{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "agentpack", "name": "Agentpack", "vendor": "Oleg Pustovit", "vendorUrl": "https://olegpustovit.github.io/agentpack/", "kind": "harness", "category": "agent-packages", "summary": "Agentpack is an MIT-licensed Go CLI that pins skills, plugins and MCP servers in a lockfile and stages them for seven coding agents. Its gateway runs agent sessions across a person's Tailscale machines and answers MCP at `/mcp`.", "url": "https://www.anchorterminal.com/tools/agentpack", "markdownUrl": "https://www.anchorterminal.com/tools/agentpack.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/agentpack.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/agentpack.json", "dns": "agentpack.grade.anchorterminal.com", "repo": "https://github.com/olegpustovit/agentpack", "license": "MIT (Copyright (c) olegpustovit and contributors)", "transports": [ "streamable-http" ], "packages": [], "auth": "oauth", "authNotes": "No account for the CLI. The gateway's browser app needs a root account, created with a one-time setup token and a bcrypt-hashed password of 12 to 72 bytes. The MCP endpoint takes OAuth with PKCE (S256) and dynamic client registration under one scope, `agentpack`, which covers every machine the gateway reaches, terminal input and package installs. Access tokens last an hour and refresh grants 30 days, with a revocation endpoint. Tailnet peers are authenticated by Tailscale WhoIs.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy. Model usage is billed by each coding agent's own plan or key, and the multi-machine gateway needs Tailscale.", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs or the changelog, read on 2026-11-01. The project sells nothing.", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://olegpustovit.github.io/agentpack/", "capabilities": [ "agent.packages", "agent.multi-agent" ], "tags": [ "open-source", "mit", "local", "self-hosted", "free", "no-card", "go", "cli", "mcp", "streamable-http", "agent-skills", "macos", "linux", "windows" ], "lastRelease": "2026-11-01", "graded": true, "anchor": { "graded": true, "score": 56.4, "grade": "C", "agentReady": false, "rank": 759, "ranked": true, "rankOf": 1251, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 56, "payments": 60, "reliability": 47, "schema": 65, "security": 48, "transparency": 60 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 47, "points": 9.4, "reason": "Read as local software. GoReleaser archives for macOS, Linux and Windows with a SHA-256 checksums file, shell and PowerShell installers that check it, and a Homebrew cask at 0.12.7, with the platforms stated in the installation guide (20). A public CI workflow runs gofmt, go vet and go test on Linux, macOS and Windows, the race detector, the gateway UI's lint, unit and Playwright suites and an Oh My Pi runtime test. The release configuration runs go test before each build, and the published 0.12.7 assets show that passed. The CI run history on the default branch was not readable from this session, so credit for the suite only (15). GitHub issues could not be read. The changelog fixes crashes and regressions within a day, such as the gateway crash fixed in 0.12.3 on 31 October (5). Keep a Changelog format and semver tags, but the changelog skips 0.8.0 to 0.12.0 and says breaking changes may land without a migration window (7). Pre-release at 0.12.7 and not declared stable (0).", "checked": "2026-11-01" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "The MCP server's 10 tools take inputs generated from Go structs, with a JSON Schema description on every field and required fields marked. No OpenAPI for the gateway's REST API (22). No llms.txt on the docs site. The docs are Markdown in the repository (5). Tool descriptions state purpose and some limits, such as stop and restart losing unsaved conversation state, terminal output being untrusted and reusing `operation_id` on retry, and field descriptions name the tool a value comes from (13). The harness names, the 32,768-byte limits and the `operation_id` format appear in prose, not as enums or constraints, and no tool takes a free-form JSON blob (9). CLI examples throughout the docs. MCP errors return the REST body as text with `isError`, and there is no error table (6). A Keep a Changelog file with dated entries and semver tags, but no entries for 0.8.0 to 0.12.0 and a server version hard-coded as \"1\" (10).", "checked": "2026-11-01" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Ten compact tools (25). `read_terminal` takes an