# Scan: Junie > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Junie: freedom 2, 2, 4, 4, 4, 2, 2, 2, 2 across its configurations; deployment governance not assessed. > Page: https://gamma-ray.sgit.ai/scans/junie/ · Source: data/scans/junie.json Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor JetBrains' coding agent that plans and makes changes in a code base, in JetBrains IDEs, on the command line and in CI through GitHub and GitLab. A scan of a product as its vendor documents it, not of any one deployment. Made by the report studio: a researcher-assessor, a challenger, then the scorer. Built only from JetBrains' own public documentation for Junie, its blog, legal and AI terms pages, the JetBrains Marketplace, and Junie's published llms.txt. Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated. *Figure. The label for this rating; its contents are in the text.* 2 Freedom as shipped Suggests 4 Freedom at most Acts widely 12 Controls it brings as shipped n/a Deployment governance not assessed ## How to read it This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings. *Figure. The freedom level of each configuration; the table has the same.* | Configuration | What changes | Freedom | Controls | Turned on by the operator | |---|---|---|---|---| | **As shipped** | Junie in a JetBrains IDE or the CLI with its defaults: sensitive actions ask first. | 2 Suggests | 12 | nothing | | **Ask mode** | Read-only exploration; no file changes. | 2 Suggests | 12 | it retrieves information and recommends actions; a person acts | | **With an allowlist** | Commands the user allows run without asking. | 4 Acts widely | 12 | the agent handles routine tasks; the person is consulted on exceptions | | **Brave mode Auto** | A safety classifier approves terminal commands it considers safe. | 4 Acts widely | 12 | the agent works independently; the person approves critical decisions only | | **Brave mode On** | Potentially sensitive actions run without approval. | 4 Acts widely | 12 | the agent has full autonomy within boundaries; the person monitors | | **With MCP servers** | The user or project configures MCP servers. | 2 Suggests | 12 | it connects to external tools or services across a trust boundary | | **In CI (GitHub Action)** | Junie runs on the customer's GitHub runners with the documented workflow permissions. | 2 Suggests | 13 | it asks for narrower access than the whole account | | **With guidelines and hooks** | An AGENTS.md guidelines file; hooks in the early access CLI. | 2 Suggests | 14 | a limit on it is a rule in prose; policy is enforced as machine-readable rules | | **Sandbox mode (Early Access)** | Junie CLI started with --sandbox or /sandbox: agent terminal commands run in an OS-level sandbox; macOS and Linux only. | 2 Suggests | 13 | a limit on it is enforced by something outside its own reach | The same product is a different agent in each row. A rating of a deployment starts by saying which row it is. An indicator with no evidence is reported as not evidenced; it is never read as a no. ## The profile *Figure. One square per indicator, by question; every answer is listed below.* ## The grant: what it can actually do The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given. **Not measured.** Not measured. No deployment shape for this product is published in the capability grammar. ## Seen, and not credited - A JetBrains Research post reports from surveys that 5% of developers regularly use Junie at work. A usage figure for the whole product, ask mode included, not for what Junie does on its own; read strictly, it does not meet the rule for being in production. Whether it should is a question for a person. [Source](https://blog.jetbrains.com/research/2026/04/which-ai-coding-tools-do-developers-actually-use-at-work/) - The Junie plugin reports tens of millions of downloads on the JetBrains Marketplace. Downloads count installs, not what the agent does on its own. [Source](https://plugins.jetbrains.com/api/plugins/26104) - The IDE help page describes Junie to its users as an AI coding agent developed by JetBrains. A description of the product to its user, not the agent telling the people it talks to (for example in GitHub or GitLab threads) that it is an AI; no source read shows that disclosure. [Source](https://www.jetbrains.com/help/ai-assistant/junie-agent.html) - The Action Allowlist is a file in the user's home directory (~/.junie/allowlist.json) that the user can edit by hand; brave mode is a user toggle. The page shows a setting the user changes, not one the agent's own account could change; for the sandbox policy the page says an agent edit needs a fresh Allow once approval. [Source](https://junie.jetbrains.com/docs/junie-cli.html) ## What its evidence reaches *Figure. The mashup graph with this agent's evidenced indicators lit.* ## Every answer, with its source ### What is the agent built on? - *Not evidenced.* It is a vendor's assistant, used as supplied. - *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code. - *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data. - **As shipped.** It generates and executes code with local or cloud privileges. In code mode Junie runs terminal commands, creates and edits files and runs tests in the user's project. [Source](https://junie.jetbrains.com/docs/junie-ide-plugin.html) (documented) - *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries. ### Does it act, or only answer and recommend? - *Not evidenced.* It follows fixed rules, with no reasoning. - **Available, if the operator turns it on.