AEON Autonomous Agent Framework
The autonomous AI agent framework that runs unattended on GitHub Actions: configure once, forget forever, with self-healing skills and no approval loops.
- Source repo
- aeonfun/aeon
- Stars
- ★ 782
- Last updated
- today
- License
- MIT
- Primary language
- JavaScript
- FA score
- 56/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Open-source maintainer: let vuln-scanner scan your repos on a schedule and privately disclose high-severity findings instead of exposing them publicly.
- Not a fit if
- Teams unwilling to host their repo and secrets on GitHub
- Users who won't pay GitHub Actions minutes plus model API fees
- Source review
- 56/100 · Major gaps
What does this agent do, and when should you use it?
AEON is an open-source (MIT) autonomous agent framework whose execution boundary is a GitHub repository plus GitHub Actions, running scheduled jobs unattended on UTC cron. Its core abstraction is the skill: a single SKILL.md file made of frontmatter plus a plain-language prompt, with all 78 skills organized into six packs (Core, Evolution, Basics, Dev & Code, Crypto & Markets, Productivity). The same SKILL.md runs on any of nine agent CLIs — Claude, Grok, Codex, Pi, Vibe, Kimi, fx, Cursor, Hermes — behind one unified run-harness contract. All configuration lives in aeon.yml, covering schedules, per-skill var inputs, models, authentication, notification channels, and API keys. Unlike agent tools that keep a human in the approval loop, AEON is built around four unattended capabilities — running on a schedule, remembering across runs, reacting to conditions, and repairing its own broken skills — closed by a heartbeat-driven health and repair loop.
AEON reads schedules and configuration from aeon.yml, triggers SKILL.md skills on cron via GitHub Actions, and dispatches them through the run-harness contract to one of nine agent CLIs. Concrete outputs: the feature skill ships PRs to your repos; deploy-prototype deploys live apps to Vercel; vuln-scanner finds real vulnerabilities and privately discloses them; create-skill writes new skills from a single sentence. After each run, a model scores it 1–5, and the heartbeat → skill-health → skill-repair → self-improve chain detects and fixes broken skills automatically, while aeon-doctor lints the config itself. spawn-instance forks one Aeon into specialized instances (e.g. a DeFi tracker) with no secrets propagated and isolated billing, and fleet-control health-checks and dispatches across the fleet. Results are reported back to Telegram, Discord, or email channels, and every skill is also exposed as an aeon MCP tool inside Claude.
- Open-source maintainer: let vuln-scanner scan your repos on a schedule and privately disclose high-severity findings instead of exposing them publicly.
- Solo developer: use the feature skill to ship PRs to your own repos on a schedule, working through backlog unattended.
- Prototype team: use deploy-prototype to push apps live to Vercel on cron, getting a working deployed version automatically.
- Security researcher: replicate the pipeline behind the project's documented disclosures across 69 open-source repos (Alibaba, Tencent, Vercel and more).
- Agent enthusiast: fork one instance into specialized crypto, security, or research nodes via spawn-instance and manage them with fleet-control.
- Platform builder: use the ADK (Aeon Developer Kit) to drive your users' Aeon instances through a GitHub App API and ship your own product on top.
How do you install or deploy this agent?
Prerequisites: Node.js 20+ and an authenticated GitHub CLI (run gh auth login). Installation is via your own fork: click Use this template on the repo page (keep it public so Actions minutes are free), or run gh repo fork aeonfun/aeon --clone. Then:
git clone https://github.com/<you>/aeon
cd aeon && ./aeonOpen http://localhost:5555 and follow the dashboard: Authenticate (any of nine harnesses) → add a channel → pick skills → Run. For cross-repo skills, add one classic PAT as the GH_GLOBAL secret with repo and workflow scopes.
How do you use this agent?
All configuration lives in aeon.yml, for example:
skills:
digest:
enabled: true
schedule: "0 14 * * *" # daily 2pm UTC
var: "solana" # per-run inputOnce saved, Aeon runs unattended on GitHub Actions and pushes results to your configured Telegram, Discord, or email channel. Every dashboard action is also an ./aeon CLI command or a /aeon chat command (installable as a Claude Code or Codex plugin). Skills are files: write frontmatter and a prompt in skills/<name>/SKILL.md, declare required API keys with requires (a ? suffix means optional), accept per-run input via var, and chain into other skills.
What are this agent's strengths and limitations?
- Genuinely unattended: scheduled runs, memory across runs, condition-triggered reactions, and self-repair together — no approval loops — which is the framework's core differentiator over most agent tools.
- One SKILL.md runs across nine agent CLIs (Claude, Grok, Codex, Pi, Vibe, Kimi, fx, Cursor, Hermes); the unified run-harness contract means swapping engines requires no skill changes.
- Self-healing is a concrete mechanism, not a slogan: a model scores every run 1–5 and the heartbeat → skill-health → skill-repair → self-improve loop detects and fixes broken skills on its own.
- Verifiable track record: the official site documents real vulnerabilities found, patched, and responsibly disclosed across 69 open-source repos (many High or Critical), plus 68 products built on Aeon.
- Guardrails ship by default: read-only skills can't touch the repo, irreversible actions fail closed, an optional Fleet Watcher gates every run, and secrets stay off the command line.
- Strong GitHub-ecosystem dependence: the runtime boundary is a repo plus Actions, and cross-repo, private, disclosure, and workflow-editing skills all require a classic PAT with repo and workflow scopes (GH_GLOBAL).
- Unattended operation raises trust costs: with no human approval step, adoption requires careful configuration of capability tiers and the Fleet Watcher gate to contain mistakes.
