OpenAgent
A single platform combining Deep Research-style deep reasoning with visual workflows, enabling teams to rapidly build vertical AI applications.
.env.example setup for JWT_SECRET_KEY/POSTGRES_PASSWORD etc., and SECURITY.md documenting responsibly disclosed Host Header poisoning and SSRF issues, indicate attention to outbound-request security; deducted because the sample shows no concrete least-privilege, user-confirmation, data-flow documentation, or encryption strategy, and tests reveal debug mode binds 0.0.0.0 with allow_unsafe_werkzeug=True.
Real unit tests exist covering startup behavior and DI singletons, supporting basic self-consistency; deducted because coverage is narrow, there is no evidence of error/failure messaging design, and availability of Weaviate/Redis/Postgres/model APIs is only implied by docker compose.
README clearly targets teams building vertical AI applications and lists Deep Research, workflows, RAG, and OpenAPI delivery scenarios with concrete environment requirements (Docker 20.10+, 8GB RAM, Python 3.11+); deducted for absent capability boundaries (context, concurrency, data limits) and no documentation of A2A routing trigger precision.
README is well structured (TOC, architecture, install, usage, testing, contact) with executable install steps; SECURITY.md includes a support matrix and disclosure process; MIT license is complete; two security reporters are credited. Deducted for no CHANGELOG, no known-limitations section, no FAQ, a thin 'Deep Research'/enable_deep_thinking naming mapping, and only best-effort maintenance beyond v1.1.4/main.
Published apps are delivered via POST /api/openapi/chat with REST/SSE and multi-turn identifiers — a usability claim; deducted because the sample contains no real output examples, no cost/latency/token figures, and the platform's marginal value versus Dify is asserted rhetorically without argument.
README test commands cross-check against actual test files in the repo (api/test/app/http/), and factual claims are distinguishable from aspirational language; deducted because most functional claims (A2A routing, Deep Research execution chain) have no inspectable implementation in the sample and sponsor/external links cannot be statically verified.
- Publisher identity is unverified; assess supply-chain trust independently.
- Tests show debug mode uses allow_unsafe_werkzeug=True bound to 0.0.0.0 — disable FLASK_DEBUG and front with Nginx in production.
- A prior SSRF vulnerability existed in custom API-tool server URLs; strictly restrict outbound destinations after deployment.
- Secrets rely solely on a .env file; there is no guidance on rotation or encrypted storage.
- No CHANGELOG or known-limitations list; diff versions yourself before upgrading.
What does this agent do, and when should you use it?
OpenAgent (GitHub repo Haohao-end/openagent, MIT licensed) is a full-stack AI agent platform that positions itself as what happens when OpenAI Deep Research and Dify become one platform. The backend combines Flask, SQLAlchemy, Celery, and Flask-SocketIO; the frontend uses Vue 3, Vite, Pinia, Vue Flow, and Arco Design; retrieval runs on Weaviate and FAISS; delivery uses Docker Compose and Nginx. It ships an app workspace, visual workflow authoring, dataset and document management, app publishing, and OpenAPI-based delivery over REST and SSE. Model integrations cover OpenAI, DeepSeek, Atlas Cloud, Moonshot, Tongyi, Wenxin, Ollama, Zhipu, and more. A deep thinking mode (enable_deep_thinking) decomposes complex tasks into multi-step execution while coordinating bound capabilities. It fits teams that need a self-hosted, orchestratable platform whose apps can be published as APIs.
OpenAgent provides: 1) a home assistant that routes user requests to published public agents via A2A, or turns natural-language requirements into AI app creation flows; 2) an app workspace managing model, prompt, and capability bindings (plugins, MCP, Skills, child Agent apps, workflows, datasets) with drafts, publishing, version and prompt comparison, left-side configuration and right-side live debugging with deep execution timelines; 3) a visual workflow editor with nodes for LLM, tool calls, dataset retrieval, code execution, HTTP requests, template transforms, text processing, parameter extraction, and if/else; 4) dataset management with document upload, segment inspection, and retrieval wiring; 5) published apps served via POST /api/openapi/chat over REST or streaming SSE with multi-turn conversation identifiers. The runtime stack is a Vue 3 frontend (port 3000), Flask API (port 5001), and Nginx reverse proxy, all started via Docker Compose.
