Cline

Coding agent (IDE) · Cline · 3/7 verified · Last checked 2026-10-16

Per-category auto-approve toggles and a YOLO mode. The CLI auto-approves all tools by default. The SDK lets you set per-tool approval policies.

Overall: D (1.33 avg, 3/7 controls verified)

Lock this down first

Run the CLI with --auto-approve false, and keep YOLO mode off.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	Per-category auto-approve toggles; the SDK has per-tool policies. In the IDE the model flags which commands need approval.
Human approval gates	2/3	Per-category auto-approve toggles for reads, edits, commands, browser and MCP.
Sandboxing	0/3	Docs suggest throwaway or sandboxed environments. None built in.
Secrets handling	Unverified	Not confirmed in the docs we checked.
Audit logs	Unverified	Not confirmed in the docs we checked.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	Unverified	Not confirmed in the docs we checked.

Unverified: Secrets handling, Audit logs, Kill switch / interrupt, Network egress control. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.