Cline

All agent state is in local files whose layout is documented (~/.cline/, ~/Documents/Cline, project .cline/). Export is therefore available immediately, but there is no export/import action: the in-app task export produces Markdown only, and restoring means copying folders by hand.

• Config: directory layout (docs source)
• exportTaskWithId (Markdown export)

The following all live locally under ~/.cline/data and ~/.cline in JSON, Markdown or SQLite: configuration (globalState.json, providers.json), credentials (secrets.json), rules, skills, workflows, hooks, MCP settings and session history. Checkpoints are git refs in the workspace repository. The Cline account holds only billing and credits, not agent-defining state. Per-workspace state is keyed by a hash of the absolute workspace path, so it re-attaches only at the same path; this is recorded, not counted. MCP OAuth supports owner-supplied or dynamically registered clients.

• storage-context.ts: file layout
• Config: directory layout (docs source)
• MCP OAuth

The extension is Apache-2.0 and runs with BYOK or local models without a Cline account. Feature flags fall back to coded defaults. However, the ToS define the 'Service' to include 'Cline Extensions' and grant only a 'freely revocable' licence that Cline 'may terminate … at any time, for any reason or no reason'. No technical path enforces that termination.

• LICENSE (Apache 2.0)
• Cline Terms of Service §2.1

The owner can choose from 200+ providers, including Ollama and LM Studio, with runtime-executed tools. The web_search and image_generation tools are added only for models that natively support them (supportsModelTool), so they are lost on other models, including local ones.

• runtime-builder.ts: model-hosted tools
• Running models locally (docs source)

Agent state is written to the owner's machine by default (~/.cline/data), so a current copy is always in the owner's hands whatever happens to the Cline account or company.

• storage-context.ts
• Tasks: history saved locally

State is plain JSON (settings, secrets, session messages including the system prompt), SQLite and Markdown/script files, with no encryption. The layout is publicly documented, and the Apache-2.0 source defines every schema.

• session-manifest-store.ts: messages JSON
• sqlite-db.ts schema

Two shortfalls. (1) Material settings cannot be determined: the default free-model list includes 'Anonymous' stealth models such as stealth/pixel-canary, and the PostHog flag values in effect are not shown to the owner. (2) Public evidence does not settle whether the hosted Cline gateway adds or alters context, so that class counts as not visible (G12). The system prompt and compaction state are saved only in on-disk session JSON with no documented viewer, which caps this test at partial under G3.

• cline-recommended.generated.ts: stealth free models
• feature-flags.ts
• session-manifest-store.ts

On the default Cline-account path, Cline collects account data, request data sent through Cline keys, automatically collected usage data and 'Inferences' about the user. The privacy policy states no retention periods (only 12 months for cookie consent), and none of this is visible item by item.

• Cline Privacy Policy

Onboarding preselects Cline's own provider. This is visible and replaceable with BYOK. The recommended and free model lists (which include stealth models) come from a Cline server feed with undisclosed selection criteria, and MCP marketplace ranking is undisclosed. No paid placement was found, but no binding no-steering commitment exists.

• data-steps.ts: onboarding choices
• MCP Marketplace
• Cline Free Models

Session history keeps every tool call with its arguments and results until the owner deletes it. One shortfall: message persistence is fire-and-forget, so a failed write is only logged and reported to telemetry, and the owner is not told.

• local-runtime-host.ts: fire-and-forget persistence
• Tasks: history

Session records are plain JSON and SQLite files with no hashes, signatures or external anchor, so any edit or deletion leaves no trace.

• session-manifest-store.ts

The record lives in ~/.cline/data, which the agent's editor and shell tools can reach. The default auto-approval settings enable editFiles and editFilesExternally, and approval checks do not treat paths outside the workspace separately. Nothing stops the agent from altering or deleting its record.

• AutoApprovalSettings.ts defaults
• sdk-tool-policies.ts

The extension source is Apache-2.0. The default Marketplace VSIX is built in CI with no reproducible-build or third-party-verifiable provenance, and the on-by-default Cline gateway (api.cline.bot) is closed but optional.

