anoncf/aikol

Checked 3 h agoAI reviewCommit 7c57b37

Is it safe?

No red flags

None of our safety checks fired.

Is it real?

Partly delivers

1 of 7 README claims fully backed by the code.

What it actually does

Agent

This is a fork of the ai16z/Eliza agent framework, customized as 'aiKOL' with an added news client (CryptoPanic), a news plugin, an analysis plugin (token/wallet scanning via TopWallets), and a Twitter client change. The agent runtime loads a character (aikollea.character.json), connects to Twitter/Telegram/Discord/etc., and has many optional wallet plugins (Solana swaps, EVM, Coinbase trading) that can move funds when private keys are configured. The aiKOL-specific modules exist in the tree but their source was not included in the excerpts, so the 'alpha' claims could only be checked at the wiring level.

Loads character JSON files, builds an AgentRuntime with DB (Postgres/SQLite) and cache, and starts configured clientsagent/src/index.ts:114-210, 313-340, 584-637
Registers the custom news and analysis plugins unconditionally for every agentagent/src/index.ts:491-494; packages/plugin-news/src/index.ts:6-12; packages/plugin-analysis/src/index.ts:8-15
Starts a news client when 'news' is listed in the character's clientsagent/src/index.ts:402-405; packages/client-news/src/index.ts:4-23
Twitter, Telegram, Discord, Farcaster, Lens and Slack clients that let the agent post and reply autonomouslyagent/src/index.ts:354-405; packages/client-twitter/src/index.ts:8-55
Conditionally enables on-chain action plugins that can sign and send transactions (Solana swap/pumpfun/transfer, EVM, Coinbase trade, etc.) based on which private keys are setagent/src/index.ts:495-561; packages/plugin-solana/src/index.ts:21-34
REST API (DirectClient) with message, image, whisper and fine-tune endpoints, with open CORS and no authentication visiblepackages/client-direct/src/index.ts:60-297
Per-message LLM response generation, then action and evaluator processingpackages/client-direct/src/index.ts:190-233
GitHub client that clones a repo, ingests files as knowledge, and can push commits and PRspackages/client-github/src/index.ts:52-180

README claims vs the code

Collective of autonomous agent KOLs that provide memecoin alpha	Partly	Only one character file (characters/aikollea.character.json) exists. No multi-agent 'collective' or DAO logic is in the visible code; it is the standard Eliza runtime.
Analyzes real-time crypto news via CryptoPanic with Playwright content extraction and memory storage	Partly	packages/client-news and packages/plugin-news exist and are wired in (agent/src/index.ts:402, 492), and CRYPTOPANIC_API_KEY is in .env.example. Their implementation files were not in the excerpts, so Playwright/CAPTCHA handling was not reviewed.
Token and wallet analysis via the TopWallets API (metrics, scoring, risk assessment)	Partly	packages/plugin-analysis registers scanToken and scanWallet actions (src/index.ts:12) and TOPWALLETS_API_* are in .env.example; the action code was not shown.
Built on Eliza and trained with expert memecoin guides	Partly	The Eliza framework is clearly the base (packages/core, @ai16z/eliza). 'Trained' presumably means knowledge in the character file, which was not reviewed; no model training code exists.
Engages on X (Twitter) and Telegram	Backed by code	packages/client-twitter/src/index.ts and packages/client-telegram/src/index.ts, started from agent/src/index.ts:364-378.
Enhanced Twitter client generating news-based tweets from memory	Partly	The client-twitter package exists with post.ts, but the news-specific modifications were not visible in the excerpts.
Provides top-tier memecoin alpha without scams, dumps, or manipulation	Can't verify	Output quality and the agent's conflicts of interest cannot be shown by code. The agent also has Solana swap/pumpfun/DAO-swap actions (plugin-solana/src/index.ts:24-31), so its trading behavior is not constrained by the code.
Copytrading: follow top-performing wallets with ease	Not in the code	No copytrade action is visible. Only scanWallet/scanToken in plugin-analysis, plus a generic take_order action in plugin-solana. The README itself lists trading delegation as future work.

Code findings

Links to a file-sharing or link-shortening site

Downloads routed through file hosts or shortened links can't be checked and are a common way to deliver malware.

docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-27.md:18
…k to a Google Drive folder where relevant files are stored: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing…
docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-29.md:8
- [whobody]: You can download the data from this Google Drive link: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing

Runs code automatically on install (preinstall)

npm runs this as soon as someone installs the package: "npx only-allow pnpm".

package.json

Runs code automatically on install (postinstall)

npm runs this as soon as someone installs the package: "node scripts/postinstall.js".

Install command pipes a download straight into a shell

Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.

docs/docs/guides/docker-setup.md:13
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash
docs/docs/guides/docker-setup.md:25
curl -fsSL https://get.pnpm.io/install.sh | sh -
docs/docs/guides/wsl.md:46
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
docs/docs/guides/wsl.md:54
curl -fsSL https://get.pnpm.io/install.sh | sh -

Some dependencies come from git or a custom address

Common in monorepos and forks, but these packages skip the registry's checks. Worth a look if the project handles keys.

packages/client-discord/package.json:10
@discordjs/opus → github:discordjs/opus
pnpm-lock.yaml:542
31da49d8d2cc6c5a2ab1bfd332033ff7d5f9fb02 → https://codeload.github.com/discordjs/opus/tar.gz/31da49d8d2cc6c5a2ab1bfd332033ff7d5f9fb02

Handles wallet private keys or seed phrases

Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.

agent/src/index.ts:520
getSecret(character, "SOLANA_PRIVATE_KEY") &&
packages/plugin-conflux/src/actions/bridgeTransfer.ts:29
secretKey: `0x${string}`,
packages/plugin-conflux/src/actions/transfer.ts:21
secretKey: `0x${string}`,
packages/plugin-multiversx/src/providers/wallet.ts:58
const secretKey = UserSecretKey.fromString(privateKey);
packages/plugin-near/src/actions/swap.ts:82
const secretKey = runtime.getSetting("NEAR_WALLET_SECRET_KEY");
packages/plugin-near/src/actions/transfer.ts:68
const secretKey = runtime.getSetting("NEAR_WALLET_SECRET_KEY");

Who made it and how it got popular

No changes in 22 months

Unmaintained agents break as APIs and models change.

anoncf/aikol

Scanned 1,603 files (1,580 text, 22 binary) at commit 7c57b37. "No red flags" means none of our checks fired, not that the code is guaranteed safe.

Launch a coin for this repo

Any open-source project that passes Vetted can get a pump.fun coin, and anyone can launch it. 90% of the coin's creator fees are locked to the developer's GitHub account, claimable only by them on pump.fun. 10% goes to Vetted. The split is set once at launch and can't be changed.

Not eligible yet.

The origin check hasn't run on this report. Check the repo again.
The owner's GitHub account couldn't be read. Check the repo again.

Developers can turn launches off for their repos by adding no-launch to .github/vetted.txt.

Builder's response

The maintainers haven't responded.

Share on X Are you the builder? Respond Raw JSON

Check again

If the repo has new commits, or your level allows a deeper review than this one, a new check runs. Otherwise you'll see this report. Levels