Phantom Autonomous Co-worker
A persistent AI co-worker that runs, remembers, and evolves on its own machine.
- Source repo
- ghostwright/phantom
- Stars
- ★ 1.5k
- Last updated
- 3mo ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 49/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformClaude Code · Claude APIClaude.ai · OpenAI API (Partial support)
- You'll need
- Typical use
- A software team wants a dedicated VM to post a weekday Slack summary of open pull requests, CI status, and reviews needing attention.
- Main limitation
- The recommended Docker configuration mounts
/var/run/docker.sock; the documentation states that this gives root-equivalent access to the Docker daemon and recommends a dedicated machine or VM. - Source review
- 49/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
Phantom is a self-hosted AI co-worker that runs as a Bun process on a dedicated workspace rather than on the user’s computer. It accepts work through Slack, Web Chat, Telegram, Email, Webhook, and CLI, and exposes a Streamable HTTP MCP server for clients such as Claude Code. Its memory system uses Qdrant, Ollama, and three vector-memory collections, while SQLite provides local persistence; it can also create and register MCP tools at runtime. After sessions, its six-step evolution process can propose configuration changes and validate them through five gates, with stored versions available for rollback. The recommended Docker deployment mounts the host Docker socket, making a dedicated VM or isolated host the appropriate deployment boundary.
Phantom assembles base prompts, role configuration, evolved configuration, and memory context, then processes channel requests through the Agent Runtime’s query() and hooks. It writes memory into three Qdrant collections, uses Ollama for embeddings, and can perform workloads such as installing software, starting databases, and building services. The agent can create and register dynamic MCP tools that persist across restarts and are exposed through the Streamable HTTP /mcp endpoint. After a session, the self-evolution engine extracts corrections, preferences, and domain facts; proposes targeted configuration changes; and applies approved changes only after constitution, regression, size, drift, and safety validation gates.
- A software team wants a dedicated VM to post a weekday Slack summary of open pull requests, CI status, and reviews needing attention.
- An engineer wants Claude Code to query a team assistant’s memory, inspect its status, or call dynamic tools through MCP.
- A data team needs an agent-hosted database, dataset loading, dashboard, and REST API, then wants that API registered as an MCP tool.
- An operations team needs scheduled monitoring of websites or open-source repositories, with changes reported to Slack.
- A nontechnical user wants to request a landing page, form, or scheduled report in Slack and receive a shareable authenticated link.
How do you install or deploy this agent?
Recommended Docker setup:
curl -fsSL https://raw.githubusercontent.com/ghostwright/phantom/main/docker-compose.user.yaml -o docker-compose.yaml
curl -fsSL https://raw.githubusercontent.com/ghostwright/phantom/main/.env.example -o .envEdit .env and provide at least ANTHROPIC_API_KEY. For Slack, also provide Slack tokens and OWNER_SLACK_USER_ID. Then run:
docker compose up -dThis starts Qdrant, pulls the Ollama embedding model, and boots the agent. For development, run bun install, start Qdrant and Ollama, run bun run phantom init --yes, set ANTHROPIC_API_KEY, and run bun run phantom start.
How do you use this agent?
After startup, check http://localhost:3100/health. With Slack configured, send Phantom a task; one documented example is: “Create an MCP token for Claude Code.” To connect Claude Code, first run bun run phantom token create --client claude-code --scope operator—or docker exec phantom bun run phantom token create --client claude-code --scope operator in Docker. Then run claude mcp add phantom https://your-phantom.ghostwright.dev/mcp --transport http --header "Authorization: Bearer YOUR_TOKEN". For local deployments, use http://localhost:3100/mcp as the MCP URL.
What are this agent's strengths and limitations?
- Its dedicated-machine model lets the co-worker run services, databases, and containers without placing the agent on the user’s computer.
- It supports Slack, web chat, Telegram, email, webhooks, CLI, and Streamable HTTP MCP as documented interaction boundaries.
- Dynamic MCP tools can be created at runtime, retained across restarts, and used by other MCP clients.
- It documents provider paths for Anthropic, Z.AI, OpenRouter, Ollama, vLLM, LiteLLM, and custom Anthropic Messages API-compatible endpoints.
- Its evolution workflow includes cross-model judging, minority veto, version storage, and rollback.
- The recommended Docker configuration mounts
/var/run/docker.sock; the documentation states that this gives root-equivalent access to the Docker daemon and recommends a dedicated machine or VM. - The documented memory and embedding stack depends on Qdrant and Ollama; development setup also requires Bun, Docker, and model-provider credentials.
- Anthropic is the default model, and safety-critical evolution judging defaults to Sonnet; other backends require YAML configuration plus the relevant credentials or proxy.
- Claude Desktop supports only stdio, so its connection to Phantom’s HTTP MCP service requires the additional
mcp-remotebridge.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Phantom Autonomous Co-worker This agent | 49 · Major gaps | ★ 1.5k | 3mo ago | TypeScript | Claude Code · Claude API |
| Dokploy MCP Server | 65 · Some gaps | ★ 383 | 5d ago | TypeScript | Claude Code · Claude.ai |
| Agency Orchestrator: One Sentence to Orchestrate an AI Expert Team | 61 · Some gaps | ★ 2.3k | 1d ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| Stakpak | 57 · Major gaps | ★ 1.8k | 2mo ago | Rust | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README and SECURITY.md describe AES-256-GCM encryption, subprocess environment isolation, non-root container, MCP authentication, and evolution safety gates. But user confirmation mechanisms (e.g., permission prompts) are absent, data flow transparency is limited, and external effects (e.g., Docker socket mount) are documented but high-risk. Deductions: missing user confirmation, insufficient data flow transparency, external effects risk not fully mitigated.
Evidence shows: README claims 1819 tests passed, CI config includes lint, typecheck, tests, and migration safety checks. But dependency versions are not pinned (using ^), and failure messages are not detailed. Deductions: dependency availability unverified, failure messages unclear.
Evidence shows: README describes multiple use cases (non-programmers, software engineering, sales, etc.) and provides multiple model providers and deployment options. But trigger precision (e.g., command parsing) is not detailed, and environment fit (e.g., Docker, VM) is documented but not verified. Deductions: insufficient trigger precision, environment fit not fully verified.
Evidence shows: README is well-structured, includes installation notes, examples, known limitations (e.g., Docker socket risk), and Apache-2.0 license. But version changelog is missing, and maintenance responsibility is unclear (unverified publisher). Deductions: missing version changelog, unclear maintenance responsibility.
Evidence shows: README provides rich use cases and output examples (e.g., dashboards, APIs), claims cost-effectiveness ($7-20/month). But lacks independent verification, marginal value may be overstated. Deductions: output usability unverified, cost-benefit claims lack evidence.
Evidence shows: Claims in README (e.g., test count, production stories) lack traceable links or independent verification. Deductions: insufficient claim traceability, missing cross-source corroboration, facts and inferences not clearly separated.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Docker socket mount provides root-level access, a serious security risk; run only on dedicated VMs.
- Self-evolution may be influenced by adversarial inputs; despite safety gates, long-term behavior changes remain a risk.
- Publisher identity unverified, dependency versions not pinned, supply chain risk needs attention.
FAQ
Does Phantom operate on my personal computer?
Is it limited to Claude?
How does it remember and change over time?
What can Claude Code do through Phantom?
/mcp with a bearer token, Claude Code can query Phantom’s memory, ask it questions, check status, and use dynamic tools that Phantom has created.