Aider

US CLOUD Act exposureOpen sourceApache-2.0

Homepage ↗Repository ↗

USAGE ON STAV · LAST 12 WEEKS

Where Aider shows up on Stav.

Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.

STAV REVIEW · LAST REVIEWED 06/21/2026

“A BYO-key CLI pair-programmer with genuinely Sovereign Inference posture, held back from enterprise-ready by an undocumented Mixpanel SDK that four curator runs have not resolved.”

Good for

Engineering teams that want AI-assisted coding with prompts and code routed directly to their own LLM endpoints — Aider AI LLC is never in the Inference path
On-premises and air-gapped deployments via Docker or local model backends such as Ollama
Teams comfortable managing API keys per-developer and happy to configure Stav as a custom LLM endpoint
Open-source buyers who need Apache-2.0 licensing with no copyleft obligations and full access to source

Watch out for

A Mixpanel SDK (mixpanel==5.0.0) is a confirmed direct runtime dependency in PyPI v0.86.2 yet is entirely absent from the vendor's privacy policy and analytics documentation — runtime invocation is unverified across four consecutive curator runs; block Mixpanel endpoints at the network layer and audit the source before deploying in regulated environments
Aider AI LLC is a US LLC with full CLOUD Act exposure, and the vendor supplies no DPA, SOC 2, ISO 27001, or SLA — compliance assurance rests entirely on your own deployment controls
High contributor concentration around a single primary author introduces bus-factor risk; the project has no bug bounty, no security.txt, and publishes no signed binaries or SBOM

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What Aider needs from a model.

Required

Streaming
Tool calling

Recommended

Code-native
Extended thinking
Long context (≥128k)

Known issues3 open

Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.

2026-06-02

lowUpstream change on aider: github_last_push '2026-05-16T00:55:02Z' → '2026-05-22T14:02:20Z'

other · open

Source ↗

2026-05-19

lowUpstream change on aider: github_last_push '2026-04-25T16:44:33Z' → '2026-05-16T00:55:02Z'

other · open

Source ↗

2026-05-05

lowUpstream change on aider: github_release None → 'v0.86.0', github_last_push None → '2026-04-25T16:44:33Z', cve_count None → 0

other · open

Source ↗

Data flow & telemetry

How Aider moves data between the client, the inference endpoint and any vendor-owned services.

Data flow

Direction: local_only
Stores prompts: No

Telemetry

Collects telemetry: true
Privacy policy: https://aider.chat/docs/legal/privacy.html

Vendor & licensing

Developer

Aider

Where Aider shows up on Stav.

What Aider needs from a model.

Data flow

Telemetry

Security profile

Maintenance health

Popularity

What teams using Aider configure.