** It retrieves information and recommends actions; a person acts. In ask mode Junie explores and explains the code without changing files; the person acts. [Source](https://junie.jetbrains.com/docs/junie-ide-plugin.html) (documented) - **As shipped.** It executes actions itself. In code mode, Junie breaks a task into a plan and itself runs terminal commands, creates and edits files and runs tests. [Source](https://junie.jetbrains.com/docs/junie-ide-plugin.html) (documented) - *Not evidenced.* It is in production: a public source names a customer or gives usage figures for what it does on its own. ### How far does it reach? - *Not evidenced.* It works in one domain's data. - **As shipped.** It works across several domains or systems. The release post says Junie connects to databases configured in the IDE through DataGrip and the JetBrains Database plugin and works on SQL in the same session as the code. [Source](https://blog.jetbrains.com/junie/2026/06/junie-coding-agent-out-of-beta/) (documented) - **Available, if the operator turns it on.** It connects to external tools or services across a trust boundary. Junie CLI can connect to external tools through MCP servers that the user configures. [Source](https://junie.jetbrains.com/docs/junie-cli-mcp-configuration.html) (documented) ### Does it work with other agents? - *Not evidenced.* Several agents coordinate inside the organisation. - *Not evidenced.* Agents operate across organisational boundaries or disparate stacks. - *Not evidenced.* There is a published protocol or communication layer between agents. - *Not evidenced.* Others build on it: third parties publish integrations, skills or agents for it. - *Not evidenced.* It exposes an agent interface: a published MCP server, an agent card, or an API documented for agents to call. ### What is the person's role? - *Not evidenced.* The person operates: every action is prompted and controlled by them. - **As shipped.** The agent suggests; the person reviews and approves each action. Unless brave mode is turned on, Junie CLI asks before terminal commands, MCP tools and other sensitive actions. [Source](https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html) (documented) - **Available, if the operator turns it on.** The agent handles routine tasks; the person is consulted on exceptions. Commands added to the Action Allowlist run without a prompt; anything else still asks the person. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) - **Available, if the operator turns it on.** The agent works independently; the person approves critical decisions only. In brave mode Auto, a safety check approves commands it classes as safe and asks for the rest. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) - **Available, if the operator turns it on.** The agent has full autonomy within boundaries; the person monitors. With brave mode On, Junie CLI runs every sensitive action without asking; the user turns it on. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) ### Is what it is for written down? - **As shipped.** Its purpose and permitted tasks are stated in writing. The documentation states what Junie CLI is for: reviewing, writing and modifying code. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) - **As shipped.** Its autonomy limits and the tools it may use are defined. The allowlist defines five action types and, for each, rules that allow an action or ask first. [Source](https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html) (documented) - **As shipped.** Its limits and known failure cases are documented for those who use it. The headless page states that non-interactive runs load project configuration without a trust prompt. [Source](https://junie.jetbrains.com/docs/junie-headless.html) (documented) ### Does it have its own identity and only the access it needs? - **Claimed, not counted.** What it can reach is enumerated: scopes, permissions, tools. The Action Allowlist page documents a list of five action types (fileEditing, executables, mcpTools, readOutsideProject, readSecretFile), each taking allow or ask rules in the user's allowlist file; this is a documented list, not a measured grant. [Source](https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html) (documented; this fact has to be observed or measured to count) - *Not evidenced.* Its authorisation is published as metadata that anyone can read. - **Available, if the operator turns it on.** It asks for narrower access than the whole account. The page gives a junie.yaml template that the user copies into the repository's .github/workflows/; its job permissions block has three entries, contents, pull-requests and issues, each set to write. [Source](https://junie.jetbrains.com/docs/junie-on-github.html) (documented) - *Not evidenced.* It has its own identity, separate from any person's. - *Not evidenced.* Its identity is cryptographic and can be checked by others. - *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on. ### Is it in a registry, with an owner? - *Not evidenced.* The organisation keeps a registry of its agents. - *Not evidenced.* Each agent has a named owner. - *Not evidenced.* Agents are retired by a defined process. ### Who is accountable for it? - *Not evidenced.* A named executive or body is accountable for the organisation's agents. - *Not evidenced.* Roles and responsibilities for AI risk are documented. ### Is there a policy that governs it? - *Not evidenced.* A governance policy for agents is published. - *Not evidenced.* Agents and use cases are classed by risk. - *Not evidenced.* The laws that apply to it are identified. - *Not evidenced.* New agents pass an approval or review before they run. ### Can a person step in or stop it? - **As shipped.