Terminal Coding Agents in 2026: OpenCode, Crush, Goose and More

Terminal coding agents converged on a common shape during 2026: a long-running process in your shell, a tool loop, MCP servers, and some layer that decides which actions need a human. What still separates them is which models they will talk to, how tightly the operating system can hold them, and what their licenses actually permit. This is a working comparison of OpenCode, Crush, Goose, Gemini CLI, Claude Code, Codex CLI, Plandex, and Aider, checked against upstream repositories and vendor docs in late July 2026.

What the terminal buys you that an IDE panel does not

The agents that live inside an editor, Cursor, Cline, Roo Code, Kilo Code, and Continue, are bound to an editor process and an editor window. That is fine for the interactive loop where you read every diff. It is awkward the moment you want to run the agent over SSH on a build box, fan out four of them across git worktrees, or drop one into a CI job.

Terminal agents are ordinary processes. You can background them, pipe into them, redirect their output, and wrap them in whatever isolation your platform gives you. That last point is the durable difference: when the agent is a process, the operating system can be the permission boundary rather than an in-app allowlist that the model itself is allowed to argue with.

The line is blurring from the other side too. Cline now ships as an SDK, an IDE extension, and a CLI in one Apache-2.0 repository, and its CLI 2.0 release added headless mode, JSON output, and stdin/stdout piping specifically for CI pipelines. Zed embeds agent panels in the editor while also being scriptable. So the real question is not terminal versus IDE, it is which process model and which trust boundary you want.

The 2026 field at a glance

Tool	License	Written in	Model providers	Permission or sandbox model	Latest release checked
OpenCode	MIT	TypeScript	75+ via AI SDK and Models.dev, plus local endpoints	Config policy of allow / ask / deny per tool, glob rules for bash, per-agent overrides	v1.18.9, 28 Jul 2026
Crush	FSL-1.1-MIT (source available)	Go	OpenAI, Anthropic, Gemini, Bedrock, Azure, Groq, OpenRouter, Ollama, llama.cpp, plus any OpenAI or Anthropic compatible endpoint	allowed_tools allowlist, --yolo to skip all prompts	v0.87.0, 24 Jul 2026
Goose	Apache-2.0, under the Agentic AI Foundation	Rust	50+ providers including local runners	Four modes: autonomous, smart approval, manual approval, chat only, plus per-tool rules	v1.45.0, 29 Jul 2026
Gemini CLI	Apache-2.0	TypeScript	Gemini models only	macOS Seatbelt profiles, or Docker / Podman containers	v0.53.0 stable, 28 Jul 2026
Claude Code	Proprietary, Anthropic Commercial Terms	Not published	Claude models only, via Anthropic API, Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, or a gateway	OS enforced: Seatbelt on macOS, bubblewrap plus socat on Linux and WSL2, proxy-based network allowlist	2.1.x, shipping continuously
Codex CLI	Apache-2.0	Rust	Built-in openai, ollama, lmstudio, plus custom model_providers blocks	sandbox_mode of read-only, workspace-write, or danger-full-access	rust-v0.146.0, 29 Jul 2026
Plandex	MIT	Go	Bring your own keys: Anthropic, OpenAI, Google, OpenRouter, local	Cumulative diff review sandbox that holds changes outside the project tree until you apply them	cli/v2.2.1, 16 Jul 2025
Aider	Apache-2.0	Python	Bring your own keys, broad provider coverage	Git-native: each accepted change becomes a commit you can revert	last commit 22 May 2026

Installation is a one-liner in every case:

curl -fsSL https://opencode.ai/install | bash
brew install charmbracelet/tap/crush
curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh | bash
npm install -g @google/gemini-cli
curl -fsSL https://chatgpt.com/codex/install.sh | sh
curl -fsSL https://claude.ai/install.sh | bash
curl -sL https://plandex.ai/install.sh | bash

Model flexibility is the sharpest split

This is where the group divides most cleanly, and it is worth being blunt about it.

