Your one-person Wall Street. An AI trading agent covering equities, crypto, commodities, forex, and macro — from research through position entry, ongoing management, to exit.
Trading work doesn't have a collaboration substrate like software does. Code has git, issues, markdown, and reproducible folders; trading has chat history, scattered notes, and broker UIs. OpenAlice maps trading onto the tools coding agents already understand — workspaces, issues, wikilinks, and approval-gated execution — so a human and multiple AI agents can share one trading workflow without losing state or audit trails.
What This Does
OpenAlice is a local trading workspace for coding agents, not a replacement for Claude Code or similar tools. It gives agents a trading-shaped place to work: a packages/ monorepo (1,217 files) with a TypeScript core, a desktop app in apps/desktop/src/main.ts, a CLI in packages/cli/src/main.ts, and a connector protocol in packages/connector-protocol/src/index.ts. The README's core loop is read-only research first — ask a market question, track entities as [[wikilinks]], create a markdown issue, schedule it, and read results in an Inbox.
The trading layer is explicitly beta. The README warns: "Do not use OpenAlice for live trading with real funds unless you fully understand and accept the risks." The repo ships a guardian-runtime package and an ibkr reference implementation, suggesting broker connectivity exists but is immature.
How It Is Wired
Execution starts at apps/desktop/src/main.ts (Electron main process) which spawns a managed runtime via apps/desktop/src/managed-runtime.ts. That runtime bridges to the CLI (packages/cli/src/main.ts) and the connector protocol (packages/connector-protocol/src/index.ts). The guardian-runtime package is the safety gate — it stages account actions like git commits, requiring review before "push." The ibkr package holds a Python reference client (packages/ibkr/ref/source/pythonclient/setup.py), meaning broker calls leave the process through that connector. The blast radius is concentrated in guardian-runtime; anything that touches it affects all order flows, so changes there need the most care. The module graph shows a hub-and-spoke pattern around connector-protocol — a single point of failure for adding new brokers. The wiring for the desktop-to-CLI IPC path is mapped; the internal call graph for the broader agent loop is not fully documented in this repo.
How To Use It
Setup: Clone and install with npm — package.json and packages/*/package.json imply npm install. Docker is available via Dockerfile and docker-compose.yml for a containerized run. Configuration: Environment variables for broker credentials belong in the connector packages; no .env.example is visible, so you'll need to inspect packages/ibkr and packages/connector-protocol for expected keys. Running: Start the desktop app from apps/desktop/src/main.ts, or invoke the CLI from packages/cli/src/main.ts. The README's documented flow is: ask Alice, track entities, create an issue, schedule it, read the Inbox.
Real-World Use
A macro research desk runs a nightly scan: an agent creates an issue in a workspace, schedules it for 6 AM, and the CLI pulls news and fundamentals via the connector protocol, writes a report to the Inbox, and stages any proposed positions for human review in the guardian-runtime before anything touches a broker.
Code Health & Issues
Med - The ibkr Python client is a reference (ref/) — likely stale relative to the TypeScript core; verify before relying on it.
Med - 203 Protocol Buffers files suggest a complex IPC layer; that's a lot of surface area for version drift.
Low - CI exists (.github/workflows/ci.yml) and 613 test files are present, but no measured analysis has run for this repo yet — the wiring map above is structural, not dynamic.
The Bottom Line
OpenAlice is a serious attempt to give AI agents a trading-native workspace, with a sane architecture (TypeScript monorepo, guardian gate, connector protocol) and honest warnings about maturity. It's not for live funds yet, but for research, scheduling, and agent-driven workflows it's a solid foundation. Use it if you want to experiment with agent-operated trading; skip it if you need production-grade broker execution today.
What the analyser found
Deployment readiness
7/7
✓Container image
✓CI pipeline
✓Lockfile committed
✓Test suite
✓README
✓License
✓No committed secrets
Composition
2,781 files
TypeScript1729
TSX300
Python252
Protocol Buffers203
Markdown92
JSON53
ReactDocker
Architecture
Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.
Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.
high3
medium9
Untrack the file your own .gitignore says to ignorehigh
ui/.env.demo
tracked although .gitignore excludes it
The author already decided this file must never be committed, so its presence is an accident nobody noticed, which means the credentials in it are the ones actually in use.
Fix: git rm --cached the path and rotate; the ignore rule is already correct.
Pin third-party GitHub Actions to a commit SHAhigh5 occurrences
A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.
Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.
Remove the committed .env and rotate what it holdshigh
ui/.env.demo
ui/.env.demo
A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.
Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.
Declare least-privilege permissions for GITHUB_TOKENmedium
.github/workflows/desktop-package-smoke.yml
1 workflow(s) declare no permissions
With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.
Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.
Enable Dependabot or Renovatemedium
17 manifest(s), no update bot configured
Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.
Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.
Pin the container base image by digestmedium2 occurrences
Dockerfile
node:22-trixie, node:22-trixie-slim
An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.
Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.
Gate pull requests on a dependency vulnerability scanmedium
.github/workflows
no dependency scan in CI
This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.
Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.
Add a pre-commit secret gatemedium
a secret-shaped file is tracked and no repo-level gate is visible
Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.
Fix: Add a pre-commit hook scanning staged content, and enable push protection.
Remove generated build output from version controlmedium6 occurrences
apps
6 generated files committed
The reviewer reads src, production runs dist, and a stale bundle means the fix that was reviewed is not the code that executes.
Fix: Gitignore the output directory and build in CI.
Set persist-credentials: false on checkoutmedium
.github/workflows/ci.yml
checkout keeps the token, then dependencies are installed
The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.
Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.
Add a non-root USER to the imagemedium
Dockerfile
CMD or ENTRYPOINT with no USER directive
A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.
Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.
Review the install lifecycle script and disable scripts in CImedium
package.json
postinstall
Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.
Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.
Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.