What is an agentic web IDE? Definition, criteria and the 2026 landscape

An agentic web IDE is a development environment that runs in the browser and hands real work to AI agents. Agentic means the model does more than autocomplete: it plans a task, edits several files, runs commands in a terminal, reads the output and corrects itself. Web means there is no installer, no local VS Code fork and no local workspace. The editor, the git checkout, the terminal and the agents all live on a server; your browser is just the window. That combination is rarer than the marketing suggests: most tools sold as "agentic IDEs" in 2026 are desktop editors. This article defines the term, lists eight criteria a browser-based agentic IDE has to meet, and sorts the current landscape honestly, including where UltraNOS fits and where it does not.

Why "in the browser" is not a detail

It is tempting to treat the browser part as packaging. It changes four things that matter in daily work.

Any device, including the phone. A workspace that lives on a server can be opened from a laptop, a tablet or an Android phone without syncing anything. An agent you started at your desk keeps running after you close the lid, and you can check its output on the train. Desktop editors can approximate this with remote SSH sessions, but the agent loop then still runs on whichever machine you happen to be on.

Shared workspaces by default. If the files are on the server, a colleague opening the same project sees the same state. There is no "works on my machine" for the agent either: it ran on the server, with the server's toolchain.

Resource limits are enforced server-side. An agent that spawns a runaway build on your laptop takes your laptop down. On a server, the operator can cap CPU time, process count, memory and disk per tenant, and kill a runaway process tree before it hurts the neighbours. That is not possible in a client-side tool, because the tool does not own the machine.

No local key on a shared machine. With a desktop agentic IDE, your model API key sits in a config file on every device you use. In a hosted setup, keys are stored once on the server side, and the prompt path can be filtered before it leaves for the model provider. Whether that filtering actually happens is one of the criteria below.

There is also a cost: a web IDE is useless offline, and you are trusting an operator with your source. Both points come up again in the "who it's not for" section.

Eight criteria for an agentic web IDE

A chat window next to a code viewer is not an IDE, and a code viewer with a "fix this" button is not agentic. The table lists what has to be there for the term to hold.

#	Criterion	Why it matters
1	Real editor with tabs, diagnostics, jump-to-line	Agents write code; you still have to read and fix it. A syntax-highlighted textarea is not enough.
2	Real terminal (PTY), not a command runner	Agents need interactive shells, and so do you when a build hangs.
3	Git built in: status, stage, commit, push, branches, clone	Every agent change should be reviewable as a diff and revertible.
4	Several agents in parallel, visible and stoppable	One agent per task is the whole point of delegation. You need to see what each is doing and kill it.
5	Tool approvals for dangerous actions	rm -rf, force push and DROP TABLE should not run because a model felt confident.
6	Loop and cost brakes	Agents repeat themselves. A budget per turn and a detector for the third identical tool call save money and time.
7	Memory across sessions	Without persistent context you re-explain the repository every morning.
8	Secret protection on the prompt path	Agents read .env files and shell output. Whatever they read goes to the model provider unless something filters it.

Criteria 1 to 3 are what makes it an IDE. Criteria 4 to 6 are what makes it usable with agents rather than dangerous. Criteria 7 and 8 are what a hosted setup can do better than a desktop tool, if it bothers.

The 2026 landscape, sorted fairly

Search results for "agentic IDE" are dominated by listicles ranking a dozen products. Almost all of them belong to the first group.

Desktop agentic IDEs

Cursor, Windsurf, Kiro, Antigravity and Trae are installable desktop editors, most of them derived from VS Code, with an agent mode that edits files and runs commands on your machine. Zed is a native editor with its own agent panel. These are good tools with large user bases. None of them runs in the browser, and none puts the workspace on a server by default. If you search for "agentic web IDE" and land on one of them, you have found an agentic IDE, not a web one.

