Raven AI Agent

by EverMind-AI• 6k•• Scanned•Claim this listing•Request removal
Developer Toolsaiai agentsanthropicchatgptclaude

The Harness of Harnesses • built for RSI: a trusted, persistent, self-evolving multi-agent ecosystem for all-domain collaboration.

Raven is an open-source ai agent by EverMind-AI, written mainly in Python, with 5,952 GitHub stars and the Apache-2.0 license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 70f29f1. Seen able to run shell commands, read environment and secrets, connect to the internet. Scan policy

Scanned
Full scan at 70f29f1 · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit155 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (125)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    agents/raven-oncall/plugins/oncall-flow/oncall_flow/transport.py:121
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    raven/agent/tools/background_exec.py:143
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/config/update_providers.py:1899
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    raven/ops/transport.py:65
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/providers/litellm_provider.py:294
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/providers/litellm_provider.py:311
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/providers/litellm_provider.py:341
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/providers/litellm_provider.py:352
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    raven/providers/litellm_provider.py:564
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    raven/stint/verify.py:313
  • medium
    sharp@0.35.4: 1 known vulnerability
    GHSA-wq5f-xc86-pv6w
    bridge/package-lock.json
  • medium
    source-map-js@1.2.1: 2 known vulnerabilities
    GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
    ui-tui/package-lock.json
  • medium
    vite@8.3.0: 6 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
    ui-tui/package-lock.json
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    ui-tui/package-lock.json
  • medium
    happy-dom@20.11.2: 3 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
    ui-web/package-lock.json
  • medium
    vite@8.2.1: 6 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
    ui-web/package-lock.json
  • medium
    zod@4.6.5: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    ui-web/package-lock.json
  • medium
    aiohttp@3.14.3: 8 known vulnerabilities
    GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-5wr8-gcqf-gqf3, GHSA-6cjc-53gc-5rqm, GHSA-9xw5-w5jj-pvcg +3 more
    uv.lock
  • medium
    cairosvg@2.9.0: 1 known vulnerability
    PYSEC-2026-4204
    uv.lock
  • medium
    filelock@3.29.0: 9 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
    uv.lock
  • medium
    fsspec@2026.3.0: 1 known vulnerability
    PYSEC-2026-4217
    uv.lock
  • medium
    gitpython@3.1.62: 7 known vulnerabilities
    GHSA-23mf-xhv8-69c2, GHSA-83vg-56qc-22m7, GHSA-f9j4-qggq-h239, GHSA-fx3j-rwgx-fr94, GHSA-gq48-pqfc-9p58 +2 more
    uv.lock
  • medium
    lxml-html-clean@0.4.4: 1 known vulnerability
    PYSEC-2026-2614
    uv.lock
  • medium
    msgpack@1.2.1: 1 known vulnerability
    GHSA-j586-36cw-2gc2
    uv.lock
  • medium
    nltk@3.10.3: 2 known vulnerabilities
    GHSA-8mgp-746c-j5xp, GHSA-j456-xh4h-cpf2
    uv.lock
  • medium
    pyasn1@0.6.4: 4 known vulnerabilities
    GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p, GHSA-mm57-4v3p-rchx
    uv.lock
  • medium
    urllib3@2.7.0: 3 known vulnerabilities
    PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177
    uv.lock
  • medium
    virtualenv@21.5.1: 19 known vulnerabilities
    PYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +14 more
    uv.lock
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    ui-tui/src/__tests__/externalLink.test.ts:57
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    ui-tui/src/__tests__/externalLink.test.ts:62
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2734
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2749
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2758
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2848
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2851
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:2858
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3253
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3253
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3262
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3264
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3265
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3282
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/features/extAgents/ExtAgentsPage.test.tsx:3295