offset and a limit up to 32 KiB and returns `next_offset` and `truncated`; the list tools have no filter or pagination (10). Failures come back as tool results with `isError` and the gateway's message, and an unauthenticated call gets a 401 with OAuth resource metadata, but the messages are not documented (8). readOnlyHint is set on every tool, true on the five reads. `restart_session` requires an `operation_id`, and each session worker keeps the last 128 results so a retry does not restart twice. No destructiveHint is set, and `install_package` restarts affected agents (14). `node` is optional and `limit` defaults to 32 KiB, but folders must be exact absolute paths from another call. No SDK; the CLI and MCP are the interfaces (7).", "checked": "2026-11-01" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 48, "points": 8.4, "reason": "Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry found in the docs, the changelog or go.mod, though the full source was not read. Tailnet sharing is on by default and every 30 seconds library records are exchanged with the owner's other machines, which the docs say carry no secrets, terminal output or project files (20). No sandbox, and sessions run as the user. OAuth consent grants one scope over every reachable machine, terminal input and package installs, staged MCP servers are approved by name in Claude Code's settings, and `--yolo` forwards each agent's skip-permission flag. Packages are checked against content hashes and locked npm trees run without install scripts (9). `read_terminal` tells the model that process output is untrusted, and pinning stops a skill or server changing under a project without a new lock (9). Each session records who started it, including `mcp`, and the gateway writes a log file, but we found no per-call log of MCP actions (6). No SECURITY.md, security.txt or bug bounty. A Security section in the changelog (a path-traversal fix in 0.3.3), PKCE S256, bcrypt, a cap on login attempts and Host and Origin checks on the MCP server (4).", "checked": "2026-11-01" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Installs from a package manager or release archive with no signup (20).", "checked": "2026-11-01" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "reason": "0.12.7 on 1 November 2026 in the changelog and the Homebrew cask (30). 24 dated changelog entries since 10 October 2026, and pkg.go.dev lists 30 module versions between 16 and 29 October (20). Issues and pull requests on GitHub could not be read from this session (0, unchecked). Not in the official MCP registry, where io.github.ihorponom/agentpack is a different project (0). Current dependencies (Go 1.27.3, the MCP Go SDK 1.8.0, tailscale.com 1.104.4) and CI on three operating systems, with the run status unread and no Dependabot configuration found (6).", "checked": "2026-11-01" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "note": "editorial 61, provenance 58", "reason": "MIT, source on GitHub (30). No privacy policy, but the gateway docs say what moves between machines (validated registry records, never local credentials, terminal output or project files), MCP header values and OAuth settings stay out of `pack.lock`, and the Codex proxy logs metadata only unless payload logging is turned on (14). The project states it has no backwards compatibility or deprecation window until a stable release, with dated changelog entries (5). No telemetry found to disclose. The default-on sharing and replication are documented with `gateway sharing off` and a Settings switch, but nothing states plainly what the CLI sends and to whom (12).", "checked": "2026-11-01" } ], "assessment": { "date": "2026-11-01", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Ten compact tools (25). `read_terminal` takes an offset and a limit up to 32 KiB and returns `next_offset` and `truncated`; the list tools have no filter or pagination (10). Failures come back as tool results with `isError` and the gateway's message, and an unauthenticated call gets a 401 with OAuth resource metadata, but the messages are not documented (8). readOnlyHint is set on every tool, true on the five reads. `restart_session` requires an `operation_id`, and each session worker keeps the last 128 results so a retry does not restart twice. No destructiveHint is set, and `install_package` restarts affected agents (14). `node` is optional and `limit` defaults to 32 KiB, but folders must be exact absolute paths from another call. No SDK; the CLI and MCP are the interfaces (7).", "maintenance": "0.12.7 on 1 November 2026 in the changelog and the Homebrew cask (30). 