Worked comparison · reference set reference-set-1.0 · draft

Draft. The answers below were collected from vendor documentation with AI assistance and have not yet been re-checked by the maintainer. Every cell links its source; treat the table as a reading list until the review is recorded.

Three ways to let a coding agent into a private repository

Which coding agents can we let into a private repository, and under what controls? The comparison is deliberately not a ranking. Each agent answers the same five deployment questions from its own documentation; where the documentation is silent the answer is "unknown", which is a question to put to the vendor before a pilot, not a mark against the agent.

Answers were read from the vendor pages linked in each cell on 2026-10-09 — maintainer review pending. "Not documented" means the pages checked do not say; it is a question for the vendor, not a finding against the agent.

	GitHub Copilot coding agent GitHub / Microsoft	Claude Code Anthropic	OpenAI Codex CLI OpenAI	Cline Cline	OpenHands All Hands AI	Aider Aider AI
Unresolved questions	2 of 5	0 of 5	1 of 5	1 of 5	1 of 5	1 of 5
Reads private repositories?	✔ documented "available in eligible private and internal repositories"; owners can disable it per repository · source	✔ documented Runs in the project directory on your machine; file tools are bounded to that folder in Manual mode · source	✔ documented "Open a project directory and run codex"; it can "inspect files" · source	✔ documented Works on the open workspace; "Read project files" is the recommended first auto-approve toggle · source	✔ documented The agent server works on a workspace in a Process, Docker or Remote sandbox · source	✔ documented "AI pair programming in your terminal" in your local git repo · source
Executes code or writes changes?	✔ documented "edit files and run tests and linters in an ephemeral cloud development environment"; "only has the ability to push to a single branch" · source	✔ documented "Manual mode: Claude Code starts with read-only permissions. When it needs to edit files, run tests, or execute commands, it asks you first" · source	✔ documented "make edits, and run the tools already installed on your machine" · source	◐ configurable "Auto Approve is evaluated per tool call"; recommended setup: "Leave edits, commands, browser, and MCP off until you have a specific reason" · source	✔ documented Docker sandbox: "Good isolation from your host machine"; Process sandbox: "No container isolation" · source	✔ documented "Aider will git commit all of its changes, so they are easy to track and undo" · source
Credential handling documented?	? not documented Which secrets the agent can read is not stated on the pages checked; the risks page notes it "has access to code and other sensitive information, and could leak it" and that internet access is restricted by a firewall · source	◐ configurable "API keys and tokens are stored in the macOS Keychain when available"; sandboxed bash with filesystem and network isolation; in cloud sessions "GitHub credentials ... never enter the session VM" · source	? not documented Sign in with ChatGPT or an API key; where credentials are stored is not stated on the pages checked · source	? not documented Not covered on the pages checked · source	? not documented Not covered on the pages checked · source	◐ configurable Model API keys are passed on the command line (--api-key) or from the environment; nothing else is documented on the page checked · source
Can run entirely on your own machine or infrastructure?	✕ not provided Hosted: works "in a cloud environment rather than your local IDE" · source	✔ documented Local terminal process; optional sandbox runtime or dev container; cloud sessions can be routed to a self-hosted environment · source	✔ documented "a coding agent from OpenAI that runs locally on your computer" · source	✔ documented Editor extension running on your machine; model requests go to the provider you configure · source	✔ documented Process and Docker sandboxes run on your machine; Remote "used by managed deployments and some hosted setups" · source	✔ documented Local terminal tool; model calls go to the provider you configure · source
Human approval before consequential actions?	✔ documented "Draft pull requests created by Copilot cloud agent must be reviewed and merged by a human"; "workflows are not triggered until Copilot cloud agent's code is reviewed" · source	◐ configurable Manual mode asks before edits and commands; Auto mode delegates to a classifier; Accept Edits mode auto-approves edits. "You're responsible for reviewing proposed code and commands for safety before approval" · source	◐ configurable /permissions chooses "when Codex can edit files or run commands without asking"; approval_policy on-request \| never; permission profiles :read-only, :workspace, :danger-full-access · source	✔ documented Each tool call prompts unless its auto-approve toggle is on; "YOLO mode" removes prompts and is documented as a deliberate choice · source	◐ configurable "Confirmation policy controls whether actions require user approval before execution"; ConfirmRisky needs a security analyzer; no default policy stated · source	✕ not provided Edits are applied and committed, then shown as diffs; review happens after the fact with /undo. No pre-edit approval step is documented · source
Evidence about the agent	T1 · FedRAMP LI-SaaS +3 vendor-level (inherited): STAR Level 2, GDPR, SOC 2	T5 · none found in the sources checked +2 vendor-level (inherited): ISO 42001, GDPR DPA available	T5 · none found in the sources checked +2 vendor-level (inherited): STAR Level 1, FedRAMP 20x	T5 · none found in the sources checked	T5 · none found in the sources checked	T5 · none found in the sources checked
Pilot restrictions that apply	Pilot with scoped, short-lived tokens only; keep production secrets out of the agent's environment. Treat it as a hosted processor: data-flow review and a signed DPA before any private data is in scope. A public trace shows data leaving the environment under adversarial input. Confirm the vendor's fix is in the version you deploy, and keep an egress allowlist around the agent during the pilot.	Limit the pilot to one non-production repository with a protected default branch; let the agent push to one branch only. Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked. A public trace shows data leaving the environment under adversarial input. Confirm the vendor's fix is in the version you deploy, and keep an egress allowlist around the agent during the pilot.	Pilot with scoped, short-lived tokens only; keep production secrets out of the agent's environment. Limit the pilot to one non-production repository with a protected default branch; let the agent push to one branch only. Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked. No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.	Pilot with scoped, short-lived tokens only; keep production secrets out of the agent's environment. Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked. No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.	Pilot with scoped, short-lived tokens only; keep production secrets out of the agent's environment. Limit the pilot to one non-production repository with a protected default branch; let the agent push to one branch only. Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked. No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.	Keep a human approval gate outside the agent — pull-request review or action confirmation — for every write and command during the pilot. Limit the pilot to one non-production repository with a protected default branch; let the agent push to one branch only. Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked. No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.

What the evidence says

GitHub Copilot coding agent: 4 of 5 questions documented, 1 of them answered no, 1 to ask the vendor; a bounded pilot is possible under 3 restrictions.
Claude Code: 5 of 5 questions documented; a bounded pilot is possible under 3 restrictions.
OpenAI Codex CLI: 4 of 5 questions documented, 1 to ask the vendor; a bounded pilot is possible under 4 restrictions.
Cline: 4 of 5 questions documented, 1 to ask the vendor; a bounded pilot is possible under 3 restrictions.
OpenHands: 4 of 5 questions documented, 1 to ask the vendor; a bounded pilot is possible under 4 restrictions.
Aider: 5 of 5 questions documented, 1 of them answered no; a bounded pilot is possible under 4 restrictions.

None of this ranks the agents. A table with more ✔ marks documents more; it does not deploy more safely. Open each dossier for the full ledger, the sources and the dispute link, and put the "not documented" rows to the vendor before scoping a pilot.