octo-agent

SECURITY.md gives an unusually explicit single-user threat model: loopback exemption, 256-bit access key with constant-time compare, Origin/Host checks, SameSite=Strict cookie. However the default posture enables shell, file, MCP and sub-agents out of the box, with least privilege resting on an optional sandbox and a hard-coded deny list, so least_privilege is only 1. restart_server requires explicit confirmation, catastrophic commands are hard-coded denies, and deletes/overwrites go to a recycle bin first, supporting user_confirmation=2 and rollback=2. Data-flow transparency claims zero telemetry with a single opt-out version check, but this is README self-assertion without code corroboration, hence 2. Sensitive data handling is deducted: SECURITY.md itself states agent-written HTML shares the app origin and can read the access key, and public Light Apps plus /_artifacts/ token URLs are reachable without the key, a real risk, hence 1. Dependency security shows only a go.mod version list with no vulnerability scanning or SBOM evidence, hence 1. External effects include curl|sh install, self-upgrade (SHA-256 verified but unsigned) and outbound IM channels, hence 1. Source attribution is explicit in the Prior Art section crediting Claude Code and OpenClacky, hence 2.

The layered architecture, eight-interface description and CI workflows (go vet/gofmt/build/test -race plus a separate desktop build) are mutually consistent, self_consistency=2. Dependency availability has pinned versions and a go mod tidy check in CI, but no go.sum or vendor evidence is supplied, so supply-chain reproducibility cannot be statically confirmed, hence 1. Failure messages are only visible as CI comments and SECURITY.md troubleshooting notes; runtime error messaging has no evidence, hence 1.

Audience and scenarios are well covered: coding agent plus personal assistant, eight entry points, multi-provider protocols, hence 2. Capability boundaries are clearly stated in SECURITY.md's 'not defended' list (hostile local processes, plaintext transport, same-origin pages), hence 2. Trigger precision is thin: CLI one-shot, TUI, IM channels and cron coexist, but there is no precise rule set for when tools or sub-agents fire, hence 1. Environment fit covers Linux/macOS/Windows, mirror fallback, Go install and multi-arch desktop CI, hence 2.

README is well structured with layered navigation to external docs, information_architecture=2. Install notes cover multiple platforms, mirrors, desktop installers and Go install, install_notes=2. Naming stability is deducted for inconsistent octo/octo-agent/Octo usage and a version claim of '1.0 stable' without a versioning policy, hence 1. Examples and FAQ are limited to a few command snippets with no FAQ, hence 1. Known limitations are disclosed well (unsigned installers, mobile preview, Linux AppImage not run-tested), hence 2. LICENSE.txt is the full MIT text, license=3. Versioning/changelog is absent beyond the 1.0 mention, hence 1. Maintenance responsibility is thin: the publisher is unverified and only a personal email and GitHub advisory channel are given, hence 1.

Output usability is adequate for ordinary use via TUI/CLI/Web/IM and single-binary distribution, hence 2. Marginal value comes from single binary, multi-model support, zero telemetry and the recycle-bin safety net, which differentiates it, but 'on par with Claude Code' claims lack benchmark evidence, hence 2. Cost benefit rests on self-reported 99%+ cache hit rates and ~40MB size with no measurements, and the desktop app adds GTK4/WebKitGTK deployment cost, hence 1.

claim_traceability is 1: performance, cache hit rates and size comparisons have no in-repo data or benchmarks. cross_source_corroboration is 1: README and SECURITY.md corroborate the security boundary, but CI and code files provide no cross-evidence for functional claims. fact_inference_separation is 2: SECURITY.md explicitly separates defended from undefended areas and README labels mobile as developer preview, keeping fact and inference reasonably distinct.