24 dated changelog entries since 10 October 2026, and pkg.go.dev lists 30 module versions between 16 and 29 October (20). Issues and pull requests on GitHub could not be read from this session (0, unchecked). Not in the official MCP registry, where io.github.ihorponom/agentpack is a different project (0). Current dependencies (Go 1.27.3, the MCP Go SDK 1.8.0, tailscale.com 1.104.4) and CI on three operating systems, with the run status unread and no Dependabot configuration found (6).", "payments": "No payment protocol (0). Read with the self-hosted rule. Free under MIT with nothing to buy (20). No card or account (20). Installs from a package manager or release archive with no signup (20).", "reliability": "Read as local software. GoReleaser archives for macOS, Linux and Windows with a SHA-256 checksums file, shell and PowerShell installers that check it, and a Homebrew cask at 0.12.7, with the platforms stated in the installation guide (20). A public CI workflow runs gofmt, go vet and go test on Linux, macOS and Windows, the race detector, the gateway UI's lint, unit and Playwright suites and an Oh My Pi runtime test. The release configuration runs go test before each build, and the published 0.12.7 assets show that passed. The CI run history on the default branch was not readable from this session, so credit for the suite only (15). GitHub issues could not be read. The changelog fixes crashes and regressions within a day, such as the gateway crash fixed in 0.12.3 on 31 October (5). Keep a Changelog format and semver tags, but the changelog skips 0.8.0 to 0.12.0 and says breaking changes may land without a migration window (7). Pre-release at 0.12.7 and not declared stable (0).", "schema": "The MCP server's 10 tools take inputs generated from Go structs, with a JSON Schema description on every field and required fields marked. No OpenAPI for the gateway's REST API (22). No llms.txt on the docs site. The docs are Markdown in the repository (5). Tool descriptions state purpose and some limits, such as stop and restart losing unsaved conversation state, terminal output being untrusted and reusing `operation_id` on retry, and field descriptions name the tool a value comes from (13). The harness names, the 32,768-byte limits and the `operation_id` format appear in prose, not as enums or constraints, and no tool takes a free-form JSON blob (9). CLI examples throughout the docs. MCP errors return the REST body as text with `isError`, and there is no error table (6). A Keep a Changelog file with dated entries and semver tags, but no entries for 0.8.0 to 0.12.0 and a server version hard-coded as \"1\" (10).", "security": "Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. No telemetry found in the docs, the changelog or go.mod, though the full source was not read. Tailnet sharing is on by default and every 30 seconds library records are exchanged with the owner's other machines, which the docs say carry no secrets, terminal output or project files (20). No sandbox, and sessions run as the user. OAuth consent grants one scope over every reachable machine, terminal input and package installs, staged MCP servers are approved by name in Claude Code's settings, and `--yolo` forwards each agent's skip-permission flag. Packages are checked against content hashes and locked npm trees run without install scripts (9). `read_terminal` tells the model that process output is untrusted, and pinning stops a skill or server changing under a project without a new lock (9). Each session records who started it, including `mcp`, and the gateway writes a log file, but we found no per-call log of MCP actions (6). No SECURITY.md, security.txt or bug bounty. A Security section in the changelog (a path-traversal fix in 0.3.3), PKCE S256, bcrypt, a cap on login attempts and Host and Origin checks on the MCP server (4).", "transparency": "MIT, source on GitHub (30). No privacy policy, but the gateway docs say what moves between machines (validated registry records, never local credentials, terminal output or project files), MCP header values and OAuth settings stay out of `pack.lock`, and the Codex proxy logs metadata only unless payload logging is turned on (14). The project states it has no backwards compatibility or deprecation window until a stable release, with dated changelog entries (5). No telemetry found to disclose. The default-on sharing and replication are documented with `gateway sharing off` and a Settings switch, but nothing