** High-impact actions need a person's approval. Most terminal commands, edits outside the project and MCP tool calls wait for the user's approval. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) - *Not evidenced.* There is a way to pause or stop it. - *Not evidenced.* There is a defined escalation path. ### Is what it does logged? - *Not evidenced.* Its actions are logged. - *Not evidenced.* The log is tamper-evident and kept for a stated time. ### Is it watched while it runs? - *Not evidenced.* It is monitored in operation. - *Not evidenced.* Anomalies are detected in real time and raise alerts. ### What stands between it and what it should not do? - **Available, if the operator turns it on.** A limit on it is enforced by something outside its own reach. Sandbox mode, in the Early Access Program and off unless the user starts it, runs agent terminal commands in an OS-level sandbox (srt) that limits filesystem access and restricts native edit tools; MCP servers and hooks are not isolated by it. [Source](https://junie.jetbrains.com/docs/junie-cli.html) (documented) - *Not evidenced.* A limit on it is a setting that its own account could change. - **Available, if the operator turns it on.** A limit on it is a rule in prose. Project and global AGENTS.md guidelines are added to every task, and the page says the global file can hold organization-wide rules for all projects. [Source](https://junie.jetbrains.com/docs/guidelines-and-memory.html) (documented) - **Available, if the operator turns it on.** Policy is enforced as machine-readable rules. PreToolUse hooks can inspect or block a tool call before it runs; hooks are in the Early Access Program. This is a mechanism, documented only. [Source](https://junie.jetbrains.com/docs/junie-cli-hooks.html) (documented) - *Not evidenced.* The difference between what it can reach and what it is for is stated. ### Is it tested, and are the results shown? - **As shipped.** Test or evaluation results are published. The release post reports Junie's SWE-Rebench result (61.6% resolved) in a quote attributed to a Research Lead at Nebius, and links the SWE-Rebench site. [Source](https://blog.jetbrains.com/junie/2026/06/junie-coding-agent-out-of-beta/) (documented) - *Not evidenced.* It is tested for safety and security, including by attack. - **As shipped.** People who did not build it take part in assessing it. The post describes SWE-Rebench as an independent agent benchmark and quotes a research lead at Nebius. [Source](https://blog.jetbrains.com/junie/2026/06/junie-coding-agent-out-of-beta/) (documented) ### What happens when it goes wrong? - *Not evidenced.* There is an incident process for agents. - *Not evidenced.* Incidents and errors are communicated to those affected. - *Not evidenced.* There is a plan for a failure of a third party it depends on. ### Do people know it is an AI, and can they answer back? - *Not evidenced.* It tells the people it talks to that it is an AI. - **As shipped.** There is a channel to report problems with it or contest its output. A /feedback command sends feedback on the current session, with its logs, to the Junie team. [Source](https://junie.jetbrains.com/docs/slash-commands.html) (documented) - **As shipped.** It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card. junie.jetbrains.com serves an llms.txt and links an OpenAPI description; both resolved when fetched on 10 November 2026. [Source](https://junie.jetbrains.com/llms.txt) (observed) ### What data does it use, and under what rules? - **As shipped.** The data it uses is described. The JetBrains AI terms (AI Assistant, Junie) describe the data used: source code, information derived from it and usage information sent with inputs; a separate notice describes collected data. [Source](https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-service/) (documented) - *Not evidenced.* There are data quality rules for what it reads. - *Not evidenced.* Its privacy risk has been examined. ### What does it depend on from others? - **As shipped.** The models and third-party components it uses are listed. The service providers page lists OpenAI, Google, Anthropic and SpaceXAI as model providers for Junie, and the models JetBrains hosts. [Source](https://www.jetbrains.com/legal/docs/terms/jetbrains-ai/service-providers/) (documented) - *Not evidenced.* Third-party components are monitored and have risk controls. ### Has anyone independent checked? - *Not evidenced.* A public certificate or audit report covers it. - *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator. ### Is the organisation behind it ready? - **As shipped.** There is a stated strategy for agents. The CEO's post sets out the company's direction for agentic software development through JetBrains Air, a product line that the post says will support Junie across all its surfaces. [Source](https://blog.jetbrains.com/blog/2026/09/22/introducing-jetbrains-air/) (documented) - *Not evidenced.* The people who work with it are trained. - *Not evidenced.* Its value is measured. - *Not evidenced.* It is improved on a regular cycle. - *Not evidenced.* The organisation's risk management covers agents. ## The vault This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`zwx0116w`, published 2026-11-10). Anyone can read it with this key: `sgit_public_read_76f22887a5be444fb2816ffb6b98e9a1b8278e8b351140d4874c78d0ac678601:zwx0116w` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_76f22887a5be444fb2816ffb6b98e9a1b8278e8b351140d4874c78d0ac678601:zwx0116w`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.