- A team that needs to ground conversational apps in domain knowledge (datasets + retrieval) and publish them as internal tools
- Developers who want to orchestrate LLM calls, code execution, HTTP requests, and branching visually instead of writing orchestration code
- Scenarios requiring multi-step deep reasoning with concrete artifacts like scripts and generated files (Deep Research / deep thinking mode)
- Platform operators exposing built AI apps to third parties via OpenAPI (POST /api/openapi/chat, REST/SSE)
- Self-hosted deployments that must use Chinese model providers (Tongyi, Wenxin, Zhipu, Moonshot) or local models (Ollama)
- AI app teams iterating with prompt version comparison, drafts, and pre-publish debugging in one workspace
What are this agent's strengths and limitations?
- End-to-end coverage of build, debug, publish, and API delivery; published apps integrate directly via POST /api/openapi/chat (REST/SSE)
- Deep thinking mode decomposes complex tasks across multi-step execution and supports concrete outputs (script execution, file generation, attachment export)
- Multi-provider model layer (OpenAI, DeepSeek, Atlas Cloud, Tongyi, Wenxin, Zhipu, Moonshot, Ollama) avoids single-vendor lock-in
- One-command full-stack deployment via Docker Compose (Flask, Celery, Vue 3, Weaviate, PostgreSQL, Redis, Nginx) with automated backend and frontend tests (pytest, npm test:unit)
- Full-stack runtime is resource-heavy: 8 GB+ RAM recommended, and you must operate PostgreSQL, Redis, Weaviate, Celery, and more simultaneously
- Requires at least one model provider API key; running costs depend directly on the chosen models
- Security history: the README records a Host Header poisoning issue and an SSRF vulnerability (responsibly disclosed and fixed), so the self-hosting security boundary needs evaluation before adoption
- MIT-licensed but with limited maturity evidence (no releases, roadmap, or production-scale cases in the README); production adoption requires independent validation
How do you install or deploy this agent?
1) Clone: git clone https://github.com/Haohao-end/openagent.git && cd openagent
2) Create the env file: cp api/.env.example api/.env
3) Set minimum required values in api/.env: JWT_SECRET_KEY, POSTGRES_PASSWORD, REDIS_PASSWORD, WEAVIATE_API_KEY, VITE_API_PREFIX, plus at least one provider key (e.g., OPENAI_API_KEY, ATLASCLOUD_API_KEY, DEEPSEEK_API_KEY, or DASHSCOPE_API_KEY)
4) Start the stack: cd docker && docker compose up -d --build
5) Access: frontend at http://localhost:3000, API at http://localhost:5001, Nginx proxy at http://localhostPrerequisites: Docker 20.10+, Docker Compose 2.x, 8 GB+ RAM recommended.
How do you use this agent?
Local development: backend with cd api && pip install -r requirements.txt && flask run --port 5001; frontend with cd ui && npm install && npm run serve (Vite serves on port 5173 by default; the API base resolves from VITE_API_PREFIX and /api is commonly proxied to Flask). Usage flow: start on the home assistant to chat or describe a new app idea → in the app workspace bind model, prompts, and capabilities (plugins/MCP/Skills/child agents/workflows/datasets), debug on the right panel and inspect deep execution timelines → optionally compose workflows in the visual editor → upload documents into datasets and wire retrieval → publish and invoke via POST /api/openapi/chat (standard or streaming).
How does this agent compare with similar options?
The README frames the project as 'what if OpenAI Deep Research and Dify were one platform': compared with Deep Research, OpenAgent adds visual workflows, dataset management, and OpenAPI publishing; similar to Dify, it offers app orchestration and publishing, but centers on a self-hosted Flask + LangGraph stack with deep reasoning loops.