Cline
Open-source autonomous coding agent — 5M+ installs (most-adopted OSS coding extension), 62K GitHub stars, $110M valuation. @cline/sdk (Apache 2.0) agent runtime powers CLI + Kanban (IDE extensions mid-migration), with native agent teams/subagents, CRON scheduling, checkpointing,
Dimension breakdown
Score · confidenceOpen-source autonomous coding agent — 5M+ installs (most-adopted OSS coding extension), 62K GitHub stars, $110M valuation. @cline/sdk (Apache 2.0) agent runtime powers CLI + Kanban (IDE extensions mid-migration), with native agent teams/subagents, CRON scheduling, checkpointing, MCP. Extension v3.86.0 (May 28) adds Claude Opus 4.8 support; CLI v3.0.14 ships headless --json + auto-approve for CI/CD. JetBrains plugin now GA across all major JetBrains IDEs. CLI reports 74.2% on Terminal-Bench (claude-opus-4.7) vs Anthropic's published 69.4% for Claude Code — vendor-reported, not third-party adjudicated.
Oracle NetSuite SuiteCloud Developer Assistant officially built on Cline. Roo Code (3M installs) shut down May 15 and merged users back to Cline. 30+ providers via BYOK; deliberately no codebase indexing (file-traversal + 1M-token context).
pattern of three serious events in ~9 months (Aug 2025 Mindgard vulns, Feb 2026 Clinejection + npm supply-chain compromise installing OpenClaw, May 2026 CVE-2026-44211 CVSS 9.3-9.7 Kanban WebSocket hijack) — ALL patched; Feb post-mortem added OIDC provenance attestations, removed GH Actions cache from credential workflows, commissioned third-party CI/CD audits.
No SOC 2 / ISO 27001 remains the primary blocker for regulated enterprise procurement. $20/user/month Teams tier (first 10 seats free).
Use cases
Not yet assessed — this section fills in as ACES research covers the tool.
Risk flags
No active caps — no risk flags apply to this tool right now.
Status rationale
Tracked (held under Opus 4.8 re-baseline). SOC 2 / ISO 27001 absent and a security pattern (three serious events in ~9 months, all now patched) warrant continued research-based monitoring, despite strong enterprise signals (Oracle NetSuite SDA built on Cline, Roo Code consolidation, @cline/sdk runtime, air-gap deployment, 5M+ installs, $110M valuation).
Advancement to Assessed is gated on direct/third-party evaluation evidence; the missing certifications and elevated disclosure cadence — even with every issue patched — keep the tool at Tracked. Not Validated: no SOC 2, no independent audit of the coding agent, and the security pattern remain open blockers.
Movement triggers
Upgrade to Assessed if: SOC 2 Type II / ISO 27001 obtained (primary trigger); OR direct hands-on or third-party evaluation evidence accrues; OR independent third-party benchmark validates the Terminal-Bench claims; OR @cline/sdk adoption demonstrated outside Cline (external products building on the runtime); AND 90+ days without a further critical CVE. Downgrade to Detected if: a fourth serious security event in <12 months; IDE-extension SDK migration stalls; enterprise references (Oracle NetSuite SDA) retract; or community fragments post-Roo-consolidation.
Risks & limitations
Not yet assessed — this section fills in as ACES research covers the tool.
Integration surface
Not yet assessed — this section fills in as ACES research covers the tool.
Adoption & benchmarks
Not yet assessed — this section fills in as ACES research covers the tool.
Spotted something wrong or missing here? Suggest a change →
Per-source contributions
Click any dimension to see the underlying sources and citations.
More in this category
