Sparrow AI Agent
by katanamlStructured data extraction, instruction calling and agentic workflows with ML, LLM and Vision LLM
Sparrow is an open-source ai agent by katanaml, written mainly in Python, with 5,232 GitHub stars and the GPL-3.0 license. Its code was last updated Oct 29, 2026.
Scan summary: scanned Nov 5, 2026 at commit b6eca73. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
b6eca73 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Secrets scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Dependency audit835 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (58)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.torch@2.8.0: 8 known vulnerabilitiesPYSEC-2025-203, PYSEC-2025-204, PYSEC-2025-206, PYSEC-2026-139, PYSEC-2026-2286 +3 more
sparrow-data/ocr/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fsspec@2025.9.0: 1 known vulnerabilityPYSEC-2026-4217
sparrow-data/ocr/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.idna@2.9.0: 2 known vulnerabilitiesPYSEC-2024-60, PYSEC-2026-215
sparrow-data/ocr/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@0.48.0: 6 known vulnerabilitiesPYSEC-2026-161, PYSEC-2026-1942, PYSEC-2026-2280, PYSEC-2026-2281, PYSEC-2026-248 +1 more
sparrow-data/ocr/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pypdf@6.16.2: 52 known vulnerabilitiesPYSEC-2026-4153, PYSEC-2026-4154, PYSEC-2026-4155, PYSEC-2026-4156, PYSEC-2026-4157 +47 more
sparrow-data/parse/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.torch@2.9.1: 4 known vulnerabilitiesPYSEC-2026-139, PYSEC-2026-2286, GHSA-qfhq-4f3w-5fph, GHSA-rrmf-rvhw-rf47
sparrow-data/parse/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.transformers@5.9.0: 1 known vulnerabilityPYSEC-2026-3929
sparrow-data/parse/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpcore2@2.9.1: 1 known vulnerabilityPYSEC-2026-3844
sparrow-data/parse/sparrow_parse/vlmb/infra/qwen2_vl_7b/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpx2@2.9.1: 5 known vulnerabilitiesPYSEC-2026-3845, PYSEC-2026-3846, PYSEC-2026-3847, PYSEC-2026-3848, PYSEC-2026-3849
sparrow-data/parse/sparrow_parse/vlmb/infra/qwen2_vl_7b/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.orjson@3.9.9: 6 known vulnerabilitiesPYSEC-2024-40, PYSEC-2026-107, PYSEC-2024-40, PYSEC-2026-107, PYSEC-2024-40 +1 more
sparrow-data/parse/sparrow_parse/vlmb/infra/qwen2_vl_7b/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.9: 16 known vulnerabilitiesPYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +11 more
sparrow-data/parse/sparrow_parse/vlmb/infra/qwen2_vl_7b/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.aiohttp@3.14.1: 11 known vulnerabilitiesPYSEC-2026-3545, PYSEC-2026-3546, PYSEC-2026-3547, GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3 +6 more
sparrow-ml/agents/requirements_sparrow_agents.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pypdf@6.13.2: 37 known vulnerabilitiesPYSEC-2026-3610, PYSEC-2026-3611, PYSEC-2026-3612, PYSEC-2026-3613, PYSEC-2026-3655 +32 more
sparrow-ml/agents/requirements_sparrow_agents.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@0.37.2: 7 known vulnerabilitiesPYSEC-2026-161, PYSEC-2026-1941, PYSEC-2026-1943, PYSEC-2026-2280, PYSEC-2026-2281 +2 more
sparrow-ml/llm/requirements_instructor.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tqdm@4.9.0: 2 known vulnerabilitiesPYSEC-2017-74, PYSEC-2026-1976
sparrow-ml/llm/requirements_instructor.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.2: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.15: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.6: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.2: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.2: 11 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.hono@4.12.23: 17 known vulnerabilitiesGHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-88fw-hqm2-52qc, GHSA-8j4g-w8fx-2239 +12 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.2.0: 8 known vulnerabilitiesGHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.1: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.12: 2 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pdfjs-dist@5.7.284: 1 known vulnerabilityGHSA-hq66-cqwq-w95j
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.4.31: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.15: 2 known vulnerabilitiesGHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.sharp@0.34.5: 3 known vulnerabilitiesGHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@8.5.0: 23 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
sparrow-ui/shell-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.gradio@6.14.0: 3 known vulnerabilitiesPYSEC-2026-211, PYSEC-2026-2178, PYSEC-2026-2179
sparrow-ui/shell/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pypdf@6.11.0: 45 known vulnerabilitiesPYSEC-2026-3004, PYSEC-2026-3009, PYSEC-2026-3010, PYSEC-2026-3016, PYSEC-2026-3018 +40 more
sparrow-ui/shell/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.datasets@4.2.0: 1 known vulnerabilityPYSEC-2026-3716
sparrow-data/ocr/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.h2@3.2.0: 2 known vulnerabilitiesPYSEC-2026-1435, PYSEC-2026-3628
sparrow-data/ocr/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.hpack@3.0.0: 1 known vulnerabilityPYSEC-2026-4053
sparrow-data/ocr/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.idna@3.9.0: 5 known vulnerabilitiesPYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215
sparrow-data/parse/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.requests@2.31.0: 6 known vulnerabilitiesPYSEC-2026-1872, PYSEC-2026-1873, PYSEC-2026-2275, PYSEC-2026-1872, PYSEC-2026-1873 +1 more
sparrow-data/parse/sparrow_parse/vlmb/infra/qwen2_vl_7b/requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.apprise@1.9.9: 1 known vulnerabilityPYSEC-2026-4200
sparrow-ml/agents/requirements_sparrow_agents.txt - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@1.19.14: 2 known vulnerabilitiesGHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.10.32: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.5: 1 known vulnerabilityGHSA-g3hv-75wg-m249
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.1: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.2: 3 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
sparrow-ui/shell-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Sparrow alternatives
View more →Similar ai agents in Web Scraping & Data, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Sparrow (this page) katanaml | 5.2k | GPL-3.0 | Oct 29, 2026 | Scanned, no flagged issues |
| Firecrawl firecrawl | 198k | AGPL-3.0 | Oct 31, 2026 | Scanned, no flagged issues |
| Crawl4ai unclecode | 87k | Apache-2.0 | Nov 1, 2026 | Scanned, no flagged issues |
| Vane ItzCrazyKns | 38k | MIT | Sep 1, 2026 | Scanned, no flagged issues |
| Maxun getmaxun | 18k | AGPL-3.0 | Oct 28, 2026 | Scanned, no flagged issues |
| Xiaobei TeamWiseFlow | 8.7k | None found | Oct 30, 2026 | Not scanned yet |