Cline
The open-source VS Code extension that turns your editor into a full coding agent. Actively developed, large MCP ecosystem.
Delv Safety Grade: B
Score 72/100 · assessed 2026-04-19
Cline is an open-source VS Code extension that functions as an autonomous coding agent with full MCP client support. It's transparently developed with active maintenance and good documentation. The project is distributed via VS Code Marketplace with standard supply-chain practices. However, as an IDE extension hosting arbitrary MCP servers, Cline inherently operates with very broad permissions: filesystem write/delete across your workspace, shell execution for running commands and tests, and network access for API calls. The maintainer is a smaller independent team rather than a major vendor, which affects the bus factor. No security incidents are known. The transparency is excellent with open source, clear docs, and active development. The core risk is the permission scope required for a coding agent to function effectively.
Green flags
- Fully open source with active development and community
- Excellent documentation including MCP integration guides
- Standard VS Code Marketplace distribution with versioning
- Large ecosystem adoption, actively maintained
- No known security incidents or credential leaks
Red flags
- Full filesystem write/delete access across workspace directories
- Unrestricted shell execution for running tests and build commands
- Smaller independent maintainer team, higher bus factor risk
- Hosts arbitrary third-party MCP servers with their own permission sets
Permissions requested
MCP capabilities
- Tools
- Resources
- Prompts
- Sampling
Platforms
Config location
Via the Cline sidebar -> MCP Servers
Review
Best MCP client for developers who live in VS Code and want an agent that writes, tests, and iterates on code without leaving the editor. Skip it if you need a general-purpose AI assistant or work in massive codebases.
Good at
- Tight VS Code integration means no context-switching during development
- Executes code changes and terminal commands directly with approval gates
- MCP configuration through sidebar UI, not manual JSON editing
- Actively developed with monthly feature releases and bug fixes
- Large ecosystem of compatible MCP servers already tested by community
Watch out
- Can loop endlessly when test failures are ambiguous
- High token usage on large codebases due to frequent context re-reading
- UI lag during long response processing
- No support for MCP prompts or sampling capabilities yet
- Struggles with monorepos or projects over a few hundred files