AEON Autonomous Agent Framework
The autonomous AI agent framework that runs unattended on GitHub Actions: configure once, forget forever, with self-healing skills and no approval loops.
Evidence shows substantial hardening (default-deny egress to link-local/metadata, bubblewrap read-only sandbox, SHA-pinned actions, fail-closed opt-in Fleet Watcher preflight), but the workflow grants broad permissions (contents:write, id-token:write, pull-requests:write, issues:write) and runs unattended — deducted. 'No approval loops' is explicit; only an optional gate exists. Data flows (chain context files, Issues state backend, audit log) are well documented (2); secrets are never echoed and the audit log has adversarial multi-encoding redaction tests, but GH_SECRETS_PAT persists rotated OAuth tokens back to repo secrets (2); dependencies are pinned ([email protected], SHA-pinned actions, offline cache) (2); external effects — unattended pushes to main, PRs, notifications — deducted to 1; rollback is limited to rebase/reset retries and PR snapshots (1); attribution is solid: MIT, OIDC-signed attestations, fixed git identity (2).
Comments record a live-observed concurrency bug (8/10 runs silently cancelled), its fix, and the remaining unfixed gap — high self-consistency with known gaps (2); dependency availability is supported by npm cache + --prefer-offline, apt lock timeouts, step timeouts (2); failure messages use ::error::/::warning:: with specifics and distinguish invalid-dispatch from real failures (2).
Nine harnesses and opt-in state backends with fork backward-compatibility (2); capability boundaries are asserted in marketing ('most autonomous', 'self-healing') with only comment-level acknowledgment of limits (1); trigger precision via skill-name regex validation, ai-build label gating, and choice inputs preventing HTTP 422 (2); environment fit handles the ubuntu-24.04 AppArmor userns restriction with measured evidence (2).
Clear repo structure (apps/, skills/, scripts/, memory/) (2); a bootstrap script exists but no README/install docs appear in evidence (1); naming stable (2); examples exist only as tests, no user docs/FAQ (1); known-limitations documentation is exceptional, with measured dates, observed incidents, and unfixed gaps (3); MIT license complete (3); root version 0.0.0, no changelog evidence, deliberately divergent per-app toolchains (1); no maintainer/CONTRIBUTING evidence beyond a fixed git identity (1).
Outputs land as consumable files (output/.chains, memory/cron-state., skill-health JSON) (2); multi-harness orchestration plus supply-chain hardening and attestations is distinctive (2); cost discipline via max_dispatches budget, step/job timeouts, fail-closed preflight (2).
Comments carry concrete dates, observed incidents (2026-08-19 hangs, 8/10 cancellations), and checkable mechanisms (attestations, audit log, state files) (2); tests cover only a few scripts, so most claims rest on self-attestation (1); facts and inference are separated in comments, but top-level marketing claims are unverifiable (1).
- Unattended runs with contents:write/id-token:write mean any skill-level prompt injection could push to main or open PRs directly; the Fleet gate is opt-in — enable it or add your own approval step.
- GH_SECRETS_PAT lets scripts persist rotated OAuth tokens back into repo secrets — a sensitive-credential persistence path; scope that PAT minimally.
- The bubblewrap sandbox works by disabling kernel.apparmor_restrict_unprivileged_userns, which itself weakens the runner's isolation baseline.
- This is a static review with no executed runs; the 'most autonomous' / 'self-healing' marketing claims are not supported by the reviewed evidence — do not rely on them for capability assessment.
What does this agent do, and when should you use it?
AEON is an open-source (MIT) autonomous agent framework whose execution boundary is a GitHub repository plus GitHub Actions, running scheduled jobs unattended on UTC cron. Its core abstraction is the skill: a single SKILL.md file made of frontmatter plus a plain-language prompt, with all 78 skills organized into six packs (Core, Evolution, Basics, Dev & Code, Crypto & Markets, Productivity). The same SKILL.md runs on any of nine agent CLIs — Claude, Grok, Codex, Pi, Vibe, Kimi, fx, Cursor, Hermes — behind one unified run-harness contract. All configuration lives in aeon.yml, covering schedules, per-skill var inputs, models, authentication, notification channels, and API keys. Unlike agent tools that keep a human in the approval loop, AEON is built around four unattended capabilities — running on a schedule, remembering across runs, reacting to conditions, and repairing its own broken skills — closed by a heartbeat-driven health and repair loop.
