Audited 2026-10-25 · Sources: GitHub repo metadata + README + releases/docs, watcher security scan, HN/X activity reported in our digest. Tabletop audit — nothing installed or executed.
The card
| Repo | JetBrains/thinkrail |
| Stars | ~1.9k (GitHub, audit date) — digest caught it at 1,643 gaining ~85/hour; #8 on GitHub trending that day. Two Hacker News threads, the larger one front-page at 150+ points. |
| License | Apache-2.0 |
| Provenance | Verified JetBrains org — official incubator badge, thinkrail.ai site and blog, signed Windows and macOS binaries (Linux unsigned). Early-stage and labeled as such. |
| What it is | An agentic IDE: a real workbench (Monaco tabs, terminals, diff review) wrapped around the pi coding agent. Every task runs in its own git worktree; a graph of SPEC.md files and portable Agent Skills give the agent durable project memory; MCP servers come through pi's mcp.json with per-tool approval prompts. |
| Install surface | Native desktop installer (Electrobun) or a self-contained thinkrail CLI that opens the same app in a browser. Source builds need Bun 1.4.4 and Node ≥22.19 — bun install fires a setup script (see scan findings). |
What problem it solves
Agent coding tools mostly ask you to live in a terminal or surrender the whole repo. ThinkRail's answer is isolation as the interface: each task gets its own worktree, branch, and chat session, so parallel agent work never touches your checkout — you review diffs, merge the good branch, discard the rest. The spec graph keeps intent alive between sessions instead of re-explaining the project every prompt.
Our gate findings
| Gate | Finding |
|---|---|
| Upstream identity | Verified — JetBrains GitHub org with the incubator badge; Windows CLI and desktop executables signed, macOS CLI signed (not yet notarized), Linux artifacts unsigned. |
| License | Apache-2.0 — clean. |
| Blast radius — the good part | Worktree-per-task is the containment pattern we recommend: agent edits land in a disposable branch. MCP calls that aren't marked read-only prompt in-chat first; repository-defined servers stay off until you approve them. That's the right shape for agent tooling. |
| Telemetry — read this row | Usage events go to JetBrains under a random install ID; error reports are always sent (error type and code location in ThinkRail's own code only — no prompts, paths, or file names, per the README). Additional sharing is opt-in, and THINKRAIL_NO_ANALYTICS=1 covers a run. Disclosed better than most — still an outbound pipe to count. |
| Supply chain | The engine is @earendil-works/pi-coding-agent — a third-party agent package, not a JetBrains-built model. Provider credentials live in pi's auth, not a ThinkRail account. One more link to vet. |
| Security scan | WARN, zero failures: a setup script that runs on dependency install (postinstall-class — read before you run bun install), install docs that download-and-run a script from the web, a base64-encoded test image, standard example keys in a test file, and two scanner tools missing on our runner. Nothing malicious identified. |
| Maturity | Early-stage: 200+ open issues, nightly builds, self-update flow. The README's own platform table lists unsigned Linux artifacts. |
Verdict: CAUTION — GO for a side-repo evaluation. Org provenance and isolation design are real. The cautions are the install hook, always-on error reporting, and the fact that an agent IDE is a command-running process by design. Point it at a repository you can afford to reclone.
Best for
Teams evaluating agentic IDEs who want IDE-grade UX instead of a terminal multiplex — and anyone studying how to wrap an agent correctly: worktree per task, spec graph as ground truth, explicit MCP trust prompts. It is, frankly, close to how our own fleet is organized, which makes it worth reading even if it never touches your editor.