What it actually does
This is the elizaOS monorepo (package name "eliza"), a large TypeScript/Bun codebase for an AI agent runtime and the Eliza app. The excerpt shows an agent host with an HTTP API, plugin loading, shell/terminal actions, wallet and signing routes, TEE attestation, backup/restore, and sandboxing. It also shows an Electrobun desktop shell with native bridges, plus Android and iOS projects. The repo is a mirror of the upstream elizaOS project, with a marketing-style description that differs from the actual README.
- Boots a standalone agent runtime and HTTP server via the CLI (serve/start/runtime/benchmark/ios-bridge/android-bridge commands)packages/agent/src/cli/index.ts:40-120
- Local HTTP API layered over the agent runtime, with route kernel, auth, CORS, WebSocket upgrade authorization and lazy-loaded optional pluginspackages/agent/src/api/server.ts:1-380, 590-650
- Compat route pipeline in the app wrapper that handles auth, cloud proxy/billing, secrets, sensitive requests, local inference and agent reset (deletes the PGlite data dir)packages/app/src/api/server.ts:484-560, 566-790
- Scans local credential sources for model providers (Codex/Claude/Copilot/Gemini files, Ollama, env vars) and validates keys against provider endpoints; keys are masked before being returned over IPCpackages/app/platforms/electrobun/src/native/credentials.ts:137-300, 607-720, 725-804
- Reads and decrypts Chromium-browser cookies on macOS (Chrome/Arc/Brave/Edge/Chromium) using the Safe Storage key from the Keychain, to detect an Eliza Cloud 'privy-session' cookiepackages/app/platforms/electrobun/src/native/credentials.ts:292-346, 429-518, 522-546
- Pluggable architecture where plugins register actions, providers, services, routes and viewspackages/agent/src/index.ts (plugin-collector, plugin-lifecycle, plugin-resolver exports); README.md:106-109
- Agent actions for terminal/shell execution, plugin management, runtime control, database access, triggers/scheduled tasks and settingspackages/agent/src/index.ts:3-39; services/shell-execution-router.ts exported at index.ts:727-735
- Wallet and remote-signing functions with a policy evaluator and TEE-gated signingpackages/agent/src/index.ts:189-192, 680-689, 736-742
- TEE / confidential-compute support: dstack attestation, GPU evidence, key release, sealed volumes, boot gatepackages/agent/src/index.ts:743-756; file tree services/tee-*.ts
- Container/VM sandbox engines (Docker, Apple Container) and a sandbox managerpackages/agent/src/index.ts:690-714
- Agent backup/restore and export/importpackages/agent/src/index.ts:475-476; services/agent-backup*.ts
- Remote capability router and endpoint providers (cloud sandbox, home machine, TEE) that expose plugins over the networkpackages/agent/src/index.ts:622-678
README claims vs the code
| elizaOS is an open-source TypeScript framework and product stack for autonomous AI agents, with the core runtime, app, CLI, cloud services, native bridges and plugins in one monorepo | Backed by code | Workspace layout in package.json:111-137 and the file tree (packages/agent, packages/app, packages/cloud, plugins/*). The packages/core directory is not in the excerpt. |
| The framework is model-agnostic and extended through plugins that register actions, providers, evaluators, services, model handlers, routes and views | Backed by code | Plugin-system exports at packages/agent/src/index.ts (plugin-collector/lifecycle/types); provider credential map in credentials.ts:552-605 |
| Local inference (Eliza-1 on-device models with 2B/4B/9B/27B tiers) can run without a network connection after assets are downloaded | Can't verify | The plugin-local-inference sources are not in the provided excerpt; only the lazy import wiring appears (packages/app/src/api/server.ts:165-175). |
| Eliza Cloud is optional; local runtime and direct provider configuration remain first-class | Backed by code | Provider scan covers local files, env vars and Ollama (credentials.ts:137-300, 607-635); cloud routes are separate compat handlers (app server.ts:584-623). |
| Non-custodial EVM/Solana wallet operations run with approval boundaries | Partly | A signing-policy evaluator, pending approvals and a hardened wallet-export rejection exist (agent index.ts:680-742; app server.ts:64-66). Full approval-flow behavior is not visible in the excerpt. |
| Linux and Android distribution tooling lives in packages/os | Can't verify | packages/os does not appear in the provided file tree excerpt. |
| Benchmarks run via the Python orchestrator in packages/benchmarks | Can't verify | packages/benchmarks is not in the excerpt; only a TypeScript benchmark CLI is shown (agent/src/cli/index.ts:113-120). |
| Repo description: 'Super Intelligence agentic operating system' | Not in the code | The README only says 'Your agentic operating system' and describes a TypeScript agent framework. Nothing in the code implements 'super intelligence'. |
Code findings
The code references where browsers and wallets keep passwords, cookies or keys. Stealers go straight for these files; a legitimate project that touches them should explain why in its README.