AEON reads schedules and configuration from aeon.yml, triggers SKILL.md skills on cron via GitHub Actions, and dispatches them through the run-harness contract to one of nine agent CLIs. Concrete outputs: the feature skill ships PRs to your repos; deploy-prototype deploys live apps to Vercel; vuln-scanner finds real vulnerabilities and privately discloses them; create-skill writes new skills from a single sentence. After each run, a model scores it 1–5, and the heartbeat → skill-health → skill-repair → self-improve chain detects and fixes broken skills automatically, while aeon-doctor lints the config itself. spawn-instance forks one Aeon into specialized instances (e.g. a DeFi tracker) with no secrets propagated and isolated billing, and fleet-control health-checks and dispatches across the fleet. Results are reported back to Telegram, Discord, or email channels, and every skill is also exposed as an aeon MCP tool inside Claude.
- Open-source maintainer: let vuln-scanner scan your repos on a schedule and privately disclose high-severity findings instead of exposing them publicly.
- Solo developer: use the feature skill to ship PRs to your own repos on a schedule, working through backlog unattended.
- Prototype team: use deploy-prototype to push apps live to Vercel on cron, getting a working deployed version automatically.
- Security researcher: replicate the pipeline behind the project's documented disclosures across 69 open-source repos (Alibaba, Tencent, Vercel and more).
- Agent enthusiast: fork one instance into specialized crypto, security, or research nodes via spawn-instance and manage them with fleet-control.
- Platform builder: use the ADK (Aeon Developer Kit) to drive your users' Aeon instances through a GitHub App API and ship your own product on top.
What are this agent's strengths and limitations?
- Genuinely unattended: scheduled runs, memory across runs, condition-triggered reactions, and self-repair together — no approval loops — which is the framework's core differentiator over most agent tools.
- One SKILL.md runs across nine agent CLIs (Claude, Grok, Codex, Pi, Vibe, Kimi, fx, Cursor, Hermes); the unified run-harness contract means swapping engines requires no skill changes.
- Self-healing is a concrete mechanism, not a slogan: a model scores every run 1–5 and the heartbeat → skill-health → skill-repair → self-improve loop detects and fixes broken skills on its own.
- Verifiable track record: the official site documents real vulnerabilities found, patched, and responsibly disclosed across 69 open-source repos (many High or Critical), plus 68 products built on Aeon.
- Guardrails ship by default: read-only skills can't touch the repo, irreversible actions fail closed, an optional Fleet Watcher gates every run, and secrets stay off the command line.
- Strong GitHub-ecosystem dependence: the runtime boundary is a repo plus Actions, and cross-repo, private, disclosure, and workflow-editing skills all require a classic PAT with repo and workflow scopes (GH_GLOBAL).
- Unattended operation raises trust costs: with no human approval step, adoption requires careful configuration of capability tiers and the Fleet Watcher gate to contain mistakes.
- Ongoing cost in GitHub Actions minutes plus the underlying model's API fees (Haiku scores every run); the repo provides no usage benchmarks for estimating long-term spend.
- Operationally bound to a supported agent CLI as the execution engine (e.g. Claude requires its own account/keys); GLM Coding Plan is only a gateway hop, not a harness, and behavior may vary when swapping engines.
- Skill quality equals prompt quality: since the prompt is the skill, writing and debugging weak SKILL.md files demands prompt-engineering experience from the user.
How do you install or deploy this agent?
Prerequisites: Node.js 20+ and an authenticated GitHub CLI (run gh auth login). Installation is via your own fork: click Use this template on the repo page (keep it public so Actions minutes are free), or run gh repo fork aeonfun/aeon --clone. Then:
git clone https://github.com/<you>/aeon
cd aeon && ./aeonOpen http://localhost:5555 and follow the dashboard: Authenticate (any of nine harnesses) → add a channel → pick skills → Run. For cross-repo skills, add one classic PAT as the GH_GLOBAL secret with repo and workflow scopes.
How do you use this agent?
All configuration lives in aeon.yml, for example:
skills:
digest:
enabled: true
schedule: "0 14 * * *" # daily 2pm UTC
var: "solana" # per-run inputOnce saved, Aeon runs unattended on GitHub Actions and pushes results to your configured Telegram, Discord, or email channel. Every dashboard action is also an ./aeon CLI command or a /aeon chat command (installable as a Claude Code or Codex plugin). Skills are files: write frontmatter and a prompt in skills/<name>/SKILL.md, declare required API keys with requires (a ? suffix means optional), accept per-run input via var, and chain into other skills.
How does this agent compare with similar options?
The README compares Aeon against Claude Code, Hermes, and OpenClaw (see docs/SHOWCASE.md): most agent tools keep you in the loop — approve each call, review each diff — whereas Aeon targets work done while you're away and claims to be the only framework that does all four unattended: scheduled runs, cross-run memory, condition-triggered reactions, and self-repair. If your workflow needs human confirmation at every step, a Claude Code-style tool fits better; if you want a configure-and-forget fleet of scheduled jobs, Aeon is the better match.