How to Use Open Source AI Coding Agent: A Practical Walkthrough

Why Everyone Is Using AI Coding Agents — and Trusting Them Less

You have likely installed an AI coding agent, watched it generate flawless code, and then spent an hour debugging a subtle logic error it introduced. This paradox defines the current developer landscape: adoption is skyrocketing, but confidence in the output is eroding rapidly.

The data tells a story of enthusiastic usage paired with deep skepticism. According to Stack Overflow’s 2025 Developer Survey, 84% of developers are using or planning to use AI tools. Meanwhile, industry analysis indicates that 68% of professional developers now use AI coding agents daily. Yet, this widespread integration has not translated into trust. Only 29% of developers trust AI output accuracy, a sharp decline from 40% in 2024.

This gap stems from the nature of AI-generated code. A significant majority of developers identify "almost right, but not quite" as their top frustration. The code compiles and looks correct, but fails under specific edge cases or architectural constraints. One randomized controlled trial even found that experienced open-source developers were 19% slower when using AI tools on mature codebases they already knew well, despite believing they were faster.

In response, developers are turning to the open-source tier for transparency and control. Tools like OpenCode, Cline, Aider, Goose, OpenHands, Kilo Code, and Tabby offer alternatives to proprietary platforms. OpenCode, for instance, has become the most-starred open-source coding agent, surpassing 185,000 GitHub stars. This shift suggests a desire for tools that teams can inspect, modify, and extend without vendor lock-in.

However, "open source" is not a magic shield against risk. It does not automatically guarantee that a tool is self-hosted, safe, or immune to maintenance issues. The market has seen significant volatility, highlighting the dangers of relying on a single provider.

• **Maintenance Risk:** By mid-2026, Continue.dev was acquired by Cursor, and Roo Code was archived, leaving teams to manage sudden workflow changes.
• **Security Assumptions:** Self-hosting an agent does not mean prompts or code context never leave the environment; data exfiltration risks remain if configurations are not strict.
• **Licensing Complexity:** While many tools use Apache 2.0 or MIT licenses, understanding the specific terms for commercial use requires legal review.

This reality underscores the need for rigorous verification. Teams must treat open-source agents with the same scrutiny as commercial ones, verifying security postures and maintenance status before deployment.

This is where the concept of curated agent skills becomes critical. Skills are instruction packages that extend an agent's capabilities, but published research suggests that roughly 26% of these skills carry at least one vulnerability. Blindly loading third-party skills is akin to installing unvetted plugins.

SkillzBench is building a free, independent directory to address this exact gap. The platform is designed to continuously crawl, dedupe, and verify agent skills, pinning every version to a commit SHA and running security scans. By offering a free MCP connector, SkillzBench allows users to toggle specific skills and tools per agent, ensuring the agent only sees what has been explicitly chosen and validated.

For now, the lesson is clear: open source offers leverage, but it does not eliminate the need for verification. As you evaluate tools like OpenCode or Cline, prioritize those that allow for least-privilege configuration and transparent auditing. The era of trusting the box is over; the era of verifying the code has begun.

Pick Your Agent: Match the Harness to Your Workflow Surface

The most important choice you'll make isn't which model to use — it's which harness wraps it. Faros.ai frames it as "Agent = Model + Harness": the model supplies raw intelligence, while the harness turns that intelligence into a reliable, autonomous agent. And the harness lives on a surface — the place where your work actually happens.

OpenHands puts it bluntly: a surface mismatch usually means developers quietly stop using the tool. Ask yourself three questions before installing anything.

Do you live in a terminal? Choose Aider, OpenCode, or Goose. OpenCode is the most-starred open-source coding agent with more than 185,000 GitHub stars, ships under an MIT license, and supports 75+ providers. Aider (Apache 2.0) is the veteran, created by Paul Gauthier in 2023, with an auto-commit-per-edit pattern and a built-in /undo that makes it forgiving for beginners. Goose, also Apache 2.0 and originally built by Block before moving to the Linux Foundation's Agentic AI Foundation, offers 70+ documented extensions and can spawn up to 10 parallel subagents per session.