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/rpc/fixtures/machines.ts:105
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    ui-web/src/rpc/fixtures/machines.ts:105
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/integration/test_imported_conversation_e2e.py:48
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/integration/test_web_bugreport_e2e.py:39
  • low
    Possible example credential in docs/tests: curl-auth-header
    2 matches in this file
    tests/test_acp_permissions.py:120
  • low
    Possible example credential in docs/tests: curl-auth-header
    2 matches in this file
    tests/test_acp_replay.py:303
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_agent_loop_run_emit.py:1799
  • low
    Possible example credential in docs/tests: curl-auth-header
    tests/test_acp_methods.py:1708
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_agents_oncall_flow_status_shows_failure_reason.py:83
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_agents_oncall_flow_submit_seed_gate.py:280
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_agents_research_flow_conversation.py:90
  • low
    Possible example credential in docs/tests: curl-auth-user
    tests/test_acp_updates.py:1897
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/test_cli_agent_commands.py:518
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_acp_redact.py:84
  • low
    Possible example credential in docs/tests: curl-auth-header
    tests/test_acp_redact.py:33
  • low
    Possible example credential in docs/tests: gitlab-pat
    2 matches in this file
    tests/test_acp_redact.py:36
  • low
    Possible example credential in docs/tests: gcp-api-key
    tests/test_acp_redact.py:37
  • low
    Possible example credential in docs/tests: jwt
    2 matches in this file
    tests/test_acp_redact.py:41
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/test_cli_trajectory_browse.py:2183
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_config_self_surface.py:593
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_cli_trajectory_regression_commands.py:160
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/test_cli_trajectory_commands.py:266
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_litellm_provider_model_names.py:58
  • low
    Possible example credential in docs/tests: generic-api-key
    8 matches in this file
    tests/test_security_untrusted_context.py:144
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_rpc_bugreport.py:26
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    tests/test_trajectory_redaction_history.py:18
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_trajectory_regressions.py:830
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    tests/test_trajectory_review.py:13
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_trajectory_bugreport.py:66
  • low
    Possible example credential in docs/tests: generic-api-key
    11 matches in this file
    tests/test_trajectory_redact.py:101
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/test_trajectory_report_session.py:20
  • low
    music-metadata@11.13.0: 5 known vulnerabilities
    GHSA-53v6-4h7p-p4gj, GHSA-5gfj-9q3v-qfp3, GHSA-8j4c-6x6g-rq3j, GHSA-f94x-6692-553q, GHSA-jjpr-9cvf-cq55
    bridge/package-lock.json
  • low
    fast-uri@3.1.8: 4 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
    package-lock.json
  • low
    @vitest/mocker@5.0.1: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    ui-tui/package-lock.json
  • low
    esbuild@0.27.7: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    ui-tui/package-lock.json
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    ui-tui/package-lock.json
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    ui-web/package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    ui-web/package-lock.json
  • low
    mako@1.3.12: 1 known vulnerability
    PYSEC-2026-4243
    uv.lock
  • low
    multidict@6.7.1: 1 known vulnerability
    PYSEC-2026-4244
    uv.lock
  • low
    opentelemetry-api@1.44.0: 1 known vulnerability
    GHSA-xcq7-p3pf-p88h
    uv.lock
  • low
    soupsieve@2.8.4: 2 known vulnerabilities
    PYSEC-2026-4170, PYSEC-2026-4171
    uv.lock
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Raven alternatives

View more →

Similar ai agents in Developer Tools, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Raven (this page)
EverMind-AI
6kApache-2.0Nov 1, 2026Scanned, no flagged issues
Deepseek Harness
deepseek-ai
268kMITOct 30, 2026Scanned, no flagged issues
Ponytail
DietrichGebert
182kMITOct 29, 2026Scanned, no flagged issues
Orca
stablyai
112kMITNov 1, 2026Scanned, no flagged issues
Deer Flow
bytedance
85kMITNov 1, 2026Scanned, no flagged issues
Ruflo
ruvnet
80kMITNov 1, 2026Scanned, no flagged issues