OpenCode sits at the open end. It routes through the AI SDK and the Models.dev catalog to reach 75 or more providers, and local models are just another OpenAI-compatible base URL. Ollama at http://localhost:11434/v1, a llama-server from llama.cpp at http://127.0.0.1:8080/v1, and LM Studio at http://127.0.0.1:1234/v1 are all configured the same way, through the @ai-sdk/openai-compatible package and a baseURL in opencode.json. Keys go in via /connect and land in ~/.local/share/opencode/auth.json.

Crush covers a similar range from a Go binary, with named support for OpenAI, Anthropic, Google, Groq, Hugging Face, AWS Bedrock, Azure OpenAI, the Vercel AI Gateway, OpenRouter, Ollama, and llama.cpp, plus a generic path for anything speaking the OpenAI or Anthropic wire format. Goose's own provider docs list 50 or more, including local runners: Ollama, LM Studio, Docker Model Runner, and Ramalama. Codex CLI ships openai, ollama, and lmstudio as reserved built-in provider IDs and lets you add anything else as a [model_providers.<id>] block in ~/.codex/config.toml, with --oss selecting a local provider outright.

Then there are the two single-vendor agents. Gemini CLI runs Gemini models; multi-provider support has been an open feature request through 2026 rather than a shipped capability. Claude Code runs Claude models, and the documentation is explicit that ANTHROPIC_BASE_URL changes where requests are sent, not which model answers them. Anthropic states that routing Claude Code to non-Claude models through a gateway is not supported.

That is not automatically disqualifying. Both tools are extremely good at the thing they do, and a single-vendor harness can make assumptions a generic one cannot. But if your reason for choosing a terminal agent is to keep the option of swapping in a cheaper open-weights model such as Qwen Coder when the task is mechanical, only the multi-provider tools give you that.

Permissions: three theories of safety

The tools disagree about where the boundary belongs, and the difference matters more than the feature lists suggest.

In-process policy

OpenCode, Crush, and Goose all gate tool calls inside the agent process. OpenCode's permission config takes allow, ask, or deny, with wildcard matching for bash where the last matching rule wins:

{
  "permission": {
    "bash": {
      "*": "ask",
      "git *": "allow",
      "rm *": "deny"
    }
  }
}

Agent-level permissions merge over the global config and take precedence, so a plan agent can be read-only while a build agent is not. Crush uses an allowed_tools list covering view, ls, grep, edit, and MCP tools, with --yolo as the escape hatch. Goose exposes four modes, autonomous (the default), smart approval, manual approval, and chat only, layered with per-tool rules of always allow, ask before, or never allow.

This model is readable and easy to reason about. Its weakness is that it inspects the command string, not the syscalls. An allowed command that does more than its name suggests is still allowed.

OS-enforced isolation

Claude Code, Codex CLI, and Gemini CLI push the boundary down to the kernel. Codex CLI is the simplest to state: sandbox_mode takes read-only, workspace-write, or danger-full-access, paired with an approval_policy of untrusted, on-request, never, or a granular table.

approval_policy = "on-request"
sandbox_mode    = "workspace-write"

Gemini CLI offers macOS Seatbelt via sandbox-exec with six named profiles, from permissive-open (the default: write restrictions, network allowed) through strict-proxied (read and write restrictions, network via proxy), or full container isolation with Docker or Podman:

SEATBELT_PROFILE=strict-proxied gemini -s
GEMINI_SANDBOX=podman gemini

Claude Code's sandboxed Bash tool is the most elaborate of the three. On macOS it uses Seatbelt with nothing to install; on Linux and WSL2 it needs bubblewrap and socat, with an optional seccomp filter for Unix domain socket blocking. Default policy allows writes only to the working directory and the session temp directory, while reads stay broadly open, which means ~/.aws/credentials and ~/.ssh are readable unless you add explicit sandbox.credentials deny entries. Network egress runs through a local proxy with no domains pre-allowed, prompting per host on first use. Administrators can pin all of this through managed settings with failIfUnavailable and allowUnsandboxedCommands: false, which kills the dangerouslyDisableSandbox retry path.

Credit where it is due: Anthropic's own docs are unusually candid about what this does not buy you. The proxy does not terminate TLS by default, so domain fronting can reach hosts outside the allowlist; allowing /var/run/docker.sock through allowUnixSockets effectively hands over the host; and enableWeakerNestedSandbox, which exists so the sandbox works inside unprivileged containers, is described as considerably weakening security. And the sandbox does not run on native Windows: the CLI does, but sandboxed execution needs WSL2.

