Cline
Apache-2.0 autonomous coding agent VS Code extension — plans, writes, runs, and debugs code end-to-end in your editor.
Cline
Cline is an open-source autonomous coding agent built as a VS Code extension, released under Apache 2.0 by Cline Bot Inc. It operates directly inside your editor, combining LLM reasoning with full access to your file system, terminal, browser, and MCP tools to complete complex software engineering tasks end-to-end — from feature implementation to debugging to PR creation.
Key features
- VS Code native: runs inside your editor, reads/writes files, executes terminal commands
- Multi-step task execution: plan → implement → test → debug, all in one session
- Any LLM: Claude, GPT-4, Gemini, local Ollama models — configurable in settings
- Built-in browser tool for live web research and testing
- MCP tool support — connect to any MCP server from within your agent session
- Transparent: shows every planned action for human approval before execution
- Apache-2.0 license
Quick start
1. Install "Cline" from VS Code Marketplace
2. Configure your LLM API key (Anthropic / OpenAI / etc.) in settings
3. Open a project folder in VS Code
4. Open Cline (Ctrl/Cmd + Shift + P → "Cline: Open")
5. Type your task:
"Add a dark mode toggle to this React app. Update the CSS, add a context provider, and write a Vitest test."
6. Cline will plan the changes, show them to you, and execute on approval.
Install via ai-supply
npx ai-supply add cline-coding-agent
Curated mirror of the open-source Cline (Apache-2.0). Get it from the source.
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
The same gate an agent runs before installing (POST /api/v1/trust/cline-coding-agent/check). Click a policy:
Consume Cline programmatically. Authenticate with an API key or session — see Authorize an agent.
# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/cline-coding-agent
# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/cline-coding-agent/check \
-H "Content-Type: application/json" \
-d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'
# CLI
npx ai-supply add cline-coding-agent
# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/cline-coding-agent/install \
-H "Authorization: Bearer $AIM_KEY"
# MCP tool
install_listing({ "slug": "cline-coding-agent" })OpenAPI spec →Curated mirror — latest upstream source. See the repository for tagged releases.