5ire (pronounced fire) is a desktop chat client for AI models. Add keys for OpenAI, Anthropic, Google, Mistral, DeepSeek, Grok and others, or point it at Ollama, and talk to all of them from one window on macOS, Windows or Linux. It was one of the early desktop apps to support the Model Context Protocol, so you can give the assistant tools such as file access, databases or web search by adding MCP servers, with a marketplace to find them.
Beyond chat it has a local knowledge base that embeds your Word, Excel, PowerPoint, PDF, text and CSV files with the bge-m3 model on your own machine, a prompt library with variables, bookmarks, search across conversations, and a page showing what you have spent on each API.
Two caveats. MCP tools need Python, Node.js and uv installed, since many servers run on them. And the latest tagged release dates from March 2026, although commits are still landing, so check the releases page before assuming a bug is fixed.
- Repository: github.com/nanbingxyz/5ire
- Licence: custom (Other)
- Language: TypeScript. Stars: 5,374. Forks: 436. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit 7951787
Who it is for
People who use several AI providers and want one desktop app for all of them, and anyone who wants to try MCP tools without a coding editor.
Getting started
1. Download the installer for macOS, Windows or Linux from the latest release
open https://github.com/nanbingxyz/5ire/releases/latest2. For MCP tools on macOS, install the runtimes they need (uv has its own installer on astral.sh)
brew install python node uvSafety scan
We cloned nanbingxyz/5ire at commit 7951787 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits, no committed binaries and no bare-IP URLs.
- npm hooks: postinstall applies patch-package fixes, runs Electron's own download script and rebuilds native modules; prepare sets up Husky git hooks. All standard for an Electron project, and none runs for people who install the app.
- 293 known advisories in package-lock.json, 7 critical (Handlebars, protobufjs, proxy-addr, shell-quote). Some sit in build tooling, but the count is high for a desktop app; stick to the latest release.
- The network list is the AI providers it supports plus 5ire.app and openai.5ireai.com; 302.ai appears as a provider with a referral link. Keys stay in the app and are sent only to the provider you pick.
- Two workflows, none using pull_request_target; the one third-party action is not pinned. Licence and code of conduct present; no security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 2 npm lifecycle scripts |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 35 distinct hosts referenced from source; most often github.com, 5ire.app, huggingface.co, lbs.amap.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 293 advisories across 1,565 pinned packages: 7 critical, 146 high, 113 moderate, 27 low. package-lock.json: 1,734 packages, 293 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (2)
package.jsonpostinstall:patch-package && node ./node_modules/electron/install.js && npm run install:depspackage.jsonprepare:husky
Worst known vulnerabilities (24 of 293)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2w6w-674q-4c4q | critical | handlebars@4.7.8 | Handlebars.js has JavaScript Injection via AST Type Confusion |
| GHSA-8r5x-fm3f-whwj | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| GHSA-p8wg-vrv2-v86f | critical | handlebars@4.7.8 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| GHSA-xq3m-2v4x-88gg | critical | protobufjs@6.11.4 | Arbitrary code execution in protobufjs |
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-w7jw-789q-3m8p | critical | shell-quote@1.8.3 | shell-quote quote() does not escape newlines in object .op values |
| GHSA-23hp-3jrh-7fpw | critical | tar@6.2.1 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-23c5-xmqv-rm74 | high | minimatch@3.1.2 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| GHSA-3ppc-4f35-3m26 | high | minimatch@3.1.2 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
| GHSA-7r86-cg39-jmmj | high | minimatch@3.1.2 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| GHSA-2883-xcg3-v3hh | high | js-yaml@3.14.2 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@3.14.2 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@3.14.2 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-345p-7cg4-v4c7 | high | @modelcontextprotocol/sdk@1.22.0 | @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse |
| GHSA-46jr-4wx8-v453 | high | @modelcontextprotocol/sdk@1.22.0 | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation |
| GHSA-6qxp-vccf-f47h | high | @modelcontextprotocol/sdk@1.22.0 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server |
| GHSA-8r9q-7v3j-jr4g | high | @modelcontextprotocol/sdk@1.22.0 | Anthropic's MCP TypeScript SDK has a ReDoS vulnerability |
| GHSA-w48q-cv73-mx4w | high | @modelcontextprotocol/sdk@1.22.0 | Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default |
| GHSA-2w69-qvjg-hvjx | high | @remix-run/router@1.23.1 | React Router vulnerable to XSS via Open Redirects |
By the numbers
| Stars | 5,374 |
|---|---|
| Forks | 436 |
| Contributors | 35 |
| Commits | 1,545 |
| Open issues | 74 |
| Open pull requests | 6 |
| Releases | 36 |
| Latest release | v0.15.4 |
| Licence | custom |
| Main language | TypeScript |
| Project age | 2 years |
| Last push | Oct 24, 2026 |
| Tracked files | 498 |
| Lines of code | 62.3K |
| Checkout size | 9 MB |
Lines by language: TypeScript 46.3K, JSON 13.7K, SCSS 1,059, Markdown 915, SQL 191, YAML 115.
Questions
Is 5ire free?
Yes for personal use. The licence is Apache 2.0 with extra terms: you may not use the 5ire name in a modified version, and distributing a modified build to enterprises with more than 10 users, inside hardware or in sensitive government work needs a commercial licence. You pay the AI providers for usage.
What is an MCP client?
The Model Context Protocol is an open standard for connecting AI models to tools and data. As a client, 5ire can launch MCP servers, for example one for your file system or a database, and let the model call them during a chat.
Does 5ire work with local models?
Yes, through Ollama. The knowledge base embeddings also run locally with the bge-m3 model.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.