Easily switch between alternative low-cost AI models in Claude Code/Agent SDK. For those comfortable using Claude agents and commands, it lets you take what you've created and deploy fully hosted agents for real business purposes. Use Claude Code to get the agent working, then deploy it in your favorite cloud.
Building agents in Claude Code is fast, but moving them to production means re-implementing against a different runtime and paying for expensive hosted models. agentic-flow aims to bridge that gap: develop the agent locally with Claude Code, then deploy the same logic as a hosted agent with cheaper model backends. The repo is a portfolio of related experiments around that goal, not a single product.
What This Does
The repository is a collection of 12 self-contained projects. The core agentic-flow/ package provides agent orchestration: task routing, self-learning hooks (.claude/ contains 350 files of agent definitions), a vector/graph database (packages/agentdb/), and a reasoning backend (reasoningbank/). It also includes a medical AI example (src/types/medical.types.ts), a CRISPR pipeline in Rust (examples/crispr-cas13-pipeline/), and a federated agent demo (examples/federated-agentdb/).
The README claims 66 agents, 213 MCP tools, and SONA (a self-optimizing neural architecture). The code supports these claims: agentic-flow/src/index.ts is the main entry point, and packages/agentdb/ contains substantial vector/graph database code with ONNX and WASM acceleration.
How It Is Wired
Execution starts at main in agentic-flow/src/index.ts:157, which reaches 390 functions. The internal call graph shows main calls assert and validate 23 times each, then runTest 16 times. The most-called functions are delete (60 callers), initialize (39), and resolve (24) — these are the high-blast-radius functions to change carefully.
The database path is short: main -> getStats reaches SQLite via this.db.prepare. The execute -> loadIntelligence path touches the filesystem via fs.readFileSync. The handler entry point in examples/federated-agentdb/serverless-lambda.ts spawns a process that initializes a GraphDatabase and calls a transformers pipeline for inference.
Key files and their responsibilities:
agentic-flow/src/utils/logger.ts — logging hub, 70 modules depend on it
agentic-flow/src/agentdb/optimizations/BatchOperations.ts — batch DB writes
agentic-flow/src/router/providers/anthropic.ts — the only file making outbound network calls for inference
packages/agentdb/src/backends/graph/GraphDatabaseAdapter.ts — graph DB storage
The module graph shows 8 modules in circular dependencies, including benchmark files in packages/agentdb/benchmarks/.
How To Use It
From the README:
npx agentic-flow init
npx agentic-flow hooks pretrain
claude
The package is on npm (agentic-flow), so npm install agentic-flow works. The TypeScript API is new AgenticFlow() then await flow.initialize() and flow.route('task'). Dockerfiles exist for various test scenarios. Configuration is via environment variables in .env.test and agentic-flow/config/.env.fastmcp.
Real-World Use
A team builds a medical diagnosis agent in Claude Code with the medical types from src/types/medical.types.ts. They test locally, then deploy the same logic to a serverless function (examples/federated-agentdb/serverless-lambda.ts) with a cheaper model backend via the router in agentic-flow/src/router/providers/anthropic.ts. The agent stores episodes in the graph database for future learning.
High — No LICENSE file at root despite README claiming MIT
Medium — No Dependabot, unpinned base images, large binaries (25.8MB .node file) in git
The Bottom Line
This is a large, ambitious portfolio with substantial working code — the agentdb, router, and orchestration pieces are real. But it's a collection of experiments, not a polished product: 4,455 files, duplicated code, secret-shaped files committed, and CI that can report green on failure. Use it as a reference for agent architecture patterns, not as a dependency.
38 declared dependencies, none a major version behind. Resolved 0 of 38 against the registry.
Findings
LowSecret-shaped paths present; the code-health audit confirms or clears them docker/cloud-run/setup-secrets.sh, packages/agentic-jujutsu/docs/project/github-secrets.md, packages/agentic-llm/cloudrun/setup-secrets.sh
Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.
high6
medium8
low2
Pin third-party GitHub Actions to a commit SHAhigh9 occurrences
A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.
Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.
Upgrade the pinned dependency carrying a published advisoryhigh4 occurrences
The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.
Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.
Add a LICENSE; redistribution rights are undefinedhigh
no licence file at the repository root
With no licence the default is all rights reserved, so this code cannot legally be reused, which matters most for the owner's own work carried into client engagements.
Fix: Add MIT or Apache-2.0 at the repository root.
Remove the committed .env and rotate what it holdshigh3 occurrences
A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.
Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.
Stop discarding the exit code of steps whose failure mattershigh
.github/workflows/docker-publish.yml
lines 169 discard failure
The job reports green while the artifact it was supposed to produce was never produced, so a crash becomes a successful run built on stale data.
Fix: Let the step fail, or test the specific expected condition instead of discarding all exit codes.
Remove continue-on-error from steps that gate correctnesshigh
.github/workflows/build-agentic-jujutsu.yml
line 160 on a correctness step
A failing test suite reports a green check, which is precisely the path this audit exists to close.
Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.
Declare least-privilege permissions for GITHUB_TOKENmedium3 occurrences
.github/workflows/agentdb-docker-test.yml
3 workflow(s) declare no permissions, 2 of them reference secrets
With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.
Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.
Enable Dependabot or Renovatemedium
35 manifest(s), no update bot configured
Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.
Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.
Pin the container base image by digestmedium
agentic-flow/Dockerfile.alpha-test
node:22-slim
An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.
Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.
Add a pre-commit secret gatemedium
a secret-shaped file is tracked and no repo-level gate is visible
Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.
Fix: Add a pre-commit hook scanning staged content, and enable push protection.
Move large binaries to Git LFS or out of the repositorymedium4 occurrences
4 blobs over 5MB: agentic-jujutsu.linux-x64-gnu.node 25.8MB, agentic-jujutsu-2.0.3.tgz 9.8MB, agentic-jujutsu-2.0.2.tgz 9.8MB
One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.
Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.
Set persist-credentials: false on checkoutmedium
.github/workflows/agentdb-docker-test.yml
checkout keeps the token, then dependencies are installed
The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.
Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.
4 further finding(s) are listed in the full report.
Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.