ginkida/rustyhand

Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал

20 stars 7 forks Качество 79 Тренд 18MIT

Agent OS in Rust — one binary, 37 agents, 26 LLM providers, 37 channels (Telegram/Discord/Slack...), MCP server, A2A protocol, 120+ API endpoints, web dashboard

Обзор

Open-source Agent OS built in Rust. 134K LOC. 10 crates. 1,728 tests. Zero clippy warnings. One binary. Autonomous Telegram agent. Agents that actually work for you. Quick Start • CLI Reference • API Docs A third adversarial-audit sweep over API auth, channels, the kernel scheduler/workflows, memory/knowledge, and request routing — each finding gated behind a 3-lens refute panel. Closes an unauthenticated-Owner auth bypass (spoofed X-Forwarded-For), redirect-based SSRF in the A2A and cron-webhook clients, an RHP pre-shared-key serialization leak, MCP allowlist/file-read hardening, a ~24× cost-quota over-count, cron validation/timezone correctness, workflow run-leak + persistence races, knowledge-graph multi-hop traversal, and Unicode-aware session search. See the release notes for details. Clone → cargo run --release -- start → open the dashboard → talk to an agent.

README

Показан фрагмент оригинального README. Открыть оригинал.

RustyHand The Agent Operating System

Open-source Agent OS built in Rust. 134K LOC. 10 crates. 1,728 tests. Zero clippy warnings. One binary. Autonomous Telegram agent. Agents that actually work for you.

Quick Start • CLI Reference • API Docs

v0.7.87 — Audit iteration 3: 27 verifier-confirmed fixes (June 2026) A third adversarial-audit sweep over API auth, channels, the kernel scheduler/workflows, memory/knowledge, and request routing — each finding gated behind a 3-lens refute panel. Closes an unauthenticated-Owner auth bypass (spoofed X-Forwarded-For), redirect-based SSRF in the A2A and cron-webhook clients, an RHP pre-shared-key serialization leak, MCP allowlist/file-read hardening, a ~24× cost-quota over-count, cron validation/timezone correctness, workflow run-leak + persistence races, knowledge-graph multi-hop traversal, and Unicode-aware session search. See the release notes for details.

Clone → cargo run --release -- start → open the dashboard → talk to an agent. No API key required. When no provider key is found in the environment, RustyHand falls back to a deterministic mock driver and seeds four sample resources so every major dashboard page is interactive on first visit:

rusty welcome agent (chat-ready)

demo-pipeline workflow (2-step sample, click to run)

sample agent-spawn trigger

demo-daily-ping cron job (registered, disabled by default)

A welcome modal on first visit lists all four with one-click navigation. The CLI startup banner and Docker entrypoint both announce demo mode as a feature instead of a missing-key warning. Set ANTHROPIC_API_KEY (or a Kimi / DeepSeek / Zhipu / MiniMax / OpenRouter / Ollama key) and restart for real LLM responses, or RUSTYHAND_DISABLE_DEMO_MODE=1 to force a hard fail.

Highlights since v0.7.41:

React dashboard — every subsystem is a page: agents, chat, workflows, automation (cron + triggers), channels, analytics, knowledge graph, skills,

Открыть полный README на GitHub

Установка

docker run -p 4200:4200 \

Новичок в MCP? Начните с руководства на mcpskill.org →

Конфигурация

{
  "mcpServers": {
    "rustyhand": {
      "command": "rustyhand",
      "args": ["mcp"]
    }
  }
}