• LICENSE
• ext-vscode-publish.yml

The agent has no identity of its own. Its only account identity is a Cline account, which Cline can suspend or terminate.

• Cline Terms of Service §1.3

Checkpoints snapshot the owner's workspace files and conversation, not agent state. There is no history, attribution or rollback for changes to settings, model, provider, tools, permissions, MCP configuration or global rules.

• Checkpoints

Rules, skills, workflows and hooks are owner-editable files that persist. The extension has no setting to replace the base system prompt; only the CLI documents -s/--system.

• Cline Rules
• CLI reference (-s) (docs source)

Cross-session memory is owner-authored files (rules, memory-bank Markdown) and task history. Each is itemised and can be edited or deleted. The extension has no hidden automatic memory or profile store.

• Memory Bank
• Tasks: history and deletion

The owner can connect any MCP server without review. Built-in bash, editor and file tools cannot be removed in the extension; only the browser and web_search can be switched off. Plugin custom tools are 'not applicable on VSCode'.

• All Cline tools (docs source)
• MCP overview

The owner can change or disable every protection in scope. Approvals can be turned off one by one or all at once with YOLO mode, and checkpoints and telemetry can be switched off. The plan-mode command blacklist applies only in plan mode, which the owner can leave. No content filter is imposed.

• Auto Approve & YOLO Mode
• command-guard.ts

PostHog feature flags are evaluated 'regardless of user's telemetry preferences'. They control Cline model-list sourcing, recommended and onboarding models, the OpenAI Responses websocket transport, and banners, and the owner has no way to pin or decline them. The ToS let Cline 'change the Service … with or without prior notice'.

• FeatureFlagsService.ts
• feature-flags.ts
• Cline Terms of Service §1.3

Three shortfalls. File scope is only on/off (workspace vs all files), and MCP approval is one global toggle. There is no per-domain or per-recipient contact or egress limit for web fetch or the browser. Under the default auto-approval (editFiles and editFilesExternally on), the agent can edit its own settings and hooks in ~/.cline or .clinerules without asking. Command allow/deny exists only through the CLINE_COMMAND_PERMISSIONS environment variable. Spend is treated as met because the agent has no payment capability (G11).

• AutoApprovalSettings.ts defaults
• sdk-tool-policies.ts
• Config: CLINE_COMMAND_PERMISSIONS (docs source)

The owner can gate only a fixed set of classes: read, edit, commands, browser and all-MCP. Whether a command is 'safe' is decided by the model's requires_approval flag.

• Auto Approve: safe vs approval-required commands
• sdk-tool-policies.ts

Cancel stops the foreground turn. The extension's cancelBackgroundCommand handler is a stub that does nothing, so commands detached with 'Proceed While Running' have no working stop. The extension runs no provider-side work.

• SdkController.ts cancelTask / cancelBackgroundCommand

The preselected 'Absolutely Free' path uses free models whose 'usage may be used to help improve model performance and quality', so content goes to secondary use by default. Telemetry is on by default (setting 'unset' is treated as opted in). The privacy policy shares identifiers with ad partners, and data-term changes take effect on publication without consent.

• Cline Free Models
• state-keys.ts telemetry default
• PostHogTelemetryProvider.ts opt-in check
• Cline Privacy Policy
• Cline Terms of Service §3.6

Credentials are in local owner-only files (secrets.json, providers.json). Provider API keys are shown per provider in settings and can be removed. MCP OAuth tokens and the Cline session token are not listed in one owner-visible place. BYOK keys are not sent to Cline, per the privacy policy.

• storage-context.ts secrets
• Cline Privacy Policy

No documented one-step deletion covers the Cline account and every provider-side copy. The only mention is a DELETE /api/v1/users/me endpoint in the enterprise API reference, with no stated time limit or confirmation. The ToS keep telemetry and a perpetual licence to de-identified data after the account ends.

• Enterprise API reference
• Cline Terms of Service §3.2, §3.6