Alibaba’s Claude Code Alternative: A Step‑by‑Step Migration to Qoder CLI

Claude Code security detection

Public reverse‑engineering shows the Claude Code client checks for a custom ANTHROPIC_BASE_URL, reads the system timezone, and compares the configured proxy address against a built‑in domain/keyword list. The result is hidden inside the ordinary Date header of each request rather than sent as a separate telemetry packet.

Qoder CLI overview

Qoder CLI is Alibaba’s AI‑coding command‑line tool, functionally comparable to Claude Code. Common commands such as /clear, /compact and /help remain the same. The configuration file CLAUDE.md is renamed to AGENTS.md, but the overall workflow is unchanged.

Model integration differs: Claude Code defaults to Anthropic models and requires extra steps for third‑party models, whereas Qoder CLI supports BYOK (Bring‑Your‑Own‑Key) and can connect to Alibaba Cloud Bailei, OpenAI, GLM‑5.2, Kimi‑K2.7‑Code, etc.

Migration from Claude Code to Qoder CLI

Qoder provides a migration skill named claude-to-qoder-migration in its skill marketplace. The migration proceeds as follows:

Read‑only check scans Claude Code configuration without writing files.

Generate a migration plan that lists user‑level, project‑shared, and project‑local items to be copied or skipped.

Confirm high‑risk resources such as permissions, hooks and MCP secrets.

Execute the migration, copying source configuration while preserving existing Qoder files.

Output a migration report that enumerates migrated items, skipped items, conflict handling and post‑migration suggestions.

Items not migrated include auth state, OAuth/session files, managed settings, remote settings and trust caches; these must be configured manually in Qoder.

Step 1 – Install Qoder CLI

Visit https://qoder.com/zh , copy the OS‑specific installation command and run it. Verify the installation with:

qodercli --version

Step 2 – Log in

On first run, qodercli prompts for login. Two methods are available:

TUI login : select “Sign in to continue” or run /login in the interactive prompt.

Personal access token : paste a token into the terminal or set the environment variable QODER_PERSONAL_ACCESS_TOKEN for non‑interactive sessions.

# Linux/macOS example
export QODER_PERSONAL_ACCESS_TOKEN="your_personal_access_token_here"

# Windows CMD example
set QODER_PERSONAL_ACCESS_TOKEN="your_personal_access_token_here"

Step 3 – Model configuration

If the free quota is exhausted, the CLI prompts for an upgrade or custom model configuration. Adding a custom model follows these steps:

Enter /model in the dialog.

Select Custom and choose a provider (e.g., Z.ai).

Pick the model (e.g., GLM‑5.2).

Configure the context window and effort parameters.

Enter the API key.

Successful configuration shows a final confirmation screen.

Step 4 – Install and run the migration skill

Open the Qoder skill marketplace at https://qoder.com/zh/marketplace/skill?id=official_lj9fIgpz , copy the prompt for the Agent, paste it into the CLI, and the migration skill installs automatically. Restart the session and run: /claude-to-qoder-migration The migration copies settings, MCP servers, commands, skills, agents, hooks, memory ( CLAUDE.md → AGENTS.md), output styles, permissions and plugins. Existing .mcp.json and settings entries such as mcpServers are recognized directly.

Qoder CLI advantages

Multi‑model switching

Use /model → “Default” tab to switch among tiers Auto, Ultimate, Performance, Efficient, Lite. BYOK enables seamless integration with multiple providers, reducing reliance on a single vendor. If a service becomes unavailable, another compatible model can be selected without external configuration layers.

Model discounts

Qoder’s “Extreme” tier is the highest inference level. Until 30 July, users can claim 200 free Extreme‑mode runs with the command /claim-ultimate.

Security

Qoder CLI is ISO/IEC 27001:2022 certified. Security measures are grouped into five layers:

Transmission security : full TLS (1.2 strict + 1.3), WAF, DDoS protection.

Identity & access : enterprise SSO (SAML 2.0), MFA, RBAC, JWT verification.

Runtime & AI security : four‑stage engine – static rules → AST analysis → LLM risk assessment → sandboxed execution.

Data storage security : privacy mode, data residency, static encryption, tenant isolation.

Supply‑chain security : secure development lifecycle (SDL), software composition analysis (SCA), vulnerability disclosure program (VDP).

All CLI‑initiated network requests that involve platform services are recorded in operation logs, enabling complete traceability of who performed which network operation, when, and from where.

Data handling notes:

Project context is read locally.

Permission policies can restrict data exfiltration.

In remote‑control mode, project data remains on the local environment.

Real‑world task demonstration

A previous Claude Code demo project was used to add a TUI interface. The workflow:

Run /quest to describe the requirement. Qoder explored the project, asked follow‑up questions, and generated a design document.

After confirmation, Qoder scheduled Subagents (e.g., M1 Subagent) to implement the plan.

For long‑running work, /goal was used to let Qoder continue autonomously, entering auto mode and updating progress after each subtask.

The final TUI output was produced successfully, demonstrating compilation verification and functional correctness.

Parallel multi‑Agent development

During the TUI task, Qoder created multiple Agents for sub‑tasks, allowing parallel execution. Users can request multi‑Agent usage in the prompt or manually create Subagents via the UI. Built‑in Subagents are also available, and a dynamic workflow engine can orchestrate complex pipelines (token‑intensive, optional for simple tasks).

Large codebase reading assistant

An Agent was created for the open‑source interview-guide project to focus on the interview module. The steps:

Enter /agents to open the configuration panel.

Navigate to the User or Project tab, select “Create new agent…”, and confirm the description.

After restarting the session, invoke the agent with @code-reader to analyze the target module.

The Agent reads the local repository context and performs analysis based on the selected model.

Conclusion

Claude Code remains stable; existing workflows have no security or account concerns, so switching solely for novelty is unnecessary. Qoder CLI offers multi‑model switching, domestic access, configuration migration and enterprise audit capabilities. The migration skill lowers the trial barrier, and the overall experience is close to seamless.