Security for Kiro, Copilot CLI, Devin, OpenCode and Qwen

AI coding agent security is only as good as its coverage, and the list of agents your developers use keeps growing. Five more now get the same treatment as Cursor, Claude Code and Codex: Kiro, GitHub Copilot CLI, Devin CLI, OpenCode (its new major version) and Qwen Code. Autonomous now lists what each one loads, records their sessions (Devin CLI aside), and enforces your guardrails and MCP policies while it works, not only after the fact.

Why coverage of every AI coding agent matters

A policy that holds in Cursor and not in the terminal next to it isn't a policy. Developers try new agents every week, and the ones that stick are rarely the ones a security team approved first. A new CLI agent can read the same repository, run the same commands and call the same MCP servers as the one you already govern.

Until this release, Kiro, Copilot CLI and Qwen Code were in your shadow AI inventory as installed apps, and Devin CLI and OpenCode's new version weren't followed at all. That tells you they exist. It doesn't stop one of them from running a destructive command or sending a secret to a model. Now it does.

What every new agent gets

On the same endpoint agent and the same policies you already run:

• Inventory: the MCP servers, skills, rules and similar files each agent loads appear beside every other agent's.
• Session history: what the agent was asked, which tools it called and what came back, in Activity, under your data collection settings (for every one of them but Devin CLI, below).
• Real-time enforcement: your guardrails and MCP policies block or redact while the agent works. A tool call your policy forbids is stopped before it runs.

Nothing new to configure: a rule you wrote for Claude Code applies to Qwen Code the day it is covered. As everywhere, Monitor shows what would have been blocked before you enforce.

Kiro security: the IDE and the CLI

In the Kiro IDE, tool calls and prompts are both governed, in a workspace you trusted with a folder open (Kiro runs no policies otherwise): a prompt your guardrails block is never sent, and a tool call your MCP policy forbids doesn't run. Its inventory includes MCP servers, steering files, skills, custom agents and Powers. In the Kiro CLI, tool calls are governed on its newer agent engine; the CLI can't stop a prompt, so a prompt decision there is recorded rather than applied.

One limit to know: Kiro doesn't report which organization it is signed in to, so an organization allow list blocks every Kiro IDE prompt: leave Kiro out of organization rules.

GitHub Copilot CLI security

GitHub Copilot CLI gets the full set. Its inventory covers MCP servers, skills, custom agents, instruction files, installed plugins and settings; its session history includes token usage. Model policies apply, so your model allow or block list holds in Copilot CLI as it does in Cursor and Claude Code. MCP policies apply to Copilot's built-in servers and to the ones developers configure in Copilot's settings, its plugins or the project; a server added for a single run on the command line is not checked. If you disallow the app itself, a running Copilot CLI is closed.

This is GitHub Copilot in the terminal. Copilot Chat in VS Code and Copilot's cloud agent are not enforced by this change.

Devin: Windsurf is now Devin Desktop

Windsurf became Devin Desktop in its June update, and its default agent is now the Devin CLI. Devin Desktop's existing coverage carries on under its new name, and Devin CLI is covered as an agent of its own: its inventory, and your guardrails and MCP policies on its tool calls. Its sessions aren't recorded, and it doesn't report its model or account, so model and account rules don't reach it. Developers who moved to Devin don't fall out of policy when the app renamed itself.

OpenCode and Qwen Code

OpenCode was already covered. Its new major version changed where it keeps its configuration, so we followed it: servers and settings written the new way are read, and policies hold, on both versions.

Qwen Code moves from a listed app to a governed one. A tool your policy forbids doesn't run; a secret in a tool's result is redacted before the model sees it; a prompt your guardrails block is never sent.

An example

A platform team rolls out a block on any MCP tool that can delete a repository, and a secrets guardrail that redacts cloud keys. A month later, one developer has moved to Kiro and another works mostly in Qwen Code.

In Kiro, the developer's agent tries a repository cleanup and reaches for the delete tool: the call is blocked, and Activity shows it beside the same rule's blocks in Cursor. In Qwen Code, a deployment script prints a cloud key into a tool's output; the key is redacted before the model sees it. Neither developer was asked to install anything, and the security team didn't write a single new rule.

One policy across 60+ agents

Autonomous supports more than 60 AI agents, at different depths depending on what each agent lets a security tool do. These five move to the deepest level their tools allow: seen and enforced, and recorded for all but Devin CLI. The same is true of ChatGPT Desktop and Codex since October.

If your developers use an agent you don't see covered, tell us which one.

Start an AI agent security free trial and see every agent on your endpoints, the new ones included.