- packages/app/platforms/electrobun/src/native/credentials.ts:308
cookiePath: "Google/Chrome/Default/Cookies", - packages/app/platforms/electrobun/src/native/credentials.ts:314
cookiePath: "Arc/User Data/Default/Cookies", - packages/app/platforms/electrobun/src/native/credentials.ts:320
cookiePath: "BraveSoftware/Brave-Browser/Default/Cookies",AI review: uncertain. Lines 308-320 are only a static table of Chromium browser cookie paths and Keychain service names. The code that uses them (readChromiumCookies, lines 429-518) does read the user's browser Cookies SQLite DB and the Safe Storage Keychain key, then decrypts cookies. That is a credential-harvesting technique, though here it is narrowly scoped to the host eliza.app / cloud.eliza.app and the 'privy-session' cookie. The code comments state its purpose is the user's own Eliza Cloud session import. The decrypted values are not returned over IPC; only a boolean-derived provider entry is. It is a sensitive capability but a documented, narrow, local one. This is not wallet-file reading, and I see no network exfiltration in the shown code. The same file also reads ~/.codex, ~/.claude, Copilot and gcloud credential files and sends detected keys to the respective provider validation endpoints, which deserves user awareness.
npm runs this as soon as someone installs the package: "bun packages/scripts/patch-punycode-deprecation.ts && bun packages/scripts/patch-llama-cpp-capacitor.ts && bun packages/scripts/patch-electrobun-linux-cef-profi".
Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.
- packages/app/src/cli/doctor/checks.ts:88
fix: "curl -fsSL https://bun.sh/install | bash",
Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.
- packages/agent/src/api/bug-report-routes.ts:155
/\b(mnemonic|private[_ -]?key|seed phrase)\b\s*[:=]\s*.+/gi, - packages/agent/src/api/config-routes.ts:500
delete envPatch.SOLANA_PRIVATE_KEY; - packages/agent/src/api/first-run-routes.ts:359
"SOLANA_PRIVATE_KEY", - packages/agent/src/api/server-helpers-config.ts:448
typeof process.env.SOLANA_PRIVATE_KEY !== "string" || - packages/agent/src/api/server.ts:3299
"SOLANA_PRIVATE_KEY", - packages/agent/src/api/wallet-capability.ts:224
process.env.SOLANA_PRIVATE_KEY?.trim(),
Who made it and how it got popular
Check what was changed compared with the original, and whether it's credited.
- elizaOS/eliza
Scanned 20,000 files (2,697 text, 433 binary), size limits reached so some files were skipped at commit c867c14. "No red flags" means none of our checks fired, not that the code is guaranteed safe.
Launch a coin for this repo
Any open-source project that passes Vetted can get a pump.fun coin, and anyone can launch it. 90% of the coin's creator fees are locked to the developer's GitHub account, claimable only by them on pump.fun. 10% goes to Vetted. The split is set once at launch and can't be changed.
- The safety check must show no red flags.
- The origin check hasn't run on this report. Check the repo again.
- The owner's GitHub account couldn't be read. Check the repo again.
Developers can turn launches off for their repos by adding no-launch to .github/vetted.txt.
Builder's response
The maintainers haven't responded.
Check again
If the repo has new commits, or your level allows a deeper review than this one, a new check runs. Otherwise you'll see this report. Levels