Locally Uncensored AI Agent

by PurpleDoubleD• 3.1k•• Scanned•Claim this listing•Request removal
Design & Mediaagentai chatai studioall in onecoding agent

The all-in-one local AI studio for your desktop: chat, image and video generation and a coding agent in one free, open source app. Windows and Linux. No Docker, no terminal, no cloud required.

Locally Uncensored is an open-source ai agent by PurpleDoubleD, written mainly in TypeScript, with 3,123 GitHub stars and the AGPL-3.0 license. Its code was last updated Oct 31, 2026.

Scan summary: scanned Nov 5, 2026 at commit ed60ec4. Seen able to run shell commands, read environment and secrets, connect to the internet. Scan policy

Scanned
Full scan at ed60ec4 · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit268 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (123)

  • high
    obfuscation issue
    Details are available to the maintainer after claiming this listing.
  • high
    obfuscation issue
    Details are available to the maintainer after claiming this listing.
  • high
    obfuscation issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:160
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:411
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:440
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:455
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:473
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/comfy.ts:479
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    dev-server/downloads.ts:61
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/exec-routes.ts:42
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/ollama.ts:11
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/ollama.ts:15
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/python.ts:14
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/system-routes.ts:43
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:68
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:71
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:101
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:113
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:115
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:150
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:159
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/web-search.ts:161
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    dev-server/whisper.ts:75
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    src/dev/ssrf-fetch.ts:252
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    src/dev/ssrf-policy.ts:9
  • medium
    zod@4.3.6: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    package-lock.json
  • medium
    openssl@0.10.76: 8 known vulnerabilities
    GHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-phqj-4mhp-q6mq, GHSA-pqf5-4pqq-29f5 +3 more
    src-tauri/Cargo.lock
  • medium
    tauri@2.10.3: 1 known vulnerability
    GHSA-7gmj-67g7-phm9
    src-tauri/Cargo.lock
  • medium
    fsspec@2026.2.0: 1 known vulnerability
    PYSEC-2026-4217
    src-tauri/resources/abliterate/requirements.txt
  • medium
    sqlitedict@2.1.0: 1 known vulnerability
    PYSEC-2026-1939
    src-tauri/resources/abliterate/requirements.txt
  • medium
    torch@2.9.1: 4 known vulnerabilities
    PYSEC-2026-139, PYSEC-2026-2286, GHSA-qfhq-4f3w-5fph, GHSA-rrmf-rvhw-rf47
    src-tauri/resources/abliterate/requirements.txt
  • medium
    transformers@5.9.0: 1 known vulnerability
    PYSEC-2026-3929
    src-tauri/resources/abliterate/requirements.txt
  • medium
    accelerate@1.14.0: 1 known vulnerability
    PYSEC-2026-3804
    src-tauri/resources/mlx/requirements.txt
  • medium
    requests@2.9.2: 5 known vulnerabilities
    PYSEC-2018-28, PYSEC-2023-74, PYSEC-2026-1872, PYSEC-2026-1873, PYSEC-2026-2275
    src-tauri/resources/mlx/requirements.txt
  • medium
    setuptools@9.1.0: 4 known vulnerabilities
    PYSEC-2022-43012, PYSEC-2025-49, PYSEC-2026-1918, PYSEC-2026-3447
    src-tauri/resources/mlx/requirements.txt
  • medium
    filelock@4.0.12: 26 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-6627-m3xw-93mp, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9c4x-gm8v-wgc4 +21 more
    src-tauri/resources/voice_loop/requirements-dev.txt
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/api/__tests__/hermes-tool-calling.test.ts:245
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/api/__tests__/mobile-client-shell.ts:119
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/api/mcp/__tests__/web-fetch-kein-rueckfall-in-der-app.test.ts:80
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/dev/__tests__/dev-server-shape.test.ts:156
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/dev-server-shape.test.ts:276
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/fs-request-path.test.ts:81
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/fs-request-path.test.ts:82
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/fs-request-path.test.ts:98
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/model-paths.test.ts:10
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/dev/__tests__/model-paths.test.ts:78
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/dev/__tests__/ssrf-fetch.test.ts:114
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/dev/__tests__/ssrf-policy.test.ts:212
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/dev/__tests__/ssrf-policy.test.ts:223
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/hooks/__tests__/approval-shows-the-payload.test.ts:39
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/hooks/__tests__/approval-shows-the-payload.test.ts:41
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    src/hooks/__tests__/ask-mode-asks-for-git-and-tests.test.ts:45
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/hooks/__tests__/chat-tools-allowlist-at-execution.test.ts:36
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/__tests__/dev-fs-jail-root.test.ts:236
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/__tests__/dev-fs-jail-root.test.ts:277
