GPT Pilot
A developer-supervised system that plans, writes, reviews, and debugs application code task by task.
Per-dimension scores and reasoning
Evidence shows the repository contained malicious code (credential stealer), disclosed and removed in README. However, no explicit implementation of least privilege, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution is present in the current version. Given the known supply-chain attack history and lack of any security mechanisms, all trust criteria score 0.
Self-consistency: Project name inconsistent between README (gpt-pilot) and pyproject.toml (pythagora-core), but core functionality description is consistent, score 1. Dependency availability: Dependencies listed in requirements.txt and pyproject.toml, but no lock file or integrity checks, score 1. Failure messages: No clear error handling or user-friendly failure messages found in tests or code, score 1.
Audience and scenarios: README describes multiple usage scenarios (CLI, VS Code extension, Docker), score 2. Capability boundaries: No explicit statement of what AI can and cannot do, score 1. Trigger precision: CLI arguments and step descriptions are clear, but trigger conditions not specified, score 1. Environment fit: Supports Python 3.9+, SQLite/PostgreSQL, multiple LLM providers, score 2.
Information architecture: README is well-structured with TOC and sections, score 2. Install notes: Detailed installation steps provided, score 2. Naming stability: Project name inconsistent between README and pyproject, score 1. Examples and FAQ: Example links and FAQ provided, score 2. Known limitations: Not explicitly listed, score 1. License: FSL-1.1-MIT license provided, score 2. Versioning and changelog: Version number in pyproject, but no changelog, score 1. Maintenance responsibility: README states no longer maintained, score 1.
Output usability: Generated code stored in workspace folder, but format or quality not specified, score 2. Marginal value: As an AI developer tool, provides unique features, score 2. Cost benefit: No performance or cost data provided, score 1.
Claim traceability: Claims in README not supported by specific evidence, score 1. Cross-source corroboration: Only single source, score 1. Fact-inference separation: No clear distinction between facts and inferences, score 1.
- The repository contained malicious code in the past; although removed, review all dependencies and code before use.
- The project is no longer maintained, potential unpatched security vulnerabilities.
- License is FSL-1.1-MIT, restricts competing commercial use; ensure compliance.
What does this agent do, and when should you use it?
GPT Pilot is the core technology behind the Pythagora VS Code extension and can also run through a Python CLI. It turns an app description into specifications, architecture, and development tasks, then advances through implementation and review one task at a time. Its documented workflow includes Specification Writer, Architect, Tech Lead, Developer, Code Monkey, Reviewer, Troubleshooter, Debugger, and Technical Writer roles. Generated application code is stored in an app-named directory under `workspace`; SQLite is the default database and PostgreSQL is documented as an option. The project is no longer actively maintained, and its README discloses a removed credential-stealing supply-chain payload that was present from August 2025 through June 11, 2026, making security due diligence essential before adoption.
After the user supplies an application name and description, Specification Writer asks questions when requirements are insufficient, while Architect records the technologies and checks or installs them. Tech Lead writes development tasks; Developer produces human-readable implementation instructions for each task; and Code Monkey applies changes using those instructions and the existing files. Reviewer checks each step and can return incorrect work, while Troubleshooter helps frame user feedback, Debugger handles failures, and Technical Writer writes project documentation. The CLI starts with python main.py, lists projects with --list, resumes with --project <app_id>, and can resume from a chosen step with --project <app_id> --step <step>.
- A VS Code developer who wants to use the Pythagora VS Code extension to build an application through iterative, conversational development tasks.
- A Python developer who prefers to run
python main.pyand have an app description developed into a local project underworkspace. - A developer returning to an existing GPT Pilot app who needs to resume its latest state with
--project <app_id>. - A developer reviewing problematic generated work who wants a documented workflow involving Reviewer, Troubleshooter, Debugger, and manual intervention.
- A user who needs PostgreSQL instead of the default SQLite database and can install the documented database drivers and configure
db.url.
What are this agent's strengths and limitations?
- It is designed around small development tasks with implementation, review, and debugging, rather than a single full-codebase generation pass.
- It offers both a VS Code extension route and a Python CLI route, with generated projects materialized in a local workspace.
- The documented provider configuration includes OpenAI, Anthropic, and Groq, alongside default SQLite and optional PostgreSQL support.
- Its stated role workflow spans requirements clarification, architecture, task planning, coding, review, troubleshooting, debugging, and documentation.
- The project explicitly states that it is no longer actively maintained, with no continuing maintenance, compatibility, or security-response commitment documented.
- The README reports a past credential-stealing supply-chain payload; anyone who ran source during the affected period must rotate credentials and check compromise indicators.
- Operation requires Python, access to a configured model provider, corresponding API credentials, and local filesystem access to the workspace.
- Resuming from a specified
--stepdeletes later progress, and the project-deletion CLI command is irreversible. - The project’s own framing retains developer responsibility for part of the work; correctness and production readiness of generated code are not guaranteed.
How do you install or deploy this agent?
Python 3.9+ is required. On a machine that was not run with affected source between August 2025 and June 11, 2026, run: git clone https://github.com/Pythagora-io/gpt-pilot.git, cd gpt-pilot, python3 -m venv venv, source venv/bin/activate, pip install -r requirements.txt, and cp example-config.json config.json. Configure a key and endpoint for openai, anthropic, or groq in config.json; a null key is read from environment variables. SQLite is the default database. For PostgreSQL, also run pip install asyncpg psycopg2 and set db.url to postgresql+asyncpg://<user>:<password>@<db-host>/<db-name>.
How do you use this agent?
After configuring config.json, start with python main.py and enter an application name and description. Generated code is written beneath workspace in a directory named for the app. Run python main.py --list to view projects, python main.py --project <app_id> to continue the latest step, and python main.py --project <app_id> --step <step> to continue from a specified step; the latter deletes progress after that step. python main.py --delete <app_id> deletes a project and cannot be undone.
How does this agent compare with similar options?
The README compares GPT Pilot with Smol developer and GPT engineer. It positions GPT Pilot as developer-involved, step-by-step app construction and debugging rather than one-shot full-codebase generation, and says it filters code so each model conversation receives only code relevant to the current task.
FAQ
Which provider credentials are needed?
config.json. If the configured key is null, GPT Pilot reads it from environment variables.Does it replace the developer?
Where does generated code go?
workspace inside the GPT Pilot folder.