GPT Pilot
A developer-supervised system that plans, writes, reviews, and debugs application code task by task.
- Source repo
- Pythagora-io/gpt-pilot
- Stars
- ★ 34k
- Last updated
- 4mo ago
- License
- NOASSERTION
- Primary language
- Python
- FA score
- 33/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A VS Code developer who wants to use the Pythagora VS Code extension to build an application through iterative, conversational development tasks.
- Not a fit if
- Teams that need ongoing maintenance and security-response commitments
- Teams that cannot send code and credentials to a cloud model provider
- Users wanting a turnkey tool with no model keys or database setup
- Source review
- 33/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
GPT Pilot is the core technology behind the Pythagora VS Code extension and can also run through a Python CLI. It turns an app description into specifications, architecture, and development tasks, then advances through implementation and review one task at a time. Its documented workflow includes Specification Writer, Architect, Tech Lead, Developer, Code Monkey, Reviewer, Troubleshooter, Debugger, and Technical Writer roles. Generated application code is stored in an app-named directory under workspace; SQLite is the default database and PostgreSQL is documented as an option. The project is no longer actively maintained, and its README discloses a removed credential-stealing supply-chain payload that was present from August 2025 through June 11, 2026, making security due diligence essential before adoption.
After the user supplies an application name and description, Specification Writer asks questions when requirements are insufficient, while Architect records the technologies and checks or installs them. Tech Lead writes development tasks; Developer produces human-readable implementation instructions for each task; and Code Monkey applies changes using those instructions and the existing files. Reviewer checks each step and can return incorrect work, while Troubleshooter helps frame user feedback, Debugger handles failures, and Technical Writer writes project documentation. The CLI starts with python main.py, lists projects with --list, resumes with --project <app_id>, and can resume from a chosen step with --project <app_id> --step <step>.
- A VS Code developer who wants to use the Pythagora VS Code extension to build an application through iterative, conversational development tasks.
- A Python developer who prefers to run
python main.pyand have an app description developed into a local project underworkspace. - A developer returning to an existing GPT Pilot app who needs to resume its latest state with
--project <app_id>. - A developer reviewing problematic generated work who wants a documented workflow involving Reviewer, Troubleshooter, Debugger, and manual intervention.
- A user who needs PostgreSQL instead of the default SQLite database and can install the documented database drivers and configure
db.url.
How do you install or deploy this agent?
Python 3.9+ is required. On a machine that was not run with affected source between August 2025 and June 11, 2026, run: git clone https://github.com/Pythagora-io/gpt-pilot.git, cd gpt-pilot, python3 -m venv venv, source venv/bin/activate, pip install -r requirements.txt, and cp example-config.json config.json. Configure a key and endpoint for openai, anthropic, or groq in config.json; a null key is read from environment variables. SQLite is the default database. For PostgreSQL, also run pip install asyncpg psycopg2 and set db.url to postgresql+asyncpg://<user>:<password>@<db-host>/<db-name>.
How do you use this agent?
After configuring config.json, start with python main.py and enter an application name and description. Generated code is written beneath workspace in a directory named for the app. Run python main.py --list to view projects, python main.py --project <app_id> to continue the latest step, and python main.py --project <app_id> --step <step> to continue from a specified step; the latter deletes progress after that step. python main.py --delete <app_id> deletes a project and cannot be undone.
What are this agent's strengths and limitations?
- It is designed around small development tasks with implementation, review, and debugging, rather than a single full-codebase generation pass.
- It offers both a VS Code extension route and a Python CLI route, with generated projects materialized in a local workspace.
- The documented provider configuration includes OpenAI, Anthropic, and Groq, alongside default SQLite and optional PostgreSQL support.
- Its stated role workflow spans requirements clarification, architecture, task planning, coding, review, troubleshooting, debugging, and documentation.
- The project explicitly states that it is no longer actively maintained, with no continuing maintenance, compatibility, or security-response commitment documented.
- The README reports a past credential-stealing supply-chain payload; anyone who ran source during the affected period must rotate credentials and check compromise indicators.
- Operation requires Python, access to a configured model provider, corresponding API credentials, and local filesystem access to the workspace.
- Resuming from a specified
--stepdeletes later progress, and the project-deletion CLI command is irreversible. - The project’s own framing retains developer responsibility for part of the work; correctness and production readiness of generated code are not guaranteed.
How does this agent compare with similar options?
The README compares GPT Pilot with Smol developer and GPT engineer. It positions GPT Pilot as developer-involved, step-by-step app construction and debugging rather than one-shot full-codebase generation, and says it filters code so each model conversation receives only code relevant to the current task.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| GPT Pilot This agent | 33 · Major gaps | CLIFree + model costs | ★ 34k | 4mo ago | Python | OpenAI API · Claude API |
| Plannotator | 78 · Good | CLIFreemium | ★ 9.9k | today | TypeScript | Codex · Claude Code |
| Kilo Code — The Open-Source All-in-One Coding Agent | 55 · Major gaps | IDE extensionFreemium | ★ 28k | today | TypeScript | — |
| Mysti AI Coding Team | 58 · Major gaps | IDE extensionFree + model costs | ★ 1.2k | 1d ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows the repository contained malicious code (credential stealer), disclosed and removed in README. However, no explicit implementation of least privilege, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution is present in the current version. Given the known supply-chain attack history and lack of any security mechanisms, all trust criteria score 0.
Self-consistency: Project name inconsistent between README (gpt-pilot) and pyproject.toml (pythagora-core), but core functionality description is consistent, score 1. Dependency availability: Dependencies listed in requirements.txt and pyproject.toml, but no lock file or integrity checks, score 1. Failure messages: No clear error handling or user-friendly failure messages found in tests or code, score 1.
Audience and scenarios: README describes multiple usage scenarios (CLI, VS Code extension, Docker), score 2. Capability boundaries: No explicit statement of what AI can and cannot do, score 1. Trigger precision: CLI arguments and step descriptions are clear, but trigger conditions not specified, score 1. Environment fit: Supports Python 3.9+, SQLite/PostgreSQL, multiple LLM providers, score 2.
Information architecture: README is well-structured with TOC and sections, score 2. Install notes: Detailed installation steps provided, score 2. Naming stability: Project name inconsistent between README and pyproject, score 1. Examples and FAQ: Example links and FAQ provided, score 2. Known limitations: Not explicitly listed, score 1. License: FSL-1.1-MIT license provided, score 2. Versioning and changelog: Version number in pyproject, but no changelog, score 1. Maintenance responsibility: README states no longer maintained, score 1.
Output usability: Generated code stored in workspace folder, but format or quality not specified, score 2. Marginal value: As an AI developer tool, provides unique features, score 2. Cost benefit: No performance or cost data provided, score 1.
Claim traceability: Claims in README not supported by specific evidence, score 1. Cross-source corroboration: Only single source, score 1. Fact-inference separation: No clear distinction between facts and inferences, score 1.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- The repository contained malicious code in the past; although removed, review all dependencies and code before use.
- The project is no longer maintained, potential unpatched security vulnerabilities.
- License is FSL-1.1-MIT, restricts competing commercial use; ensure compliance.
FAQ
Which provider credentials are needed?
config.json. If the configured key is null, GPT Pilot reads it from environment variables.Does it replace the developer?
Where does generated code go?
workspace inside the GPT Pilot folder.