Do you live in VS Code or JetBrains? Choose Cline, Kilo Code, or Tabby. Cline (Apache 2.0) has millions of VS Code Marketplace installs, supports 30+ providers, and works in both IDE and CLI. Kilo Code supports 500+ models, giving you maximum flexibility over what powers it. Tabby takes a different path entirely: it's a self-hosted completion server, air-gapped capable, ideal for teams that want suggestions without any cloud dependency.

Do you want a visual, multi-agent workspace? Choose OpenHands. It's MIT-licensed, connects to 100+ providers, and can be self-hosted in a VPC or air-gapped environment — the strongest option for teams with compliance requirements.

A few cautions before you commit. "Open source" means the codebase is published and inspectable — it does not automatically mean self-hosted, audited, or vendor-proof. Self-hosting the agent doesn't guarantee prompts, code context, or logs never leave your environment. And maintenance risk is real: by mid-2026, Continue.dev had been acquired by Cursor and Roo Code was archived, leaving teams to migrate their workflows.

Also weigh cost, not just capability. Community conversation has shifted from "which tool is smartest?" to "which tool won't torch my credits?" — heavy MCP servers alone can consume 10K+ tokens per turn. Token efficiency, not raw intelligence, is now the deciding factor for most teams, especially with Anthropic introducing rate limits that hit developers mid-workstream.

Once your agent is running, the next layer is skills — curated instruction packages that extend what it can do. SkillzBench is building a free directory and free MCP connector so you can load only vetted, security-scanned skills into whichever harness you picked.

Set Up Least-Privilege Permissions Before Your First Prompt

Before you type a single prompt into an open-source coding agent, decide what that agent is allowed to do. Unlike a traditional assistant that only suggests code, an agent executes — opening files, installing dependencies, and modifying repositories without asking each time. Security researchers at Knostic frame the risk bluntly: treat an agent's command permissions like those of a junior developer with admin access.

That framing matters because the stakes are real. A 2025 red-teaming competition recorded 60,000 successful prompt-injection attacks out of 1.8 million attempts, and the Frontier Model Forum warns that "every tool an agent can access expands both its capability and its exposure." Least-privilege configuration is the single most important control, and OWASP's AI Agent Security Cheat Sheet treats it as the top best practice.

Start with these four moves:

• Scope file access narrowly — point tools at the specific directories they need, read-only where possible.
• Deny-list secrets like *.env, *.key, *.pem, and anything matching *secret* so the agent can never read credentials.
• Use explicit command allowlists instead of a wildcard like allowed_commands: "*", which OWASP flags as a dangerous default.
• Treat every autonomous write as a potential production change and require human-approved diffs before anything merges.

A scoped tool configuration looks like this:

{
  "mcpServers": {
    "filesystem": {
      "command": "scoped-file-reader",
      "args": ["--root", "/app/reports/", "--mode", "read-only"],
      "deny": [".env", ".key", ".pem", "secret"]
    },
    "shell": {
      "command": "allowlisted-runner",
      "allow": ["npm test", "npm run lint", "git diff"]
    }
  }
}

The philosophy behind this config is "fail closed": unknown tools get blocked by default, and only explicitly low-risk actions skip review. OWASP also recommends classifying tool risk — search and read operations are LOW, write_file is MEDIUM, and execute_code or anything touching databases is HIGH or CRITICAL. Match your human-in-the-loop requirements to those tiers.

The same principle extends to the skills and MCP servers you attach to an agent. Every additional tool widens the attack surface, and heavy MCP servers can consume 10K+ tokens per turn — so loading everything "just in case" is both a security and a cost mistake. That's exactly the problem SkillzBench is building for: a free MCP connector where you toggle precisely which skills and tools each agent can see, so the agent only ever sees what you deliberately chose. Version pinning, security scanning, and trust scoring are part of the same design, because ~26% of published agent skills carry at least one vulnerability.

Configure permissions first, prompt second. An agent constrained on day one is far safer than one you try to rein in after it has already written to the wrong directory.

Your First Task: Sandbox, Small Scope, Human-Reviewed Diff

You picked an agent, configured least-privilege permissions, and pointed it at a scratch repo. Now comes the part that separates a useful rollout from a security incident: the first task.

The goal is not to ship code. It is to prove you can trust the diff before you merge it. Treat the first run as a calibration exercise, not a productivity push.

