24 tools · checked against public docs
How safe is the agent you just gave your terminal to?
We read the docs so you know what each AI agent tool lets you lock down: permissions, approvals, sandboxing, secrets, logs, interrupts and network egress. Every rating links to its source. If we could not confirm something, it says Unverified.
Top safest this week
GitHub Copilot cloud agent
Runs in an ephemeral, firewalled Actions environment. It can push only to its own branch, cannot approve or merge, and only sees secrets in the copilot environment. The firewall does not cover MCP servers or setup steps.
Claude Code
Deny-first permission rules, PreToolUse hooks that can block even in bypass mode, and an OS-level Bash sandbox with domain allowlists. The sandbox only covers shell commands; file tools and MCP servers sit outside it.
Codex CLI
Separates sandbox mode from approval policy. Defaults to no network and writes limited to the workspace, enforced by Seatbelt on macOS and restricted tokens on Windows. Admins can pin allowed sandbox modes.
Claude Agent SDK
Shares Claude Code's permission system. canUseTool handles approvals for calls not already allowed, and PreToolUse hooks run on every call.
OpenAI Agents SDK
needs_approval on tools pauses a run and returns interruptions you approve or reject. Input, output and tool guardrails run checks, and built-in tracing records tool calls and handoffs.
Devin
Sessions run in isolated environments, with a single-tenant VPC option for enterprise. Secrets are encrypted and scoped to org, user, repo or session. Audit logs are exposed through enterprise API permissions.
LangGraph
interrupt() pauses a graph and resumes with approve, edit, reject or respond. Needs a checkpointer, which also gives you a persisted state history.
MCP servers (protocol)
The spec says hosts should get user consent before tool calls and treat tool descriptions as untrusted. HTTP servers use OAuth 2.1 with audience-bound tokens. Real safety depends on each host and server.
AutoGen
DockerCommandLineCodeExecutor runs generated code in a container with a timeout. Network, mounts and limits are up to you.
n8n AI Agent
Human Review nodes can gate specific agent tools. The workflow pauses, asks over Slack, email or chat, and only runs the tool after approval.
Cursor Agent
Run modes decide what executes without asking. permissions.json holds terminal and MCP allowlists, sandbox.json sets network and path rules, and admins can push both. MCP tools do not run inside the local sandbox.
Gemini CLI
A TOML policy engine can allow, deny or ask per tool, argument pattern and MCP server. Trusted folders put unknown repos in safe mode. Sandboxing is opt-in.
Replit Agent
Automatic checkpoints cover files, config and optionally the database, and you can roll back to any of them. Production databases are kept separate from the dev database.
OpenHands
Runs actions in a Docker sandbox by default. Confirmation mode plus an LLM security analyzer can pause risky actions for a human.
Kiro
permissions.yaml rules with allow, ask and deny, where deny always wins. Supervised mode prompts before actions.
Amazon Q Developer CLI
Per-tool trust for a session via /tools trust, which resets on restart. Shadow-git checkpoints can restore earlier states.
Goose
Four modes from fully autonomous to chat only, with per-tool always allow, ask, or never. Auto is the default.
Windsurf Cascade
Four auto-execution levels from Disabled to Turbo, with user and team allow and deny lists. Deny beats allow.
CrewAI
Supports pausing for human input on registered frontend tools. Sandboxing, secrets and egress are left to you.
Roo Code
Auto-approve with allowed and denied command prefixes. A public issue reported a denied-command bypass that was later fixed, so stay on the latest version.
Jules
Each task runs in a fresh cloud VM with internet access. You review the plan first, but plans can auto-approve on a timer if you walk away.
Cline
Per-category auto-approve toggles and a YOLO mode. The CLI auto-approves everything by default, but supports a command allow and deny list with deny-first rules.
Aider
Commits every edit to git, so /undo is the main safety net. We found no documented sandbox or command allowlist. By default it skips pre-commit hooks.
Continue
Per-tool policies: ask first, automatic, or excluded. Ask first is the default. Headless CLI runs drop ask tools entirely.