Agentic tools in the browser

Claude Code on the web and OpenAI's Codex web run agents in a hosted sandbox against a repository and hand you back a diff or a pull request. They are agentic and they are web-based, but they are agent runners rather than IDEs: there is no editor you work in, no terminal you type into, no git panel. Replit is the closest thing to a full agentic web IDE from a large vendor, with editor, shell, hosting and an agent in one browser tab, centred on building and deploying apps in Replit's own environment. App builders such as Bolt and Lovable generate whole applications from a prompt in the browser; they are agentic and web-based, but they are optimised for producing an app, not for working inside an existing codebase.

Where UltraNOS sits

UltraNOS is a browser workspace with a multi-agent chat, a Monaco editor, git, a real terminal and persistent memory, hosted at Hetzner in Nuremberg. It is not open source; the repository is private. It is not a VS Code fork and not a desktop app, apart from an Android app. Self-hosting is available on request, not as a download. It brings no model of its own: the AI comes from the provider you configure, whether Claude, an OpenAI-compatible endpoint, Ollama or a custom URL. That is the honest placement: a small, hosted, browser-first agentic IDE with a provider-agnostic model layer, next to much larger desktop products and much larger web agent runners.

How UltraNOS meets the eight criteria

Every line below comes from the current feature sheet. Where a limit exists, it is named.

1. Editor. Monaco with tabs, dirty markers, Cmd+S, jump-to-line, lint diagnostics from ruff and a JS check, inline ghost-text completion with a 500 ms debounce and a small cache, and a blame line in the style of GitLens. File tree with lazy loading, Cmd+P file search and Cmd+Shift+F content search.

2. Terminal. A PTY over WebSocket in the browser, with a special-key bar on the phone. Eight terminals per tenant, output throttled to 512 KB/s so a runaway cat cannot freeze the tab.

3. Git. Status, stage and unstage, commit, push, branches, stash, fetch, pull, merge, init and clone. Clone defaults to a partial clone with optional sparse paths, because large repositories are a stated goal. An AI-generated commit message is offered, not imposed. There is also UltraForge, a built-in git server over Smart HTTP with repositories, issues and pull requests.

4. Agents in parallel. The chat can spawn sub-agents that appear live in an agent fleet panel with streaming output, tool badges and a stop button. Limits are explicit: nesting depth 2, at most 16 concurrent tasks, callback depth 8. Sessions can query other sessions (cross-chat) with a 120-second blocking limit. A pipeline mode runs Plan, Code, Test, Review, Security and Verify stages with a judge model.

5. Tool approvals. An approval dialog for unsafe tools, with batch approval and a log. Four built-in guards block rm -rf, force push, DROP TABLE and curl | bash, plus your own regex rules. Every child process gets hard limits on CPU time, file size, process count and file descriptors, with memory capped through cgroups and builds running in a bwrap sandbox.

6. Loop and cost brakes. A loop guard warns on the third identical tool call with the same result and stops executing from the fifth; A↔B oscillation is detected separately. Each turn has a time budget, defaulting to 45 minutes. When a provider returns a rate limit or a token-limit cut-off, the turn is resumed automatically at most twice. Retries follow the provider's Retry-After header, then back off 1, 2, 4, 8, 16 seconds.

7. Memory. Persistent memory across sessions (Centre AI), per-session context limits with summarisation of older history, and since 2026-09-05 a context restart with a hand-over record instead of a lossy compression.

8. Secret protection. The cloak layer replaces API keys, passwords and e-mail addresses with placeholders before the request reaches the provider. On the hosted instance it runs in the enforce profile; you can verify that yourself via GET /api/health. Two limits matter. First, it is pattern-based: a secret with no known prefix, no assignment context and low entropy passes through, which is why UltraNOS does not advertise an absolute "never" for secrets. Second, the hosted instance currently runs Claude through the CLI path (claude-instanz). On that path only the prompt and system prompt are filtered; tool calls are executed by the CLI itself and their results do not pass through cloak. Filtering of tool results and placeholder resolution in tool calls apply to the API paths, which you get when you configure your own Anthropic, OpenAI-compatible or Ollama key. The details are in Redact API keys before they reach the LLM.