- Ongoing cost in GitHub Actions minutes plus the underlying model's API fees (Haiku scores every run); the repo provides no usage benchmarks for estimating long-term spend.
- Operationally bound to a supported agent CLI as the execution engine (e.g. Claude requires its own account/keys); GLM Coding Plan is only a gateway hop, not a harness, and behavior may vary when swapping engines.
- Skill quality equals prompt quality: since the prompt is the skill, writing and debugging weak SKILL.md files demands prompt-engineering experience from the user.
How does this agent compare with similar options?
The README compares Aeon against Claude Code, Hermes, and OpenClaw (see docs/SHOWCASE.md): most agent tools keep you in the loop — approve each call, review each diff — whereas Aeon targets work done while you're away and claims to be the only framework that does all four unattended: scheduled runs, cross-run memory, condition-triggered reactions, and self-repair. If your workflow needs human confirmation at every step, a Claude Code-style tool fits better; if you want a configure-and-forget fleet of scheduled jobs, Aeon is the better match.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AEON Autonomous Agent Framework This agent | 56 · Major gaps | CLIFree + model costs | ★ 782 | today | JavaScript | Codex · Claude Code |
| Dagu Workflow Orchestrator | 74 · Some gaps | CLIFreemium | ★ 4.4k | 1d ago | Go | Codex · Claude Code · Claude API |
| Strix AI Pentesting | 62 · Some gaps | CLIFreemium | ★ 71k | 1d ago | Python | ChatGPT · Codex · Claude Code · OpenAI API · Claude API |
| Agent Swarm | 47 · Major gaps | Agent plugin / skillFree + model costs | ★ 929 | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows substantial hardening (default-deny egress to link-local/metadata, bubblewrap read-only sandbox, SHA-pinned actions, fail-closed opt-in Fleet Watcher preflight), but the workflow grants broad permissions (contents:write, id-token:write, pull-requests:write, issues:write) and runs unattended — deducted. 'No approval loops' is explicit; only an optional gate exists. Data flows (chain context files, Issues state backend, audit log) are well documented (2); secrets are never echoed and the audit log has adversarial multi-encoding redaction tests, but GH_SECRETS_PAT persists rotated OAuth tokens back to repo secrets (2); dependencies are pinned ([email protected], SHA-pinned actions, offline cache) (2); external effects — unattended pushes to main, PRs, notifications — deducted to 1; rollback is limited to rebase/reset retries and PR snapshots (1); attribution is solid: MIT, OIDC-signed attestations, fixed git identity (2).
Comments record a live-observed concurrency bug (8/10 runs silently cancelled), its fix, and the remaining unfixed gap — high self-consistency with known gaps (2); dependency availability is supported by npm cache + --prefer-offline, apt lock timeouts, step timeouts (2); failure messages use ::error::/::warning:: with specifics and distinguish invalid-dispatch from real failures (2).
Nine harnesses and opt-in state backends with fork backward-compatibility (2); capability boundaries are asserted in marketing ('most autonomous', 'self-healing') with only comment-level acknowledgment of limits (1); trigger precision via skill-name regex validation, ai-build label gating, and choice inputs preventing HTTP 422 (2); environment fit handles the ubuntu-24.04 AppArmor userns restriction with measured evidence (2).
Clear repo structure (apps/, skills/, scripts/, memory/) (2); a bootstrap script exists but no README/install docs appear in evidence (1); naming stable (2); examples exist only as tests, no user docs/FAQ (1); known-limitations documentation is exceptional, with measured dates, observed incidents, and unfixed gaps (3); MIT license complete (3); root version 0.0.0, no changelog evidence, deliberately divergent per-app toolchains (1); no maintainer/CONTRIBUTING evidence beyond a fixed git identity (1).
Outputs land as consumable files (output/.chains, memory/cron-state., skill-health JSON) (2); multi-harness orchestration plus supply-chain hardening and attestations is distinctive (2); cost discipline via max_dispatches budget, step/job timeouts, fail-closed preflight (2).
Comments carry concrete dates, observed incidents (2026-08-19 hangs, 8/10 cancellations), and checkable mechanisms (attestations, audit log, state files) (2); tests cover only a few scripts, so most claims rest on self-attestation (1); facts and inference are separated in comments, but top-level marketing claims are unverifiable (1).
- Unattended runs with contents:write/id-token:write mean any skill-level prompt injection could push to main or open PRs directly; the Fleet gate is opt-in — enable it or add your own approval step.
- GH_SECRETS_PAT lets scripts persist rotated OAuth tokens back into repo secrets — a sensitive-credential persistence path; scope that PAT minimally.
- The bubblewrap sandbox works by disabling kernel.apparmor_restrict_unprivileged_userns, which itself weakens the runner's isolation baseline.
- This is a static review with no executed runs; the 'most autonomous' / 'self-healing' marketing claims are not supported by the reviewed evidence — do not rely on them for capability assessment.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v0.1.0 Aeon v0.1.0
Release notes excerpt
Aeon is an autonomous agent framework that runs on GitHub Actions via Claude Code. Fork it, enable a few skills, schedule them — and it does the work on its own: ships features to your repos, finds and privately discloses real vulnerabilities, deploys live apps, runs deep research, and writes new skills for itself. No approval loops, no babysitting. v0.1.0 is the first tagged snapshot — a stable, fully documented point to fork from or pin to. It's pre-1.0: the architecture is settled and the core skill set is production-ready, but interfaces may still shift before 1.0. What's in it …View on GitHub ↗