Cline explained: one coding agent across several interfaces
Cline security: approval defaults, MCP and external side effects
Review tool authority explicitly before connecting a coding agent to real repositories or services.
What you will learn
- Do not infer approval from the interface
- Treat integrations as added authority
- Understand recovery limits
Before you start
- Basic terminal and Git knowledge
- Disposable repository without secrets
A learning project separates streamed events, tool actions and verified repository outcomes.
Key takeaways
- Approval policy varies by execution surface.
- MCP expands the trust boundary.
- Workspace undo is not universal rollback.
Do not infer approval from the interface
The CLI README documents auto-approved tools by default and offers --auto-approve false for review. ACP startup has a separate source branch requiring an explicit true override for auto-approval. Host-specific policy matters.
A prompt asking for read-only behavior is useful scope guidance but not a substitute for permissions. Keep credentials minimal and inspect every tool request during the first supervised session.
Treat integrations as added authority
MCP servers and chat connectors can add filesystem or external-service access. Review executable source, arguments, transport and account scopes before enabling them. A familiar server name is not evidence of a safe permission set.
Do not publish keys in command lines or retain full sensitive prompts in debugging reports. Inspect logging and state paths, and retain only the redacted evidence required to diagnose the issue.
Understand recovery limits
The documented checkpoints and undo workflow concern workspace state. Do not assume they undo provider-side messages, repository pushes or actions taken by an external MCP service. Track those effects separately.
On unexpected execution, pause sessions and schedules, preserve a redacted trace and revoke exposed credentials through the provider if necessary. Review the changed files before restoring only the affected work.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Set and verify the intended approval policy.
- 2
Review each integration’s executable and permissions.
- 3
Track external effects outside checkpoint recovery.
Copy-ready example
agent_boundary:
tool_approval: explicit
credentials: minimum-scope
workspace: disposable-first
external_effects: separately-recordedFrequently asked questions
Does ACP inherit ordinary CLI auto-approval?
The inspected branch enables it only with an explicit true override.
Will a checkpoint reverse an external API action?
Do not assume so; handle external effects with their own recovery procedure.
Sources
- Cline / apps/cli/README.mdSource checked 2026-09-23
- Cline / apps/cli/src/main.tsSource checked 2026-09-23