Is there a free agentic web IDE?

The honest answer is "free tier, plus your own model bill". UltraNOS has a Starter plan at 0 € with 200 MB of storage, and a 14-day trial of the paid tiers. Pro is 19 € per month with 5 GB, Team is 49 € per month with unlimited storage. The model calls are paid to whichever provider you connect, or you use the operator-paid access included in the hosted plans. With Ollama on your own hardware the model side can be free as well, at the cost of smaller models.

The desktop products and the web agent runners listed above also have free tiers or trials, but their limits change often. Rather than repeat numbers that may be stale by the time you read this, check each vendor's pricing page. The pattern is the same everywhere: the editor is free or cheap, the tokens are where the money goes.

For the "open source agentic IDE" search intent: UltraNOS is not open source. If that is a hard requirement, look at Zed, which publishes its editor source, or at VS Code itself with an agent extension. Neither of those is web-based.

Who this is not for

An agentic web IDE is the wrong tool if you need to work offline, on a plane or behind a firewall that blocks WebSockets. It is the wrong tool if your policy forbids source code on any third-party server; the on-request self-hosting exists for that case, but it is not a one-click download. It is also not a replacement for a model subscription: without a configured provider the agents have nothing to think with.

If your work is a single file and a REPL, a desktop editor with an inline assistant will feel faster. If your team has spent years tuning a VS Code setup with a hundred extensions, the browser version will feel thin in places, because it is; UltraNOS has an editor, not an extension marketplace. And if you want an app generated from a sentence and hosted the same afternoon, the app builders do that better than a general-purpose workspace.

Where the browser version wins is the case it was built for: several agents working on a real repository, on a server that enforces limits, reachable from any device, with git and a terminal for the human who has to check the result.

FAQ

What is an agentic IDE?

An agentic IDE is a development environment in which an AI agent can plan a task, edit multiple files, run commands and react to the results, rather than only suggesting the next line. Cursor, Windsurf, Kiro, Antigravity, Trae and Zed are the best-known desktop examples in 2026. The word "web" is added when the whole thing, workspace included, runs in the browser on a server.

What is the difference between an agentic IDE and Copilot-style completion?

Completion predicts text at the cursor and stops there. An agent takes a goal, decides which files to open, writes changes across them, runs tests or builds in a terminal, reads the output and tries again. The difference shows up in tooling: an agent needs approvals for dangerous commands, a loop guard and a way to be stopped, none of which a completion engine needs.

Which agentic IDE is free?

Most vendors offer a free tier or trial for the editor and charge for model usage. UltraNOS has a Starter plan at 0 €; the paid tiers are 19 € and 49 € per month, with a 14-day trial. For the desktop tools and web agent runners, their pricing pages are the only reliable source, because limits change frequently.

Does a web IDE work offline?

No. The editor, terminal, git checkout and agents live on the server, and the browser only renders them. Without a connection nothing runs. A desktop agentic IDE can edit files offline, though its agent still needs a network to reach a model unless you run one locally.

Can I use my own models?

In UltraNOS, yes: Claude through the API or CLI, any OpenAI-compatible endpoint, Ollama, or a custom URL, with eight routing slots so that chat, planning, review and commit messages can use different models. Which providers a desktop tool supports varies; some are tied to one vendor's models, others allow a custom key.

Is my code safer in a web IDE than on my laptop?

Different, not automatically safer. On a server, an operator can enforce process limits, sandboxes and secret filtering that a desktop tool cannot. In return you hand your source to that operator. UltraNOS names its server location, offers a data-processing agreement, and lets you check the secret-filter status via the health endpoint; it does not claim an absolute "never" for secrets, because pattern-based filtering has gaps. More on the blog at https://ultranos.de/blog/.

Your keys stay yours — the rest runs in the browser.

UltraNOS is the agentic web IDE: parallel AI agents, editor, git and terminal. cloak replaces API keys and passwords before a prompt reaches the provider. Hosted in Germany, 14 days free.

Try 14 days free →