Reviewable staging

Plandex takes a third position. Rather than gating execution, it accumulates model output in a cumulative diff review sandbox that sits apart from your project files until you approve it, alongside tree-sitter project maps that let it index directories in the tens of millions of tokens. Aider's version of the same idea is git itself: it applies edits as diffs and commits each successful change with a generated message, so git revert is your undo. Neither stops a shell command from doing damage, but both make the file changes trivially inspectable and reversible.

For anything genuinely unattended, none of these replace a disposable environment. A container or a microVM sandbox such as E2B is still the honest answer when the agent is running without a human in the loop.

MCP is table stakes, and now has a foundation behind it

Every tool in the table above except Aider and Plandex ships Model Context Protocol support, and in April 2026 the governance question got settled: the Linux Foundation formed the Agentic AI Foundation, anchored by contributions of MCP itself, Goose, and AGENTS.md. Goose moved from block/goose to aaif-goose/goose on 7 April 2026, so if you installed it before then, your git remote is stale.

Implementation quality varies more than presence. Crush supports stdio, HTTP, and SSE transports and added OAuth 2.1 authorization for HTTP MCP servers in v0.87.0, which matters if you are connecting to hosted servers rather than local binaries. Goose treats extensions and MCP servers as the same thing, down to its built-in extensions being MCP servers in their own right, and points at a central directory of them. Gemini CLI reads server definitions from ~/.gemini/settings.json. OpenCode and Codex CLI both support it as a first-class configuration surface.

Worth saying plainly: every server you add from a public MCP server directory is a supply chain dependency that runs with your agent's privileges and can inject text into the model's context. Sandboxing the agent and then wiring in six unaudited MCP servers is not a security posture.

Cost control is mostly a gateway problem

Only one of these tools has a meaningful free tier: Gemini CLI grants 60 requests per minute and 1,000 requests per day when you sign in with a personal Google account. That is genuinely useful for exploratory work, and it is the main reason Gemini CLI shows up on machines where nobody has an API budget.

Everything else falls into three buckets. Subscription-backed harnesses, Claude Code on Anthropic plans and Codex CLI on ChatGPT plans, trade metering for a flat rate; Plandex added the ability to attach a Claude Pro or Max subscription for Anthropic models in its last release. Bring-your-own-key tools (OpenCode, Crush, Goose, Aider) bill you per token at the provider. And curated gateways sit in between: OpenCode Zen is an optional pay-as-you-go catalog of models the OpenCode team has tested against the agent loop, priced per million tokens, and explicitly not required to use OpenCode.

If more than two people are running agents, put a gateway in front of them. LiteLLM is the standard self-hosted answer: virtual keys with hard budgets per key, team, internal user, and model, reset on whatever duration you configure, and requests that fail once a key crosses its cap. It also tags spend by User-Agent by default, which means you can see how much of the bill came from Claude Code versus Gemini CLI without instrumenting anything. Pointing Claude Code at it is two variables:

export ANTHROPIC_BASE_URL=https://llm-gateway.example.com
export ANTHROPIC_AUTH_TOKEN=sk-gateway-key

Note the tradeoff Anthropic documents for that configuration: once a gateway credential is active, your claude.ai subscription is not used and the traffic is billed per token to whoever owns the credential.

The other cost lever is running mechanical work locally. Refactors, test scaffolding, commit messages, and codebase Q&A do not always need a frontier model, and every multi-provider agent here can point at Ollama, llama.cpp, or LM Studio for those.

Licensing: several of these are not open source

This section exists because the marketing does not make it obvious.

Genuinely open source, OSI-style: OpenCode is MIT, roughly 191,000 GitHub stars and pushed daily. Goose is Apache-2.0 with foundation governance. Gemini CLI and Codex CLI are both Apache-2.0, though only the client is; the service behind each is not. Aider is Apache-2.0 and Plandex is MIT. On the IDE side, Cline, Roo Code, and Continue are Apache-2.0 and Kilo Code is MIT.

