and freshness-tracked, and built for humans and agents alike.

api · v3.1status · all green
Contact
support@ai-supply.storesecurity@ai-supply.store
Catalog
  • Discover
  • Categories
  • Leaderboards
  • Benchmarks
  • Security
  • Scan a repo
Community
  • Community
  • FAQ
For agents
  • Quickstart (60s)
  • Authorize an agent
  • Agent API
  • OpenAPI spec
For builders
  • Publish
  • Dashboard
Account
  • Create account
  • Sign in
  • Settings
Legal
  • Terms
  • Publisher Agreement
  • Acceptable Use
  • Privacy