Simon Willison shipped a coding agent on July 2 — the kind of thing that reads and edits your files and runs shell commands until a task is done. What's notable isn't that it exists; it's how small it is. llm-coding-agent is an Apache-2.0 plugin for his llm command-line tool, not a standalone product. Install it and you get one new command, llm code, that turns any tool-capable model into a Claude-Code-style agent in your terminal. Here's how to run it safely.

Install it in one line#

The agent rides on top of the llm CLI, so if you have llm already you can just add the plugin. If you don't, pip pulls both:

pip install --pre llm-coding-agent
# or, if you already have the llm CLI:
llm install llm-coding-agent

The --pre flag is not optional. The plugin depends on an alpha release of llm (0.32a3 or newer), because the human-in-the-loop tool-calling machinery it needs — the ability to pause a tool chain and ask a human before continuing — only landed in the 0.32 line. Without --pre, pip resolves to the last stable llm and the install fails.

If you've never used llm before, set a key for whichever provider you want first — e.g. llm keys set openai — because the agent borrows llm's existing model and credential setup rather than inventing its own.

Start a session#

The command is llm code. With no arguments it drops you into an interactive session using your default model:

llm code

Give it a task inline to skip the first prompt, and use flags to choose a model and a working directory:

llm code "add type hints to utils.py"
llm code -m gpt-4.1 -d ~/dev/myproject

That -m flag is the quiet headline. The agent is model-agnostic: any tool-capable model llm already knows about works — OpenAI, Anthropic, Gemini, or a local model served through a plugin. You're not locked to one vendor's agent, and you can change your mind mid-conversation with !model gpt-4.1-mini.

The permission gate is the whole design#

An agent that can run execute_command in your repo is a loaded gun. The reason llm code is safe to point at real code is that it stops before every action that changes state. Under the hood there are six tools:

When it pauses, you get three choices:

y      approve this one action
a      approve similar actions for the rest of the session
<else> decline — the model is told, and can try another approach

That third option is the good part: declining isn't a dead end. The model receives the refusal as feedback and can propose a different path, so you can steer by saying no. All file access is also confined to the working directory — attempts to reach outside it come back as Error: strings the model has to deal with, not silent escapes.

Autonomy without a blank check#

Approving every pytest run by hand gets old fast. Two flags trade safety for speed, and they are not equal:

# Good: pre-approve only the commands you trust
llm code --allow "pytest*" --allow "git diff*"

# Dangerous: approve everything, no prompts at all
llm code --yolo

--allow is the one to reach for. It whitelists command patterns so routine, harmless calls run unattended while anything else still stops for you. --yolo removes the gate entirely — fine in a throwaway directory or a container, reckless in a repo you care about. You can also toggle it live with !yolo if you decide mid-session that you trust what it's doing.

Two more guardrails run whether you ask or not: the agent stops after 25 tool rounds per prompt by default (so a confused model can't loop forever), and shell commands time out at 120 seconds, capped at ten minutes.

Sessions are just llm logs#

Because the agent is a plugin, its sessions land in the same SQLite database as everything else llm does. That means the observability is free. Inspect what happened:

llm logs --short

And pick up where you left off — either the most recent session or a specific one by id:

llm code -c              # continue the latest conversation
llm code --cid 01ab...   # resume a specific one

Inside a session, a handful of ! commands give you control without leaving: !model to switch models, !tokens to check usage, !yolo to toggle auto-approval, and !quit to exit.

When to reach for it#

llm code is not trying to out-feature Claude Code or the open-source coding agents like Aider, Cline, and OpenHands. It's the minimal version of the pattern — a thin, auditable layer over a tool-calling engine you can already read end to end — and its edge is that it's model-agnostic and logs to a store you already own. Use it when you want a coding agent you fully understand, when you want to A/B two models on the same task without changing tools, or when you want the agent's every move sitting in a database you can query later. Start it in a git repo with a clean working tree, keep the permission prompts on until you trust it, and let the y/a/decline rhythm teach you how much rope this particular model has earned.