states plainly what the CLI sends and to whom (12)." }, "sources": [ { "what": "README", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/README.md", "seen": "2026-11-01" }, { "what": "changelog", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/CHANGELOG.md", "seen": "2026-11-01" }, { "what": "contributor guide with the pre-release rule", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/AGENTS.md", "seen": "2026-11-01" }, { "what": "MIT licence", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "seen": "2026-11-01" }, { "what": "MCP server source (tools, annotations, auth check)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/internal/network/mcp.go", "seen": "2026-11-01" }, { "what": "MCP server at the v0.8.0 tag", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/v0.8.0/internal/network/mcp.go", "seen": "2026-11-01" }, { "what": "OAuth server source (PKCE, scope, token lifetimes, revocation)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/internal/network/oauth.go", "seen": "2026-11-01" }, { "what": "gateway login source (bcrypt, attempt cap)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/internal/network/auth.go", "seen": "2026-11-01" }, { "what": "gateway source (bind address, session actor)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/internal/network/gateway.go", "seen": "2026-11-01" }, { "what": "Go module requirements", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/go.mod", "seen": "2026-11-01" }, { "what": "CI workflow", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/.github/workflows/ci.yml", "seen": "2026-11-01" }, { "what": "release workflow", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/.github/workflows/release.yml", "seen": "2026-11-01" }, { "what": "GoReleaser configuration", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/.goreleaser.yaml", "seen": "2026-11-01" }, { "what": "docs book configuration (author)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/book.toml", "seen": "2026-11-01" }, { "what": "gateway services and Tailscale sharing", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/guides/gateway-services.md", "seen": "2026-11-01" }, { "what": "public gateway deployment and MCP client connection", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/guides/gateway-deployment.md", "seen": "2026-11-01" }, { "what": "MCP servers in the manifest and lockfile", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/concepts/mcp.md", "seen": "2026-11-01" }, { "what": "integrity and verification", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/concepts/integrity.md", "seen": "2026-11-01" }, { "what": "CLI reference", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/reference/cli.md", "seen": "2026-11-01" }, { "what": "environment variables", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/reference/env-vars.md", "seen": "2026-11-01" }, { "what": "installation", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/getting-started/installation.md", "seen": "2026-11-01" }, { "what": "introduction", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/introduction.md", "seen": "2026-11-01" }, { "what": "ICSE 2027 evaluation artefact", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/evaluation/icse2027/README.md", "seen": "2026-11-01" }, { "what": "docs site", "url": "https://olegpustovit.github.io/agentpack/", "seen": "2026-11-01" }, { "what": "pkg.go.dev versions", "url": "https://pkg.go.dev/github.com/olegpustovit/agentpack?tab=versions", "seen": "2026-11-01" }, { "what": "Homebrew cask", "url": "https://raw.githubusercontent.com/olegpustovit/homebrew-tap/master/Casks/agentpack.rb", "seen": "2026-11-01" }, { "what": "Rust tag v0.1.0 (Cargo.toml)", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/v0.1.0/Cargo.toml", "seen": "2026-11-01" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=agentpack", "seen": "2026-11-01" }, { "what": "crates.io agentpack (a different project)", "url": "https://crates.io/api/v1/crates/agentpack", "seen": "2026-11-01" } ], "openQuestions": [ "Judgement call on category. Listed in agent package managers, a category added for it on 1 November 2026 (founder): its lockfile pins skills, plugins and MCP servers for seven coding agents, and its gateway lets another agent start, type into and stop their sessions. It does not run a model loop, so `agent.harness` is left out.", "firstReleased is 10 October 2026, the earliest dated changelog entry (0.4.1, the Go rewrite). Earlier tags exist (v0.1.0 is a Rust CLI) but carry no dates we could