Crush is not open source, and the distinction is real rather than pedantic. It carries FSL-1.1-MIT, the Functional Source License, which is not OSI approved. It permits nearly everything except building a product or service that competes with Crush, and each released version converts to MIT two years after its release. For internal engineering use that restriction will never bite. If you are building a coding-agent product, read the license before you vendor the code.

Claude Code is proprietary. The anthropics/claude-code repository is public, but it holds issues, docs, and example settings, not the CLI source; use is governed by Anthropic's Commercial Terms of Service. Cursor is likewise closed. Neither fact is a scandal, but "on GitHub" and "open source" are not synonyms, and a fair number of 2026 comparison posts conflate them.

Portability: AGENTS.md, CLAUDE.md, and skills

AGENTS.md became the de facto project instruction file, and it is now stewarded by the Agentic AI Foundation under the Linux Foundation. Its own site counts more than 60,000 open source projects carrying the file, and lists Codex CLI, Cursor, Aider, Zed, Goose, and OpenCode among the tools that read it.

Claude Code is not on that list. Its documentation is direct about this: Claude Code reads CLAUDE.md, not AGENTS.md. The supported workaround is a one-line import at the top of CLAUDE.md, or a symlink when you have no Claude-specific content to add:

ln -s AGENTS.md CLAUDE.md

Gemini CLI defaults to GEMINI.md, but its context.fileName setting takes a list, so ["AGENTS.md", "GEMINI.md"] makes it read both.

So the portable setup in practice is one AGENTS.md with the real content, plus thin per-tool files that import it. Treat any claim that a given agent "supports AGENTS.md natively" as something to verify in that tool's own docs, because several roundups get this wrong.

Reusable capability packages are the other portability story. Crush implements the Agent Skills standard for skill packages that are either user-invocable or model-triggered, and Goose's recipes are portable YAML files that bundle instructions, extensions, parameters, and subrecipes into a repeatable workflow. Both are more transferable than a pile of shell aliases, and both are still tool-specific formats rather than a shared standard.

How to choose, and what to watch

Start with release velocity, because it filters the list fast. OpenCode, Crush, Goose, Codex CLI, and Gemini CLI all shipped releases in the last week of July 2026. Aider's last commit was 22 May 2026, which is fine for a tool whose core loop is finished but worth knowing. Plandex is the outlier: its newest tagged release is cli/v2.2.1 from 16 July 2025, and Plandex Cloud began winding down in October 2025, leaving self-hosting and local mode. Its ideas about very large tasks, a two-million-token effective context and tree-sitter maps over 20-million-token repositories, remain the most interesting in the group, but a year without a tag is a real risk to weigh.

From there:

• You want maximum model choice and an actively developed TUI. OpenCode. MIT, 75-plus providers, local models via plain OpenAI-compatible URLs, and a permission config that is easy to read in review.
• You want a single Go binary with strong editor intelligence. Crush. It exposes LSP operations as first-class agent tools, lsp_rename and lsp_replace_symbol among them, which pays off on large refactors. Check the FSL restriction first.
• You need foundation governance and deep MCP. Goose. Apache-2.0, AAIF stewardship, four permission modes, and recipes that survive being handed to a teammate.
• You need OS-enforced sandboxing and administrator controls. Claude Code or Codex CLI. Codex if you want Apache-2.0 client code and provider flexibility; Claude Code if you want managed settings, credential masking, and network allowlists your security team can pin centrally. Codex CLI also sandboxes on native Windows when you run it in PowerShell; Claude Code's sandbox needs WSL2 there.
• You have no budget. Gemini CLI, on the 1,000-requests-per-day free tier, with -s set so it is not running unsandboxed.
• You want the smallest possible loop. Aider. Repo map, diff, commit, done.

Two things to watch through the rest of 2026. First, whether the single-vendor harnesses stay single-vendor; the pressure from OpenCode's provider count is real and the feature requests against Gemini CLI have not gone away. Second, whether sandboxing becomes a default rather than a flag. Right now the tools that isolate best are the ones that ship the isolation off by default, and the honest reading of Claude Code's own limitations page is that even the best of these boundaries is a risk reduction, not a containment guarantee.