Useagent AI Agent
by useagenthqThe open-source Devin alternative. Run Claude Code, Codex or OpenCode in isolated cloud workspaces you can self-host.
Useagent is an open-source ai agent by useagenthq, written mainly in TypeScript, with 385 GitHub stars and the AGPL-3.0 license. Its code was last updated Oct 27, 2026.
Scan summary: scanned Nov 5, 2026 at commit d05ef79. Seen able to run dynamic code, connect to the internet. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
d05ef79 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit426 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (75)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.18: 12 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr +7 more
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.1.4: 12 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr +7 more
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.9: 15 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr +10 more
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.electron@44.2.0: 7 known vulnerabilitiesGHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-997q-gvvc-jwmx, GHSA-fw47-9c62-h3vw, GHSA-h3v5-h239-pg29 +2 more
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@6.28.1: 5 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.29.1: 8 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.5.4: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
apps/desktop/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@grpc/grpc-js@1.14.4: 4 known vulnerabilitiesGHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j, GHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.30.0: 18 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +13 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@xmldom/xmldom@0.8.14: 16 known vulnerabilitiesGHSA-27p8-2357-5qqv, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-8344-3jmq-59r6, GHSA-93r5-fhx6-vmg9 +11 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.adm-zip@0.5.18: 16 known vulnerabilitiesGHSA-7q85-xj36-vmfc, GHSA-8238-w5pm-2374, GHSA-c6fg-446q-cg94, GHSA-j5f4-cc29-5x44, GHSA-p634-w6r4-rjp2 +11 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@1.19.0: 12 known vulnerabilitiesGHSA-3pq3-5fj3-cg6v, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8, GHSA-9fr6-4gfg-395g +7 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.3.0: 3 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.5: 20 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-hrr3-gc8f-f4qj +15 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.follow-redirects@1.16.0: 6 known vulnerabilitiesGHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p +1 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.image-size@1.2.1: 4 known vulnerabilitiesGHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.sharp@0.34.5: 6 known vulnerabilitiesGHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w, GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c +1 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 4 known vulnerabilitiesGHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.29.0: 54 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +49 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@8.10.0: 57 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +52 more
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 2 known vulnerabilitiesGHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 4 known vulnerabilitiesGHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
backend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.devalue@5.9.1: 8 known vulnerabilitiesGHSA-4q55-j62x-fr9h, GHSA-9rgm-9g3h-6x36, GHSA-hx4r-w6wj-j8fg, GHSA-j22f-vq7h-c4qm, GHSA-mcm9-63f2-9j32 +3 more
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.image-size@2.0.2: 2 known vulnerabilitiesGHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.15.1: 1 known vulnerabilityGHSA-2883-xcg3-v3hh
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.3.1: 1 known vulnerabilityGHSA-2883-xcg3-v3hh
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@6.1.0: 1 known vulnerabilityGHSA-9wv6-86v2-598j
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.sharp@0.35.3: 4 known vulnerabilitiesGHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.svgo@4.0.2: 2 known vulnerabilitiesGHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@8.2.2: 6 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.1.11: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
docs-site/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.happy-dom@21.0.1: 1 known vulnerabilityGHSA-834v-8h66-3h79
frontend/bun.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.6: 7 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-58mr-gqgx-xq4g, GHSA-hrr3-gc8f-f4qj, GHSA-qw65-cvwx-89v3, GHSA-w74x-v6f9-j3xg +2 more
packages/cli/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
backend/src/provider-gateway/routes.test.ts:73 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
backend/src/runs/desktop-proxy.test.ts:297 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
backend/src/security/gateway-boundary.test.ts:31 - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
packages/sandbox-daytona/src/plugin.test.ts:59 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/src/runs/operator-routes.test.ts:5 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt
backend/src/secrets/redact.test.ts:34 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: curl-auth-header2 matches in this file
backend/src/secrets/redact.test.ts:51 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/src/secrets/redact.test.ts:60 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/test/code-index-extractor.test.ts:100 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/src/security/gateway-boundary.test.ts:12 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
backend/src/provider-gateway/routes.test.ts:112 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/test/secrets.test.ts:265 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
backend/test/runs.test.ts:103 - lowLow. Minor, or common in normal tools. Shown for information.@better-auth/drizzle-adapter@1.6.25: 3 known vulnerabilitiesGHSA-44jh-23m7-hpcf, GHSA-44jh-23m7-hpcf, GHSA-44jh-23m7-hpcf
apps/desktop/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.@better-auth/kysely-adapter@1.6.25: 3 known vulnerabilitiesGHSA-44jh-23m7-hpcf, GHSA-44jh-23m7-hpcf, GHSA-44jh-23m7-hpcf
apps/desktop/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.fast-uri@3.1.7: 5 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
apps/desktop/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.6: 5 known vulnerabilitiesGHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
apps/desktop/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.minimatch@9.0.9: 1 known vulnerabilityGHSA-g3hv-75wg-m249
apps/desktop/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@2.0.12: 1 known vulnerabilityGHSA-rmxm-3fg6-px4f
backend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.glob@13.0.6: 4 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4
backend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.hono@4.13.1: 5 known vulnerabilitiesGHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv
backend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.ip-address@10.3.1: 5 known vulnerabilitiesGHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
backend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.3: 9 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw +4 more
backend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@2.1.1: 2 known vulnerabilitiesGHSA-rmxm-3fg6-px4f, GHSA-rmxm-3fg6-px4f
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.hono@4.13.3: 5 known vulnerabilitiesGHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.ip-address@10.5.0: 10 known vulnerabilitiesGHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +5 more
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.katex@0.16.47: 2 known vulnerabilitiesGHSA-238p-pmpm-9mq7, GHSA-238p-pmpm-9mq7
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.10: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.smol-toml@1.8.0: 1 known vulnerabilityGHSA-r4xh-jqrq-34v2
docs-site/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
frontend/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.hono@4.13.4: 5 known vulnerabilitiesGHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv
packages/cli/bun.lock - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Useagent alternatives
View more →Similar ai agents in Cloud Infrastructure, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Useagent (this page) useagenthq | 385 | AGPL-3.0 | Oct 27, 2026 | Scanned, no flagged issues |
| OmniRoute cheaper-inference | 83k | MIT | Nov 1, 2026 | Scanned, see report |
| Generative AI GoogleCloudPlatform | 18k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Dsh Routing Suite yjh051108 | 7k | MIT | Sep 18, 2026 | Scanned, no flagged issues |
| Intentkit crestalnetwork | 6.5k | MIT | Sep 16, 2026 | Scanned, no flagged issues |
| Open Agents vercel-labs | 5.9k | MIT | Aug 29, 2026 | Scanned, no flagged issues |