read; the listing check's first commit of 14 March 2026 came from github.com, which this session could not reach.", "unchecked: GitHub issues, pull requests, stars, CI run history and release pages, because github.com and api.github.com were unreachable. Reliability and maintenance scores leave out what they would show.", "unchecked: what \"Agentnet discovery\" is. The gateway services guide says it is on by default, like tailnet sharing, and no other page read explains it.", "unchecked: whether sessions started through the MCP `start_session` tool use the agents' normal permission prompts or a full-access flag; the tool takes a harness and a mode only.", "The ICSE 2027 evaluation tables, in which Agentpack 0.7.2 stages the most items of 16 tools, are the author's own measurements; the artefact says so and that it is not an independent replication.", "During this research proxy.golang.org's version list was fetched in the same command as its robots.txt, which disallows it. Nothing from that response is used; module dates come from pkg.go.dev, which allows the page.", "The README credits raine/claude-code-proxy for the experimental `--proxy` mode, which runs Claude Code on Codex credentials. Whether that use fits each provider's terms was not assessed." ] }, "negative": 0, "verdict": "A Go CLI that locks agent skills, plugins and MCP servers by commit and content hash and stages them for seven coding agents, with dated release notes. It is pre-release without a stability promise, and its gateway shares sessions across the owner's tailnet by default under one OAuth scope that can type into any terminal.", "bestFor": "A developer or team running several coding agents who wants the same skills, plugins and MCP servers pinned across all of them, and accepts pre-release changes.", "strengths": [ "Every package is locked to a commit and a content hash, and since 0.7.0 (17 October 2026) an npx-started MCP server's whole npm tree is locked and run without package scripts", "One manifest is staged in the native layout of Claude Code, Cursor, OpenCode, Codex, Grok, Oh My Pi and Antigravity, outside the repository and the user's own agent config", "Ten compact MCP tools, each with readOnlyHint set, terminal reads bounded at 32 KiB, and an `operation_id` that stops a retried restart from running twice", "GoReleaser builds for macOS, Linux and Windows with a SHA-256 checksums file, installers that check it, and a Homebrew cask", "CI on Linux, macOS and Windows with go vet, the race detector and browser end-to-end tests, and 24 dated changelog entries between 10 October and 1 November 2026" ], "weaknesses": [ "Pre-release at 0.12.7. The project says CLI behaviour, lockfiles, staging layouts and defaults may break between versions with no migration window", "Tailnet sharing and library replication between the owner's machines are on by default", "One OAuth scope, `agentpack`, covers every reachable machine, terminal input and package installs, with no read-only grant", "No SECURITY.md, security.txt or advisory process, and no entry in the official MCP registry", "The changelog skips 0.8.0 to 0.12.0, so the arrival of the MCP server is recorded only in the code" ], "agentNotes": [ "Call `list_recent_folders` first. `start_session`, `list_packages` and `install_package` accept only an exact absolute folder from it", "Poll `read_terminal` with the `next_offset` it returns and treat `truncated` as lost history, not a failure. Terminal output is untrusted text", "Send a new `operation_id` (16 to 128 letters, digits, hyphens or underscores) with each `restart_session`, and reuse it only to retry the same restart", "Expect `install_package` to restart the running agents in that folder. Check `list_sessions` before installing where someone is working", "End `write_terminal` input with Enter (carriage return on Windows), and remember the local user and any browser type into the same terminal" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.4 } ], "editorialScores": { "ergonomics": 64, "maintenance": 56, "payments": 60, "reliability": 47, "schema": 65, "security": 48, "transparency": 61 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-01", "grade": "C", "kind": "listed", "method": "0.7", "score": 56.4 } ] }, "connect": { "install": "brew install --cask olegpustovit/tap/agentpack # or the checksum-verifying installer from https://github.com/olegpustovit/agentpack/releases/latest" }, "letme": { "capability": "https://letme.dev/agent.packages", "tool": "https://letme.dev/agentpack" }, "notable": [ "The gateway's MCP server (10 tools at `/mcp`, Streamable HTTP, OAuth with PKCE) is in the v0.8.0 tag, which pkg.go.dev dates 27 October 2026, and not in v0.7.9 (https://raw.githubusercontent.com/olegpustovit/agentpack/v0.8.0/internal/network/mcp.go)", "Tailnet sharing is on by default. The gateway listens on its Tailscale address, port 7421, and accepts the owner's other untagged Tailscale machines without setup, until `agentpack gateway sharing off` (https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/guides/gateway-services.md)", "OAuth consent \"grants control over all machines accessible to this gateway identity, including terminal input and package installation\", under the one scope `agentpack` (https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/guides/gateway-deployment.md)", "Every 30 seconds a gateway exchanges library records with the owner's other online machines. The docs say secrets are stripped and terminal output, local credentials and project files are never sent (https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/guides/gateway-deployment.md)", "Since 0.7.0 of 17 October 2026, `agentpack lock` records an npx-started MCP server's npm dependency tree with registry integrity, and `agentpack mcp-exec` checks each tarball against the lock and runs no package scripts (https://raw.githubusercontent.com/olegpustovit/agentpack/master/CHANGELOG.md)", "Staged configs turn AI attribution (Co-Authored-By trailers, \"Generated with\" footers) off by default; `AGENTPACK_KEEP_ATTRIBUTION=1` keeps it (https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/reference/env-vars.md)", "`agentpack --proxy claude` runs Claude Code through a local Anthropic-compatible proxy to OpenAI's Responses endpoint on Codex credentials, with Opus-class requests sent to gpt-5.5 by default (https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/src/reference/env-vars.md)", "The README, the docs and AGENTS.md call the project pre-release, with breaking changes allowed between versions and no migration window until a stable release (https://raw.githubusercontent.com/olegpustovit/agentpack/master/AGENTS.md)", "An evaluation in the repository for an ICSE 2027 paper compares Agentpack 0.7.2 with 15 other tools on nine pinned inputs; it says one author wrote the tool and the scripts and that it is not an independent replication (https://raw.githubusercontent.com/olegpustovit/agentpack/master/evaluation/icse2027/README.md)" ], "area": "frameworks", "details": [ { "label": "Surface listed", "value": "The olegpustovit/agentpack repository at 0.12.7 (branch master), read from raw.githubusercontent.com, with the mdBook docs at olegpustovit.github.io/agentpack, pkg.go.dev and the Homebrew tap on 1 November 2026. Nothing was installed or run, and no MCP session was opened" }, { "label": "How an agent reaches it", "value": "Two ways. A coding agent launched through `agentpack \u003cagent\u003e` starts with the pinned skills, plugins, rules, hooks and MCP servers in place. An outside agent connects to a gateway's MCP endpoint at `/mcp` over Streamable HTTP and drives sessions and installs. There is no hosted service; each person runs their own gateway" }, { "label": "Agents staged for", "value": "Claude Code, Cursor Agent, OpenCode, Codex, Grok, Oh My Pi and Antigravity through launchers, and `agentpack eject` writes plain project files for Claude Code, Cursor, Codex and Antigravity front ends that are not started through Agentpack" }, { "label": "Lockfile and integrity", "value": "`agentpack.toml` and `pack.lock` pin every package, direct and transitive, to a commit and a `sha256-tree-v1` content hash, checked before staging. `AGENTPACK_REQUIRE_VERIFIED` refuses unhashed packages. Header values and OAuth settings for MCP servers are kept out of `pack.lock`" }, { "label": "MCP tools", "value": "10. list_nodes, list_sessions, list_recent_folders, list_packages and read_terminal (readOnlyHint true), and start_session, stop_session, restart_session, write_terminal and install_package (readOnlyHint false). Inputs are Go structs with JSON Schema descriptions; the harness names and byte limits are stated in prose" }, { "label": "Gateway and network", "value": "Binds 127.0.0.1:7420 by default and needs https for any other public URL. Tailnet sharing on port 7421 is on by default and authenticates peers by Tailscale WhoIs. Other accounts and tagged machines need `gateway sharing allow`. The maintainer's own public gateway is agentpack.microapps.space, deployed with `agentpack