{"id":"80afd522-01a6-4664-bf54-673d2cb86157","repo":"BitPodAI/FungIPle","status":"done","verdict":"no_red_flags","headline":"No red flags found. README claims backed by the code: 2 of 8.","error":null,"report":{"ai":{"kind":"framework","claims":[{"claim":"Build a decentralized Agent network based on the Eliza framework","verdict":"partial","evidence":"The Eliza framework is fully present (agent/, packages/core, clients, plugins), but no network/peer coordination code for a 'decentralized agent network' appears in the reviewed excerpts or tree beyond a characters/podai.character.json file that was not reviewed."},{"claim":"Allow everyone to build their own IP Agent","verdict":"partial","evidence":"Character JSON loading and the create-eliza-app package let users define agents (agent/src/index.ts:363-370; packages/create-eliza-app), but no IP-specific tooling was seen in the excerpts."},{"claim":"Full-featured Discord, Twitter and Telegram connectors","verdict":"supported","evidence":"packages/client-discord, client-twitter, client-telegram exist and are wired in agent/src/index.ts:8-14."},{"claim":"Support for every model (Llama, Grok, OpenAI, Anthropic, Gemini, etc.)","verdict":"partial","evidence":"getTokenForProvider handles ~30 providers (agent/src/index.ts:521-680), but 'every model' is an overstatement."},{"claim":"Multi-agent and room support","verdict":"partial","evidence":"Multiple characters can be loaded (agent/src/index.ts:448-489) and room actions exist in plugin-bootstrap; the runtime code was not reviewed."},{"claim":"Easily ingest and interact with your documents; retrievable memory and document store","verdict":"partial","evidence":"packages/core exports knowledge.ts, ragknowledge.ts, memory.ts and database adapters (packages/core/src/index.ts), but implementations were not in the excerpts."},{"claim":"Highly extensible - create your own actions and clients","verdict":"supported","evidence":"Plugin interface with actions/providers/evaluators/services/clients used by 100+ plugin packages; packages/_examples shows plugin templates."},{"claim":"Quick start: Python 2.7+ prerequisite and one-click Fleek deploy","verdict":"unverifiable","evidence":"Python 2.7 requirement is inherited from upstream README and appears dated; Fleek deployment is an external service."}],"costUsd":0.231074,"summary":"This repository is a fork of the ElizaOS (Eliza) multi-agent framework, with the README unchanged from upstream. It includes a core runtime, database adapters, social and messaging clients (Discord, Twitter, Telegram, etc.), and a very large collection of plugins (mostly blockchain wallet/transfer/swap actions). The agent entrypoint loads character JSON files, resolves model-provider API keys, picks a database adapter, and starts clients. The BitPod-specific \"decentralized IP Agent network\" is not visible in the reviewed excerpts beyond a podai character file.","capabilities":[{"evidence":"agent/src/index.ts:200-520","capability":"Loads character JSON files from local paths, remote URLs, or on-chain (IQ6900) and merges 'extends' characters; injects CHARACTER.<NAME>.* env vars as secrets"},{"evidence":"agent/src/index.ts:491-519 (handlePluginImporting uses import(plugin))","capability":"Dynamically imports plugins named in a character file at runtime"},{"evidence":"agent/src/index.ts:521-680","capability":"Resolves model-provider API keys for ~30 providers from character secrets or env settings"},{"evidence":"agent/src/index.ts:682-784","capability":"Selects a database backend (MongoDB, Supabase, Postgres, PGLite, Qdrant, SQLite) based on env vars"},{"evidence":"agent/src/index.ts:7-22; agent/package.json:28-39","capability":"Wires many social/messaging clients (Discord, Telegram, Twitter, Slack, Instagram, Farcaster, Lens, Alexa, Deva, XMTP, SimsAI) into the agent"},{"evidence":"packages/plugin-evm/src/index.ts:13-20; packages/plugin-solana/src/index.ts:20-34; packages/plugin-bnb/src/index.ts:16-32; .env.example:369-400","capability":"Large set of blockchain plugins exposing actions for transfers, swaps, bridging, staking, token deployment using private keys from env"},{"evidence":"packages/plugin-arbitrage/src/index.ts:9-15; packages/plugin-hyperliquid/src/index.ts; packages/plugin-binance/src/index.ts","capability":"Trading/arbitrage plugins with services and market providers"},{"evidence":"packages/plugin-bootstrap/src/index.ts:19-33","capability":"Bootstrap plugin providing default actions, fact/goal evaluators and providers"},{"evidence":"scripts/bug_hunt/main.py:129-230","capability":"Python/TUI bug-hunting script that runs Biome analysis over plugin packages and generates markdown reports"},{"evidence":"packages/client-auto/src/index.ts:3-18","capability":"Placeholder