qwen-code

Name: qwen-code
Author: QwenLM

Issues

An open-source AI coding agent that lives in your terminal.

27,084stars

2,871forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/QwenLM/qwen-code

Getting Started

Guides for using ai agents skills like qwen-code.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 8/4/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL Comment",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource Consumption",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@larksuiteoapi/node-sdk: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/api-extractor-model: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@microsoft/tsdoc-config: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@mobilewright/core: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/core: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-prometheus: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-zipkin: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/instrumentation-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-grpc-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-transformer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-b3: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-jaeger: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/resources: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-logs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-metrics: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-node: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-node: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/node-core-library: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/terminal: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@rushstack/ts-command-line: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/browser: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/coverage-v8: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "echarts: Apache ECharts has a cross-site scripting (XSS) vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to host confusion via backslash authority introducer",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "linkify-it: linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mobilewright: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: protobufjs: Denial of Service via infinite loop in .proto option parsing",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "storybook: Storybook Dev Server is Vulnerable to WebSocket Hijacking",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "undici: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite middleware may serve files starting with the same name with the public directory",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite-node: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vitest: Vulnerability found",
      "severity": "critical"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-08-04T06:27:15.466Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}

README.md

Frequently Asked Questions

What is qwen-code?

qwen-code is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by QwenLM. An open-source AI coding agent that lives in your terminal. It has 27,084 GitHub stars.

Is qwen-code safe to use?

qwen-code failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install qwen-code?

Clone the repository with "git clone https://github.com/QwenLM/qwen-code" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is qwen-code written in?

qwen-code is primarily written in TypeScript. It is open-source under QwenLM on GitHub, so you can review or fork the full source.

Are there alternatives to qwen-code?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh qwen-code against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

240,529

Developers Also Liked

Based on votes and bookmarks from developers who liked this skill

mcp-server-chart

by antvis

🤖 A visualization mcp & skills contains 25+ visual charts using @antvis. Using for chart generation and data analysis.

4,316

claude-hud beads

The open-source AI coding agent that lives in your terminal.

中文 | Deutsch | français | 日本語 | Русский | Português (Brasil) | 한국어

Why Qwen Code?

Agentic out of the box — Auto-Memory, Auto-Skills, SubAgents, Agent Teams, and MCP. Dynamic workflows, zero setup.
Open-source, inside and out — The framework and the Qwen models are open-source. They evolve together. No vendor lock-in.
Multi-protocol — Supports OpenAI, Anthropic, Gemini, and Qwen APIs. Any third-party provider or local model (Ollama / vLLM). Switch at runtime.
Beyond the terminal — IDE plugins, Desktop app, daemon mode, SDKs, and IM bots (Telegram / DingTalk / WeChat / Feishu).

[!TIP] Qwen Code is actively iterating on itself — using its own agent and models to file issues, submit PRs, review code, and run tests. Powered by the community, driven by AI.

Installation

Linux / macOS:

curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.sh | bash

Windows:

irm https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.ps1 | iex

Restart your terminal after installation to ensure environment variables take effect.

NPM (requires Node.js 22+):

npm install -g @qwen-code/qwen-code@latest

Homebrew (macOS / Linux):

brew install qwen-code

Quick Start

qwen          # Launch interactive terminal UI
# Inside the session:
/auth         # Configure your provider and API key

See the Authentication Guide and Settings Reference for detailed setup.

Qwen Code

How to Use Qwen Code

Mode	Command	Use Case
Interactive	`qwen`	Terminal UI with rich rendering, `@file` references, slash commands
Headless	`qwen -p "..."`	Scripts, CI/CD, batch processing — no UI
IDE	—	VS Code, Zed, JetBrains
Desktop	—	Qwen Code Desktop — GUI for macOS, Windows, Linux
Daemon	`qwen serve`	Shared agent session over HTTP+SSE (ACP). Multiple clients, one agent. (experimental) Docs
SDK	—	TypeScript, Python, Java
IM Bot	`qwen channel`	Connect to Telegram, DingTalk, WeChat, or Feishu

import asyncio

from qwen_code_sdk import is_sdk_result_message, query


async def main() -> None:
    result = query(
        "Summarize the repository layout.",
        {
            "cwd": "/path/to/project",
            "path_to_qwen_executable": "qwen",
        },
    )

    async for message in result:
        if is_sdk_result_message(message):
            print(message["result"])


asyncio.run(main())

Capabilities

If you know Claude Code, you already know Qwen Code — and then some. We've put significant effort into bringing Qwen Code to feature parity with Claude Code, improving both breadth and reliability across the board.

Feature	Qwen Code	Claude Code
SubAgents, Agent Teams, Dynamic Workflows	✓	✓
Auto-Memory, Auto-Skills, Hooks	✓	✓
Built-in Skills (/review, /batch, /loop, /bugfix…)	✓	✓
MCP, Plan Mode, LSP Integration	✓	✓
Auto Mode, Sandbox, Git Worktrees	✓	✓
Computer Use (desktop automation)	✓	✓
IDE Plugins (VS Code / JetBrains / Zed)	✓	✓
SDK	✓	✓
Headless Mode, Session Management	✓	✓
Open-source — model and framework	✓	—
Multi-protocol (OpenAI / Anthropic / Gemini / Qwen + any provider)	✓	—
Agent Arena (multi-model head-to-head on same task)	✓	—
Daemon Mode — `qwen serve` (multi-client shared agent)	✓	—
IM Channels (Telegram / DingTalk / WeChat / Feishu)	✓	—

Ecosystem

Qwen Code Desktop — Official desktop app for macOS, Windows, and Linux
AionUi — A modern GUI for command-line AI tools including Qwen Code
Gemini CLI Desktop — A cross-platform desktop/web/mobile UI for Qwen Code
🦞 Qwen Code Claw — Let other agents (Claude, Codex, etc.) delegate coding tasks to Qwen Code via ACP. Paste this prompt into your agent:

Use Qwen Code as a coding agent. First, fetch and read this skill reference:
https://raw.githubusercontent.com/QwenLM/qwen-code/refs/heads/main/.qwen/skills/qwen-code-claw/SKILL.md
Then follow the instructions inside to install, authenticate, and use Qwen Code via acpx for all coding tasks.

Aliyun Model Studio CLI — Official CLI for Aliyun's AI platform (bailian-cli). Extends Qwen Code with image/video generation, knowledge retrieval, app orchestration, and model deployment

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

Acknowledgments

This project was originally based on Google Gemini CLI v0.8.2. We gratefully acknowledge the Gemini CLI team's excellent work. Starting from Qwen Code v0.1, we stopped syncing with upstream and began independent development as a multi-protocol, multi-platform agent framework with deep integrations for Qwen models and beyond.