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/__tests__/dev-fs-jail-root.test.ts:320
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/__tests__/dev-fs-jail.test.ts:80
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/__tests__/dev-fs-jail.test.ts:89
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    src/lib/voice/__tests__/work-scope.test.ts:82
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/mobile/platform/__tests__/first-paint.dom.test.ts:29
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/mobile/platform/__tests__/webview-check.dom.test.ts:27
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/remote/__tests__/pairingLink.test.ts:156
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    src/mobile/remote/__tests__/remoteAgent.test.ts:61
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/remote/__tests__/sealedChannel.test.ts:197
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/remote/__tests__/sealedChannel.test.ts:200
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/screens/settings/__tests__/providers.test.ts:39
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/screens/settings/__tests__/providers.test.ts:39
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    src/mobile/screens/settings/__tests__/providers.test.ts:41
  • low
    Possible example credential in docs/tests: curl-auth-header
    docs/blog/lm-studio-alternative-for-mac.html:126
  • low
    Possible example credential in docs/tests: curl-auth-header
    docs/blog/uncensored-ai-chat-online-guide.html:136
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/scripts/ping-indexnow.sh:8
  • low
    Possible example credential in docs/tests: generic-api-key
    src/api/__tests__/a-lora-link-asks-the-host.test.ts:33
  • low
    Possible example credential in docs/tests: generic-api-key
    src/api/cloud/__tests__/keychain-storage.test.ts:163
  • low
    Possible example credential in docs/tests: generic-api-key
    src/api/__tests__/voice-brain.test.ts:26
  • low
    Possible example credential in docs/tests: generic-api-key
    src/components/settings/__tests__/civitai-key-field-renders.test.ts:180
  • low
    Possible example credential in docs/tests: generic-api-key
    src/stores/__tests__/remote-signin-and-announce.test.ts:25
  • low
    glib@0.18.5: 2 known vulnerabilities
    RUSTSEC-2024-0429, RUSTSEC-2024-0429
    mobile-tests/fixture/ios-testbett/src-tauri/Cargo.lock
  • low
    proc-macro-error@1.0.4: 2 known vulnerabilities
    RUSTSEC-2024-0370, RUSTSEC-2024-0370
    mobile-tests/fixture/ios-testbett/src-tauri/Cargo.lock
  • low
    tokio@1.53.2: 1 known vulnerability
    RUSTSEC-2026-0386
    mobile-tests/fixture/ios-testbett/src-tauri/Cargo.lock
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    package-lock.json
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    package-lock.json
  • low
    katex@0.17.0: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    package-lock.json
  • low
    minimatch@10.2.4: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    fxhash@0.2.1: 1 known vulnerability
    RUSTSEC-2025-0057
    src-tauri/Cargo.lock
  • low
    jsonwebtoken@9.3.1: 1 known vulnerability
    GHSA-h395-gr6q-cpjc
    src-tauri/Cargo.lock
  • low
    pin-utils@0.1.0: 1 known vulnerability
    RUSTSEC-2026-0441
    src-tauri/Cargo.lock
  • low
    proc-macro-error2@2.0.1: 1 known vulnerability
    RUSTSEC-2026-0173
    src-tauri/Cargo.lock
  • low
    rand@0.7.3: 1 known vulnerability
    RUSTSEC-2026-0097
    src-tauri/Cargo.lock
  • low
    serde_with@3.18.0: 1 known vulnerability
    GHSA-7gcf-g7xr-8hxj
    src-tauri/Cargo.lock
  • low
    tar@0.4.45: 1 known vulnerability
    GHSA-3pv8-6f4r-ffg2
    src-tauri/Cargo.lock
  • low
    unic-char-property@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0081
    src-tauri/Cargo.lock
  • low
    unic-char-range@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0075
    src-tauri/Cargo.lock
  • low
    unic-common@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0080
    src-tauri/Cargo.lock
  • low
    unic-ucd-ident@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0100
    src-tauri/Cargo.lock
  • low
    unic-ucd-version@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0098
    src-tauri/Cargo.lock
  • low
    unsafe-libyaml@0.2.11: 1 known vulnerability
    RUSTSEC-2024-0449
    src-tauri/Cargo.lock
  • low
    zbus_names@4.3.4: 1 known vulnerability
    RUSTSEC-2026-0371
    src-tauri/Cargo.lock
  • low
    zvariant@5.15.0: 1 known vulnerability
    RUSTSEC-2026-0370
    src-tauri/Cargo.lock
  • low
    zvariant_derive@5.15.0: 1 known vulnerability
    RUSTSEC-2026-0372
    src-tauri/Cargo.lock
  • low
    datasets@4.8.5: 1 known vulnerability
    PYSEC-2026-3716
    src-tauri/resources/abliterate/requirements.txt
  • low
    idna@3.9.0: 2 known vulnerabilities
    PYSEC-2026-215, PYSEC-2026-215
    src-tauri/resources/abliterate/requirements.txt
  • low
    torch@2.12.1: 1 known vulnerability
    GHSA-rrmf-rvhw-rf47
    src-tauri/resources/mlx/requirements.txt
  • low
    opentelemetry-api@1.45.0: 2 known vulnerabilities
    GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h
    src-tauri/resources/voice_loop/requirements-dev.txt
  • low
    setuptools@84.0.0: 2 known vulnerabilities
    GHSA-xmj3-9gf7-h52w, GHSA-xmj3-9gf7-h52w
    src-tauri/resources/voice_loop/requirements-dev.txt
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Locally Uncensored alternatives

View more →

Similar ai agents in Design & Media, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Locally Uncensored (this page)
PurpleDoubleD
3.1kAGPL-3.0Oct 31, 2026Scanned, no flagged issues
Taste Skill
Leonxlnx
107kMITOct 31, 2026Scanned, no flagged issues
Archify
tt-a1i
92kApache-2.0Oct 31, 2026Scanned, no flagged issues
Hyperframes
heygen-com
77kApache-2.0Nov 1, 2026Scanned, no flagged issues
OpenMontage
calesthio
74kAGPL-3.0Oct 28, 2026Scanned, no flagged issues
CopilotKit
CopilotKit
38kMITOct 31, 2026Scanned, no flagged issues