AutoClient that only logs hourly"},{"evidence":"client/package.json; root package.json 'start:client'","capability":"React/Vite web client for chatting with the agent"}],"findingReviews":[]},"url":"https://github.com/BitPodAI/FungIPle","depth":"standard","stats":{"files":3589,"binaries":37,"textFiles":3551,"truncated":false},"verdict":"no_red_flags","findings":[{"id":"bait.file_host","title":"Links to a file-sharing or link-shortening site","detail":"Downloads routed through file hosts or shortened links can't be checked and are a common way to deliver malware.","evidence":[{"line":20,"path":"docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-27.md","excerpt":"…k to a Google Drive folder where relevant files are stored: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing…"},{"line":10,"path":"docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-29.md","excerpt":"- [whobody]: You can download the data from this Google Drive link: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing"},{"line":25,"path":"packages/plugin-obsidian/src/example/NAVALS-VAULT.md","excerpt":"https://drive.google.com/drive/folders/1EZiUhASpNQBYka3Z8NNkBzYnrb7TCfmG"}],"severity":"info"},{"id":"install.npm_hook","title":"Runs code automatically on install (preinstall)","detail":"npm runs this as soon as someone installs the package: \"npx only-allow pnpm\".","evidence":[{"path":"package.json"}],"severity":"info"},{"id":"install.npm_hook","title":"Runs code automatically on install (postinstall)","detail":"npm runs this as soon as someone installs the package: \"node scripts/postinstall.js\".","evidence":[{"path":"packages/plugin-node/package.json"}],"severity":"info"},{"id":"install.pipe_to_shell","title":"Install command pipes a download straight into a shell","detail":"Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.","evidence":[{"line":14,"path":"docs/docs/guides/docker-setup.md","excerpt":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash"},{"line":27,"path":"docs/docs/guides/docker-setup.md","excerpt":"curl -fsSL https://get.pnpm.io/install.sh | sh -"},{"line":50,"path":"docs/docs/guides/wsl.md","excerpt":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash"},{"line":59,"path":"docs/docs/guides/wsl.md","excerpt":"curl -fsSL https://get.pnpm.io/install.sh | sh -"},{"line":81,"path":"packages/plugin-sgx/README.md","excerpt":"apt install -y curl"},{"line":100,"path":"scripts/start.sh","excerpt":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash"},{"line":109,"path":"scripts/start.sh","excerpt":"echo \"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash\""}],"severity":"info"},{"id":"deps.off_registry","title":"Some dependencies come from git or a custom address","detail":"Common in monorepos and forks, but these packages skip the registry's checks. Worth a look if the project handles keys.","evidence":[{"line":22,"path":"packages/client-discord/package.json","excerpt":"@discordjs/opus → github:discordjs/opus"},{"line":1095,"path":"pnpm-lock.yaml","excerpt":"679ff3f58e6804b80becc166c7214deb2ca026e2 → https://codeload.github.com/discordjs/opus/tar.gz/679ff3f58e6804b80becc166c7214deb2ca026e2"}],"severity":"info"},{"id":"keys.handles_private_keys","title":"Handles wallet private keys or seed phrases","detail":"Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.","evidence":[{"line":1058,"path":"agent/src/index.ts","excerpt":"getSecret(character, \"SOLANA_PRIVATE_KEY\")"},{"line":6,"path":"packages/plugin-abstract/src/hooks/useGetAccount.ts","excerpt":"const PRIVATE_KEY = runtime.getSetting(\"ABSTRACT_PRIVATE_KEY\");"},{"line":85,"path":"packages/plugin-akash/src/actions/createCertificate.ts","excerpt":"async function initializeWallet(mnemonic: string): Promise<DirectSecp256k1HdWallet> {"},{"line":202,"path":"packages/plugin-akash/src/actions/createDeployment.ts","excerpt":"async function initializeWallet(mnemonic: string) {"},{"line":77,"path":"packages/plugin-akash/src/actions/getDeploymentApi.ts","excerpt":"// Validate configuration and get mnemonic"},{"line":234,"path":"packages/plugin-akash/src/actions/getDeploymentStatus.ts","excerpt":"// Initialize wallet from mnemonic"}],"severity":"info"}],"headline":"No red flags found. README claims backed by the code: 2 of 8.","provenance":[{"id":"prov.fork","title":"Fork of elizaOS/eliza","detail":"Check what was changed compared with the original, and whether it's credited.","evidence":[{"path":"elizaOS/eliza"}],"severity":"info"},{"id":"prov.stale","title":"No changes in 20 months","detail":"Unmaintained agents break as APIs and models change.","evidence":[{"path":"BitPodAI/FungIPle"}],"severity":"info"}],"generatedAt":"2026-10-15T10:43:39.896Z"}}