Skip to main content

Buyer guide

Cline Enterprise Controls Checklist

SSO, approved model vendors, MCP allowlists, and telemetry for Cline, with the products that enforce each setting.

Reading time
2 min read
Sources
12 cited
In this piece
Cline+39 Positive

The call

Govern Cline through the VS Code and JetBrains extensions.

Keep the CLI and Cline Desktop off machines that need enforced controls until Cline enforces them there, or cover those machines with endpoint policy.

Cline Enterprise's provider, MCP, and telemetry controls take effect only in the VS Code and JetBrains extensions; the CLI enforces rules and workflows, and Cline Desktop enforces none. Enterprise also adds SSO, role-based access, and audit logs. This checklist covers each setting and how to close the gaps.

When you need this

  • Security asks how Cline is governed before a wider rollout.
  • Model traffic must stay on approved providers.
  • You need to limit which MCP servers engineers can connect.
  • Engineers use the CLI or Cline Desktop alongside the IDE extension.

Evaluation criteria

  1. Sign-in and roles

    Do engineers sign in with corporate identity?

    Look forSSO through WorkOS AuthKit with Okta, Microsoft Entra ID, Google Workspace, or generic SAML or OIDC, and the Member, Admin, and Owner roles. Members cannot switch to a personal account in the IDE extensions. Cline's Enterprise plan also lists SCIM provisioning.

  2. Approved providers

    Can engineers send code to a provider you have not approved?

    Look forAllowed providers set in remote configuration: Cline, Amazon Bedrock, Google Vertex AI, Azure Foundry, Anthropic, OpenAI-compatible endpoints, or LiteLLM. Only the VS Code and JetBrains extensions enforce the list. In the CLI and Cline Desktop, members can choose other providers.

  3. MCP servers

    Which tools can the agent call?

    Look forallowedMCPServers to allowlist local servers by ID, remoteMCPServers to push approved hosted servers, and blockPersonalRemoteMCPServers. Start with no auto-approved state-changing tools. Regulated teams that vet each server first can turn off the MCP marketplace, which also blocks local MCP servers. A developer in a regulated company contributed that setting in v3.4.5.

  4. Telemetry and prompt data

    What leaves the developer's machine?

    Look forTelemetry is on by default and excludes code and prompts. The exception is the Cline and ClinePass providers, which receive prompts to run the model. Set the organization telemetry setting, then turn telemetry off on each machine that runs the CLI or Desktop, because both ignore the organization setting.

  5. Workspace files

    Will organization settings end up in Git?

    Look forIgnore **/.cline/enterprise/ and **/.cline/remote-config/ in every repository. Cline writes the organization's settings there, and the copy can include the access keys for prompt storage.

  6. Autonomy policy

    Who may run Cline with every action auto-approved?

    Look forA written YOLO-mode policy, enforced through review and endpoint policy. Cline documents a yoloModeAllowed setting, and its enforcement table lists no product that enforces it.

Questions to ask vendors

  1. When will the CLI and Cline Desktop enforce provider, MCP, and telemetry controls? If your rollout includes them, put the date in the order form.
  2. When will any Cline product enforce yoloModeAllowed?
  3. Which administrative actions does the audit log record, how long does Cline keep it, and can we export it? Cline's docs promise selective audit logging of administrative operations and keep a removed member's logs, but they name neither the actions nor the retention period.
  4. How does Cline handle prompt injection from files, web pages, or MCP results that try to exfiltrate secrets?

Red flags

  • The rollout includes the CLI or Cline Desktop but relies on remote configuration for provider control.
  • Repositories do not ignore the .cline/remote-config/ and .cline/enterprise/ folders.
  • Auto-approve is broad on machines that hold production credentials.
  • Nobody watches Cline's security advisories. A 2025 data-exfiltration report went more than 90 days without a fix after private disclosure. Cline published three advisories in 2026, including a critical WebSocket hijack in its Kanban server on May 8.

Products in this piece

Sources

Official documentation
9
Public source
3
  1. Cline docs: Cline EnterpriseOfficial documentationdocs.cline.bot
  2. Cline docs: SSO setupOfficial documentationdocs.cline.bot
  3. Cline docs: Enterprise provider configurationOfficial documentationdocs.cline.bot
  4. Cline docs: MCP server controlsOfficial documentationdocs.cline.bot
  5. Cline docs: YOLO mode controlsOfficial documentationdocs.cline.bot
  6. Cline docs: TelemetryOfficial documentationdocs.cline.bot
  7. Cline pricingOfficial documentationcline.bot
  8. Embrace The Red: Cline: Vulnerable To Data Exfiltration And How To Protect Your Data (Aug 27, 2025)Public sourceembracethered.com
  9. GitHub issue #1870: a regulated team asks to disable the MCP marketplace (Feb 20, 2025)Public sourcegithub.com
  10. Juan Torchia: Cline on Autopilot: Why I Put Limits on My Agent (Sep 2, 2026)Public sourcedev.to
  11. Cline docs: Managing membersOfficial documentationdocs.cline.bot
  12. Cline security advisories on GitHubOfficial documentationgithub.com

Keep reading

  1. Buyer guideCline Workflow Playbook: Plan, Act, and VerifyRun a Cline task from request to merge with committed rules, Plan mode first, a model per mode, small changes, and normal code review.
  2. Buyer guideCline Model Access and Spend: What Each Path CostsWhat your own key, Cline credits, and ClinePass each cost, what engineers report spending, and how to see the cost of each task.
  3. Buyer guideCline Auto-Approve and Checkpoints PolicyWhich actions Cline takes without asking, when YOLO mode is acceptable, and how checkpoints undo a bad step.
Read the research