openfang - Moses Yebei

The Problem

Enterprises that need autonomous software agents today must stitch together multiple LLM wrappers, schedule cron jobs, and maintain separate services for persistence, networking, and tooling. The result is fragile integration work, duplicated binaries, and unpredictable security posture.

What This Does

OpenFang delivers a single‑binary Agent Operating System written in Rust. The repository is a portfolio of four self‑contained projects:

openfang‑cli – the command‑line driver (crates/openfang-cli/src/main.rs).
openfang‑api – an HTTP front‑end exposing agent actions (crates/openfang-api/src/*).
openfang‑channels – adapters for external services such as Bluesky (crates/openfang-channels/src/bluesky.rs).
openfang‑runtime / kernel – the core scheduler, state store and model inference layer (crates/openfang‑runtime/src/*, crates/openfang‑kernel/src/kernel.rs).

Agents (“Hands”) are defined by TOML manifests under agents/ and are compiled into the binary, so no runtime package manager is required.

How It Is Wired

Execution begins at the CLI entry point:

crates/openfang-cli/src/main.rs:745 → main (calls run).
run (crates/openfang-cli/src/launcher.rs:183) boots the runtime (boot_kernel) and, depending on sub‑command, starts the API server or a channel bridge.

From main the call graph follows the most‑used functions:

validate → Err (56 times) and is_empty (49 times) – guard clauses that gate every user‑initiated action.
api_send_message (used by the API bridge) → status (46 times) → network POST to /api/shutdown (e.g., main -> cmd_stop).
daemon_client (50 calls) creates an HTTP client for outbound calls such as token validation in crates/openfang‑channels/src/bluesky.rs.
record (via run -> shutdown) writes to the SQLite store (conn.execute).
boot_kernel → MemorySubstrate::open accesses the embedded file‑based KV store.

Key effect owners:

Effect	File	Functions that cause it	Reach
DB read/write	`crates/openfang‑api/src/routes.rs` (172 functions) – e.g., `spawn_agent`, `list_agents`	55 callers, 38 callees	Broad
Network outbound	`crates/openfang‑channels/src/bluesky.rs` (`validate_token`, `api_send_message`)	31 callers	Medium
File I/O	`crates/openfang‑kernel/src/kernel.rs` (`open`, `save_agent`)	22 callers	Limited
Model inference	`crates/openfang‑runtime/src/a2a.rs::new` (calls inference)	47 callers	Medium

The import graph shows only two edges and no circular dependencies, so the modules are loosely coupled. The most‑connected module is sdk/javascript/index (imported by two other modules), but it does not participate in the core runtime.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/openfang
cd openfang

# Build the single binary (requires Rust toolchain)
cargo build --release          # produces target/release/openfang

# Run the CLI (see built‑in help)
./target/release/openfang --help

# Example: start the API server
./target/release/openfang api serve

# Example: launch a specific hand (agent)
./target/release/openfang start --hand lead

A Docker image can be built with the provided Dockerfile:

docker build -t openfang:0.1.0 .
docker run --rm -p 4200:4200 openfang:0.1.0 api serve

Configuration files such as agents/<name>/agent.toml and the optional .env.example supply required keys (e.g., LLM API tokens, database URL). No additional package managers are required.

Real‑World Use

A SaaS provider wants daily prospect generation. They place the lead hand under agents/lead/agent.toml, configure the OpenAI key in .env, and run openfang start --hand lead. The binary schedules the hand, writes qualified leads to the embedded SQLite store, and pushes a CSV to a configured webhook—all without external orchestration tools.

Code Health & Issues

Critical – wasmtime@41 vulnerable to CVE‑2026‑34971 (pinned). Fix: upgrade version and update Cargo.lock.
High – Pin GitHub Actions to commit SHA (.github/workflows/*.yml). Fix: replace @vN with full SHA.
High – Upgrade vulnerable crates: tokio@1 (CVE‑2021‑45710), rmp-serde@1, aes-gcm@0.10. Fix: bump to patched releases.
High – Wildcard CORS (packages/whatsapp-gateway/index.js). Fix: enumerate allowed origins.
Medium – Declare least‑privilege GITHUB_TOKEN permissions (.github/workflows/ci.yml).
Medium – Enable Dependabot/Renovate for 17 manifests.
Medium – Pin Docker base images by digest (Dockerfile).
Medium – Set persist-credentials: false on checkout (.github/workflows/release.yml).
Medium – Add non‑root USER to container (Dockerfile).
Low – Add timeout-minutes to CI jobs (.github/workflows/ci.yml).

All findings are derived from the static analysis report; no additional issues were detected.

The Bottom Line

OpenFang offers a cohesive, single‑binary platform for autonomous agents, with a well‑structured Rust codebase and complete test suite. Security‑related dependency pinning and CI hardening need immediate attention before production use. It is best suited for teams that want a Rust‑native agent runtime without managing a microservice mesh.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

482 files

Rust236
Markdown90
TOML79
JavaScript24
JSON8
Python7

ReactExpressDocker

Module dependencies

The 10 most depended-upon modules of 29, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_sdk_javascript_index["index"] n1_dk_javascript_examples_basic["basic"] n2_avascript_examples_streaming["streaming"] n3_s_openfang_api_static_js_api["api"] n4_s_openfang_api_static_js_app["app"] n5_g_api_static_js_pages_agents["agents"] n6_pi_static_js_pages_approvals["approvals"] n7_api_static_js_pages_channels["channels"] n8_ang_api_static_js_pages_chat["chat"] n9_ng_api_static_js_pages_hands["hands"] n1_dk_javascript_examples_basic --> n0_sdk_javascript_index n2_avascript_examples_streaming --> n0_sdk_javascript_index

Dependencies

57 declared dependencies, none a major version behind. Resolved 0 of 57 against the registry.

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high3

medium5

low2

Upgrade the pinned dependency carrying a critical advisorycritical31 occurrences

wasmtime@41 CVE-2026-34971 (critical) +30 more

The manifest pins the exact version the advisory covers, so this is not a warning about drift: the vulnerable code is what installs, and a critical rating means it is reachable over the network without credentials or user interaction.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Pin third-party GitHub Actions to a commit SHAhigh8 occurrences

.github/workflows

dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, tauri-apps/tauri-action@v0, softprops/action-gh-release@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh12 occurrences

tokio@1 CVE-2021-45710 (high) +7 more; rmp-serde@1 GHSA-255r-3prx-mf99 (medium) +1 more; aes-gcm@0.10 CVE-2023-42811 (medium) +1 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Replace the wildcard CORS origin with an explicit allow listhigh

packages/whatsapp-gateway/index.js

Access-Control-Allow-Origin': '*'

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

17 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

Dockerfile

rust:1-slim-bookworm, debian:bookworm-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Set persist-credentials: false on checkoutmedium

.github/workflows/release.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.