Create an empty Git repository with one trivial file — a function stub, a config, a README — and nothing else. No production code, no secrets, no CI pipeline that talks to the real world. The point is to isolate the agent's behaviour from anything that hurts if it misbehaves.

Resist the urge to test the agent's ambition. A good first task has three properties: it is small, it is verifiable, and it is reversible. The canonical example is "add a validation function plus a test" — a few lines of code, a single test case that passes or fails, and a diff you can read end-to-end in two minutes. Anything broader invites the failure mode that 66% of developers already report: solutions that are "almost right, but not quite" and that take longer to debug than to write.

Before you let the agent touch the repo, map its tools to OWASP's risk tiers:

• Read (search, file read, grep): LOW risk. Auto-approve.
• Write file: MEDIUM risk. Require a diff you eyeball before commit.
• Execute (run tests, install packages, shell commands): HIGH risk. Require explicit approval per call, and scope the working directory.

If the agent tries to send a network request, modify a file outside the scratch repo, or run a command you did not author, that is a stop signal, not a prompt to negotiate.

This is where the discipline pays off. Open the diff in your normal review tool and read it the way you would read a junior developer's pull request — checking for logic errors, missing edge cases, hardcoded values, and anything that looks plausible but wrong. The METR randomized controlled trial found that experienced developers working on familiar codebases were actually 19% slower with AI tools while believing they were 20% faster. Subjective speed is not evidence. The diff is evidence.

Before you grant the agent a second task, write down three numbers in a simple log:

• Cycle time: minutes from prompt to passing test
• Review-caught defects: issues you had to fix or flag in the diff
• Rework: lines you deleted or rewrote after merging

After five to ten tasks, you will have a real baseline for your own workflow — not a vendor benchmark, not a productivity claim from a press release. Only then does it make sense to widen the sandbox, add more tools, or let the agent run longer chains without checkpoints. One natural extension once the base agent is working is layering curated agent skills — vetted instruction packages that automate adjacent steps like formatting, linting, or test scaffolding. SkillzBench is building a free directory and MCP connector so teams can browse, scan, and toggle skills per agent without exposing the model to unvetted instructions. Join the waitlist to get early access.

Go Further with Agent Skills — Curated, Scanned, and Verified

Your agent works. Now comes the question every team eventually faces: how do you teach it to do more without handing it instructions you haven't vetted? Agent skills — SKILL.md instruction packages for tools like Claude Code, Codex, Cursor, and Gemini CLI — are the natural next step, but they deserve the same skepticism you'd apply to any code you didn't write.

The risk is not hypothetical. Published research found that roughly 26% of agent skills carry at least one vulnerability. That aligns with broader agent security findings: a 2025 red-teaming competition recorded 60,000 successful prompt-injection attacks out of 1.8 million attempts, and OWASP lists supply chain attacks and tool abuse among the top agent risks. A skill is, after all, just instructions your agent will follow — treating every external input as untrusted applies here too.

So what does a safe adoption path look like? A skill should be inspected before it's loaded, pinned to a specific version, and tested against a baseline rather than taken on faith. That's exactly the problem SkillzBench is being built to solve. The free directory continuously crawls and dedupes skills from GitHub, then runs each one through a verification pipeline:

• Every version is pinned to a commit SHA, so what you reviewed is what you load.
• Each skill gets a license check, security scan, and quality evaluation.
• Skills are benchmarked in a sandbox with the same model, with and without the skill, and the measured Lift is published in percentage points.
• A 0–100 trust score combines security, quality, license, maintenance, and community signals — with Lift always shown separately, and money never touching ratings.

The same least-privilege logic from earlier in this walkthrough applies to skills. SkillzBench's free MCP connector is being built so you toggle skills and tools per agent, and the agent only sees what you chose — mirroring OWASP's guidance that unknown tools should fail closed. Upstream changes get tracked and re-scanned, so a skill that was safe last month doesn't silently become a liability.

This matters because the "almost right, but not quite" problem — the top frustration for 66% of developers — doesn't disappear when you add skills; it just changes shape. A skill that measurably lifts performance in a controlled benchmark is a far better bet than one that merely reads well.

SkillzBench is pre-launch and actively building this. If you want first access to the directory, benchmarks, and the free MCP connector, join the waitlist at skillzbench.com and get notified the moment it goes live.