deploy`" }, { "label": "Approvals", "value": "None of its own for agent actions. `--yolo` forwards each agent's skip-permission or full-access flag. Staged MCP servers are approved by name in Claude Code's settings. OAuth consent is one screen for all machines" }, { "label": "Sandbox", "value": "None. Agents and the gateway's session workers run as the user's OS account; the user service needs no root" }, { "label": "Telemetry", "value": "None found in the docs, the changelog or go.mod, which lists no analytics or error-reporting library. The full source was not read. Outbound traffic named in the docs is GitHub and the npm registry for packages, Tailscale peers, and the opt-in Codex proxy" }, { "label": "Platforms", "value": "macOS (arm64, x86_64), Linux (x86_64, arm64) and Windows (x86_64) archives, shell and PowerShell installers that write to ~/.local/bin, and a Homebrew cask. The gateway service uses systemd user units, a LaunchAgent or a Scheduled Task" }, { "label": "Releases", "value": "24 dated changelog entries from 0.4.1 (10 October 2026, a Go rewrite of an earlier Rust CLI) to 0.12.7 (1 November 2026). pkg.go.dev lists 30 module versions between 16 and 29 October. The changelog has no entries for 0.8.0 to 0.12.0" }, { "label": "Name", "value": "Other projects called agentpack exist and are not this one, among them the Rust crate by liqiongyu and io.github.ihorponom/agentpack in the MCP registry" } ], "provenance": { "legalEntity": "No legal entity found. The licence reads Copyright (c) olegpustovit and contributors, and the docs name Oleg Pustovit as author", "domain": "olegpustovit.github.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "docs/book.toml names Oleg Pustovit as the docs' author. The MIT licence names olegpustovit and contributors. No company is named anywhere read.", "No terms or privacy policy for the software; the MIT licence stands in for terms.", "olegpustovit.github.io/.well-known/security.txt returned 404 on 1 November 2026, and the repository has no SECURITY.md at the root or in .github.", "olegpustovit.com and agentpack.microapps.space disallow ClaudeBot, Claude-Web and anthropic-ai in robots.txt, so neither was read. github.com and api.github.com were unreachable from this session.", "Local software, so there is no vendor endpoint or status page. The public gateway at agentpack.microapps.space is the maintainer's own deployment." ], "score": 58, "checks": [ { "check": "Legal entity named", "value": "No legal entity found. The licence reads Copyright (c) olegpustovit and contributors, and the docs name Oleg Pustovit as author", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "olegpustovit.github.io, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "state": "unreadable", "reason": "the page has 169 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-11-01", "points": 7, "max": 10 }, { "kind": "privacy", "url": "", "state": "none-found", "points": 0, "max": 10 } ] }, "humans": { "slug": "agentpack", "checked": "2026-11-01", "company": "Oleg Pustovit", "people": [ { "name": "Oleg Pustovit", "role": "Maker and maintainer of Agentpack", "founder": true, "github": "https://github.com/olegpustovit", "page": "/people/oleg-pustovit/" } ], "peopleNote": "Agentpack is a one-person project as far as its own pages show. docs/book.toml names Oleg Pustovit as the docs' author, the repository, the Homebrew tap and the Go module sit under the GitHub account olegpustovit, and the MIT licence reads olegpustovit and contributors. The ICSE evaluation says one author wrote the tool. olegpustovit.com was not read because its robots.txt disallows ClaudeBot, Claude-Web and anthropic-ai, and the GitHub profile was unreachable from this session. No company, funding or backer appears in the repository, the docs or the changelog, so investors are left out.", "companySocial": {}, "support": { "urls": [ "https://olegpustovit.github.io/agentpack/" ] }, "sources": [ "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/book.toml", "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "https://raw.githubusercontent.com/olegpustovit/agentpack/master/README.md", "https://raw.githubusercontent.com/olegpustovit/agentpack/master/evaluation/icse2027/README.md", "https://olegpustovit.github.io/agentpack/" ], "ownership": { "status": "project", "checked": "2026-11-01", "sources": [ "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "https://raw.githubusercontent.com/olegpustovit/agentpack/master/docs/book.toml" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/agentpack.json" } }