w3bs.AccountStart building
PACKAGES / OpenHands (All Hands AI)

OpenHands CLI

Terminal client for the OpenHands AI software development agent.

ThreatCrush · No malware found
INSTALLw3bs install openhands.dev/openhands-cli

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install openhands.dev/openhands-cliInstall OpenHands CLI and track it for updates
  2. openhandsStart the TUI; the first run walks you through LLM settings
  3. openhands --headless -t "<task>"Run one task without the UI, for CI and scripts
  4. openhands --resume --lastResume your most recent conversation
  5. openhands webOpen the same TUI in a browser

Every option: openhands --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in OpenHands CLI 1.16.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 23:00 UTC · threatcrush 0.13.30
Files
344 (installer + github.com/OpenHands/OpenHands-CLI@283c6ac3610f)
Findings
2 high · 1 medium · 3 low
6 other findings (not malware)
  • high
    Generic API Keysource/openhands_cli/tui/utils/critic/feedback.py:29secret-generic-api-key · CWE-798
  • high
    outbound request to a non-constant URLsource/openhands_cli/version_check.py:57py-ssrf-outbound-request · CWE-918
  • medium
    stack trace returned to the callersource/openhands_cli/tui/modals/settings/utils.py:265py-stack-trace-returned · CWE-209
  • low
    Hardcoded Credentialsource/tests/auth/test_login_command.py:138secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth/test_login_command.py:204secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/auth/test_login_command.py:291secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/openhands.dev/openhands-cli/badge.svg)](https://w3bs.org/packages/openhands.dev/openhands-cli)