AGT

AGT is a local, defensive autonomous security employee built on Vercel Eve. It inventories an explicitly authorized local repository, creates bounded security-review work, runs independent scout, validator, and remediation phases, and records every decision in persistent SQLite memory and a SHA-256 chained audit ledger.

AGT is intentionally not a public-target bug-bounty scanner. It only reads a local repository or public GitHub repository whose operator confirms authorization through the CLI flag or interactive approval. Agent workers cannot use host shell, arbitrary file, network, or web tools. Proposed patches require an explicit separate agt apply ... --yes action and are applied in an isolated Git worktree.

Requirements

• Node.js 24
• Bun
• Ollama running at http://127.0.0.1:11434
• Git for GitHub URL audits and optional patch worktrees

Install dependencies and create the tested 16K-context tool model:

npm install
ollama pull qwen3:0.6b
ollama create agt-qwen3:0.6b -f ollama/Modelfile
ollama create agt-qwen3-worker:1.7b -f ollama/Worker.Modelfile

Start the interactive agent:

bun dev

Paste a local repository path or public GitHub URL into the chat. Approve the audit when prompted. The TUI hides model reasoning by default so the interaction stays focused on prompts, approvals, and results.

CLI

Run the CLI directly from this checkout:

bun run agt -- audit /absolute/path/to/repository --authorized
bun run agt -- audit https://github.com/owner/repository --authorized

To make agt available as a command on your machine:

bun link
agt --help

bun link registers this checkout, so later source changes are available without reinstalling.

The custom model is required because Ollama's OpenAI-compatible endpoint cannot change context size per request. A 4K context is too small for Eve's instructions, safety policies, and security-tool schemas.

Run an audit

Ollama must already be running. AGT starts and stops a headless Eve development server automatically when port 2000 is free:

npm run agt -- audit /absolute/path/to/repository \
  --authorized \
  --company Ryva \
  --workers 16

Public GitHub repositories are cloned into ~/.agt/repositories and then audited through the same bounded local reader:

npm run agt -- audit https://github.com/owner/repository \
  --authorized \
  --workers 16

The default is a bounded 16-worker swarm; use --workers 1 on machines where Ollama is configured for one parallel generation. Ollama may serialize model inference unless its server is configured for parallel requests.

AGT inventories common web, backend, systems, mobile, shell, infrastructure, template, and configuration formats. Deterministic rules seed likely secrets, injection, command execution, traversal, weak crypto, auth bypasses, unsafe deserialization, TLS bypasses, XSS, CORS, cookies, SSRF, permissions, and debug configuration. Additional review slices send every inventoried file through the agent swarm even when no rule matched. This is broad defensive coverage, not a guarantee that every vulnerability will be found.

For a fast model-free inventory and rule scan:

npm run agt -- audit /absolute/path/to/repository \
  --authorized \
  --deterministic-only

Useful commands:

npm run agt -- campaigns
npm run agt -- status <campaign-id>
npm run agt -- report <campaign-id>
npm run agt -- apply <finding-id> --yes

apply validates the stored unified diff, creates a branch and external worktree under ~/.agt/worktrees, and applies the patch there. It deliberately does not execute repository code, commit, push, or open a PR.

Test

Run the complete static test gate:

npm run check

Run the deterministic end-to-end fixture:

AGT_DATA_DIR=/tmp/agt-deterministic-test \
  npm run agt -- audit tests/fixtures/vulnerable-app \
  --authorized \
  --company Fixture \
  --deterministic-only

Run the live Eve + Ollama scout/validation/remediation loop:

npm run agt -- audit tests/fixtures/vulnerable-app \
  --authorized \
  --company Fixture \
  --workers 1

The fixture contains direct eval of untrusted template input and SHA-1 session token hashing. A successful live run prints a report path, reports a verified ledger chain, and exits zero. Any exhausted work item marks the campaign failed and exits non-zero.

Do not change AGT_DATA_DIR while an Eve server for this app is already running: the CLI and Eve tools must share the same database. Stop that server first or use the default ~/.agt store.

Storage and controls

• Database: ~/.agt/security.sqlite
• Reports: ~/.agt/reports/<campaign-id>.md
• GitHub clones: ~/.agt/repositories/
• Patch worktrees: ~/.agt/worktrees/<finding-id>
• Eve development/runtime state: .eve/
• Repository reads are realpath-confined, symlink-safe, size-capped, and restricted to supported source and configuration files.
• Work is deduplicated, leased atomically, retry-bounded, and independently validated by a different Eve session.
• Finding evidence stores hashes and bounded metadata rather than secret source text.

Configuration:

Variable	Default
OLLAMA_BASE_URL	http://127.0.0.1:11434/v1
OLLAMA_MODEL	agt-qwen3:0.6b
AGT_WORKER_MODEL	agt-qwen3-worker:1.7b
OLLAMA_CONTEXT_WINDOW	16384
AGT_DATA_DIR	~/.agt
AGT_EVE_URL	http://127.0.0.1:2000
AGT_WORKER_TIMEOUT_MS	600000

Eve's just-bash sandbox is configured for isolated agent scratch work. Security campaign tools themselves execute in Eve's trusted application runtime, so they enforce their own repository authorization and least-privilege boundaries.