What it actually does
This repository is a fork of the ElizaOS (Eliza) multi-agent framework, with the README unchanged from upstream. It includes a core runtime, database adapters, social and messaging clients (Discord, Twitter, Telegram, etc.), and a very large collection of plugins (mostly blockchain wallet/transfer/swap actions). The agent entrypoint loads character JSON files, resolves model-provider API keys, picks a database adapter, and starts clients. The BitPod-specific "decentralized IP Agent network" is not visible in the reviewed excerpts beyond a podai character file.
- Loads character JSON files from local paths, remote URLs, or on-chain (IQ6900) and merges 'extends' characters; injects CHARACTER.<NAME>.* env vars as secretsagent/src/index.ts:200-520
- Dynamically imports plugins named in a character file at runtimeagent/src/index.ts:491-519 (handlePluginImporting uses import(plugin))
- Resolves model-provider API keys for ~30 providers from character secrets or env settingsagent/src/index.ts:521-680
- Selects a database backend (MongoDB, Supabase, Postgres, PGLite, Qdrant, SQLite) based on env varsagent/src/index.ts:682-784
- Wires many social/messaging clients (Discord, Telegram, Twitter, Slack, Instagram, Farcaster, Lens, Alexa, Deva, XMTP, SimsAI) into the agentagent/src/index.ts:7-22; agent/package.json:28-39
- Large set of blockchain plugins exposing actions for transfers, swaps, bridging, staking, token deployment using private keys from envpackages/plugin-evm/src/index.ts:13-20; packages/plugin-solana/src/index.ts:20-34; packages/plugin-bnb/src/index.ts:16-32; .env.example:369-400
- Trading/arbitrage plugins with services and market providerspackages/plugin-arbitrage/src/index.ts:9-15; packages/plugin-hyperliquid/src/index.ts; packages/plugin-binance/src/index.ts
- Bootstrap plugin providing default actions, fact/goal evaluators and providerspackages/plugin-bootstrap/src/index.ts:19-33
- Python/TUI bug-hunting script that runs Biome analysis over plugin packages and generates markdown reportsscripts/bug_hunt/main.py:129-230
- Placeholder AutoClient that only logs hourlypackages/client-auto/src/index.ts:3-18
- React/Vite web client for chatting with the agentclient/package.json; root package.json 'start:client'
README claims vs the code
| Build a decentralized Agent network based on the Eliza framework | Partly | The Eliza framework is fully present (agent/, packages/core, clients, plugins), but no network/peer coordination code for a 'decentralized agent network' appears in the reviewed excerpts or tree beyond a characters/podai.character.json file that was not reviewed. |
| Allow everyone to build their own IP Agent | Partly | Character JSON loading and the create-eliza-app package let users define agents (agent/src/index.ts:363-370; packages/create-eliza-app), but no IP-specific tooling was seen in the excerpts. |
| Full-featured Discord, Twitter and Telegram connectors | Backed by code | packages/client-discord, client-twitter, client-telegram exist and are wired in agent/src/index.ts:8-14. |
| Support for every model (Llama, Grok, OpenAI, Anthropic, Gemini, etc.) | Partly | getTokenForProvider handles ~30 providers (agent/src/index.ts:521-680), but 'every model' is an overstatement. |
| Multi-agent and room support | Partly | Multiple characters can be loaded (agent/src/index.ts:448-489) and room actions exist in plugin-bootstrap; the runtime code was not reviewed. |
| Easily ingest and interact with your documents; retrievable memory and document store | Partly | packages/core exports knowledge.ts, ragknowledge.ts, memory.ts and database adapters (packages/core/src/index.ts), but implementations were not in the excerpts. |
| Highly extensible - create your own actions and clients | Backed by code | Plugin interface with actions/providers/evaluators/services/clients used by 100+ plugin packages; packages/_examples shows plugin templates. |
| Quick start: Python 2.7+ prerequisite and one-click Fleek deploy | Can't verify | Python 2.7 requirement is inherited from upstream README and appears dated; Fleek deployment is an external service. |
Code findings
Downloads routed through file hosts or shortened links can't be checked and are a common way to deliver malware.
- docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-27.md:20
…k to a Google Drive folder where relevant files are stored: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing… - docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-29.md:10
- [whobody]: You can download the data from this Google Drive link: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing - packages/plugin-obsidian/src/example/NAVALS-VAULT.md:25
https://drive.google.com/drive/folders/1EZiUhASpNQBYka3Z8NNkBzYnrb7TCfmG
npm runs this as soon as someone installs the package: "npx only-allow pnpm".
npm runs this as soon as someone installs the package: "node scripts/postinstall.js".
Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.
- docs/docs/guides/docker-setup.md:14
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash - docs/docs/guides/docker-setup.md:27
curl -fsSL https://get.pnpm.io/install.sh | sh - - docs/docs/guides/wsl.md:50
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash - docs/docs/guides/wsl.md:59
curl -fsSL https://get.pnpm.io/install.sh | sh - - packages/plugin-sgx/README.md:81
apt install -y curl - scripts/start.sh:100
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash - scripts/start.sh:109
echo "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash"
Common in monorepos and forks, but these packages skip the registry's checks. Worth a look if the project handles keys.
- packages/client-discord/package.json:22
@discordjs/opus → github:discordjs/opus - pnpm-lock.yaml:1095
679ff3f58e6804b80becc166c7214deb2ca026e2 → https://codeload.github.com/discordjs/opus/tar.gz/679ff3f58e6804b80becc166c7214deb2ca026e2
Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.
- agent/src/index.ts:1058
getSecret(character, "SOLANA_PRIVATE_KEY") - packages/plugin-abstract/src/hooks/useGetAccount.ts:6
const PRIVATE_KEY = runtime.getSetting("ABSTRACT_PRIVATE_KEY"); - packages/plugin-akash/src/actions/createCertificate.ts:85
async function initializeWallet(mnemonic: string): Promise<DirectSecp256k1HdWallet> { - packages/plugin-akash/src/actions/createDeployment.ts:202
async function initializeWallet(mnemonic: string) { - packages/plugin-akash/src/actions/getDeploymentApi.ts:77
// Validate configuration and get mnemonic - packages/plugin-akash/src/actions/getDeploymentStatus.ts:234
// Initialize wallet from mnemonic
Who made it and how it got popular
Check what was changed compared with the original, and whether it's credited.
- elizaOS/eliza
Unmaintained agents break as APIs and models change.
- BitPodAI/FungIPle
Scanned 3,589 files (3,551 text, 37 binary) at commit e9f004b. "No red flags" means none of our checks fired, not that the code is guaranteed safe.
Launch a coin for this repo
Any open-source project that passes Vetted can get a pump.fun coin, and anyone can launch it. 90% of the coin's creator fees are locked to the developer's GitHub account, claimable only by them on pump.fun. 10% goes to Vetted. The split is set once at launch and can't be changed.
- The origin check hasn't run on this report. Check the repo again.
- The owner's GitHub account couldn't be read. Check the repo again.
Developers can turn launches off for their repos by adding no-launch to .github/vetted.txt.
Builder's response
The maintainers haven't responded.
Check again
If the repo has new commits, or your level allows a deeper review than this one, a new check runs. Otherwise you'll see this report. Levels