Phantom Autonomous Co-worker
A persistent AI co-worker that runs, remembers, and evolves on its own machine.
- Source repo
- ghostwright/phantom
- Stars
- ★ 1.5k
- Last updated
- 4mo ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 59/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude Code · Claude APIClaude.ai · OpenAI API (Partial support)
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A software team wants a dedicated VM to post a weekday Slack summary of open pull requests, CI status, and reviews needing attention.
- Not a fit if
- Teams unwilling to give a container root-equivalent Docker daemon access
- Users who need a fully offline setup with no cloud LLM calls
- Casual users who only want to try it on a personal laptop
- Source review
- 59/100 · Major gaps
What does this agent do, and when should you use it?
Phantom is a self-hosted AI co-worker that runs as a Bun process on a dedicated workspace rather than on the user’s computer. It accepts work through Slack, Web Chat, Telegram, Email, Webhook, and CLI, and exposes a Streamable HTTP MCP server for clients such as Claude Code. Its memory system uses Qdrant, Ollama, and three vector-memory collections, while SQLite provides local persistence; it can also create and register MCP tools at runtime. After sessions, its six-step evolution process can propose configuration changes and validate them through five gates, with stored versions available for rollback. The recommended Docker deployment mounts the host Docker socket, making a dedicated VM or isolated host the appropriate deployment boundary.
Phantom assembles base prompts, role configuration, evolved configuration, and memory context, then processes channel requests through the Agent Runtime’s query() and hooks. It writes memory into three Qdrant collections, uses Ollama for embeddings, and can perform workloads such as installing software, starting databases, and building services. The agent can create and register dynamic MCP tools that persist across restarts and are exposed through the Streamable HTTP /mcp endpoint. After a session, the self-evolution engine extracts corrections, preferences, and domain facts; proposes targeted configuration changes; and applies approved changes only after constitution, regression, size, drift, and safety validation gates.
- A software team wants a dedicated VM to post a weekday Slack summary of open pull requests, CI status, and reviews needing attention.
- An engineer wants Claude Code to query a team assistant’s memory, inspect its status, or call dynamic tools through MCP.
- A data team needs an agent-hosted database, dataset loading, dashboard, and REST API, then wants that API registered as an MCP tool.
- An operations team needs scheduled monitoring of websites or open-source repositories, with changes reported to Slack.
- A nontechnical user wants to request a landing page, form, or scheduled report in Slack and receive a shareable authenticated link.
How do you install or deploy this agent?
Recommended Docker setup:
curl -fsSL https://raw.githubusercontent.com/ghostwright/phantom/main/docker-compose.user.yaml -o docker-compose.yaml
curl -fsSL https://raw.githubusercontent.com/ghostwright/phantom/main/.env.example -o .envEdit .env and provide at least ANTHROPIC_API_KEY. For Slack, also provide Slack tokens and OWNER_SLACK_USER_ID. Then run:
docker compose up -dThis starts Qdrant, pulls the Ollama embedding model, and boots the agent. For development, run bun install, start Qdrant and Ollama, run bun run phantom init --yes, set ANTHROPIC_API_KEY, and run bun run phantom start.
How do you use this agent?
After startup, check http://localhost:3100/health. With Slack configured, send Phantom a task; one documented example is: “Create an MCP token for Claude Code.” To connect Claude Code, first run bun run phantom token create --client claude-code --scope operator—or docker exec phantom bun run phantom token create --client claude-code --scope operator in Docker. Then run claude mcp add phantom https://your-phantom.ghostwright.dev/mcp --transport http --header "Authorization: Bearer YOUR_TOKEN". For local deployments, use http://localhost:3100/mcp as the MCP URL.
What are this agent's strengths and limitations?
- Its dedicated-machine model lets the co-worker run services, databases, and containers without placing the agent on the user’s computer.
- It supports Slack, web chat, Telegram, email, webhooks, CLI, and Streamable HTTP MCP as documented interaction boundaries.
- Dynamic MCP tools can be created at runtime, retained across restarts, and used by other MCP clients.
- It documents provider paths for Anthropic, Z.AI, OpenRouter, Ollama, vLLM, LiteLLM, and custom Anthropic Messages API-compatible endpoints.
- Its evolution workflow includes cross-model judging, minority veto, version storage, and rollback.
- The recommended Docker configuration mounts
/var/run/docker.sock; the documentation states that this gives root-equivalent access to the Docker daemon and recommends a dedicated machine or VM. - The documented memory and embedding stack depends on Qdrant and Ollama; development setup also requires Bun, Docker, and model-provider credentials.
- Anthropic is the default model, and safety-critical evolution judging defaults to Sonnet; other backends require YAML configuration plus the relevant credentials or proxy.
- Claude Desktop supports only stdio, so its connection to Phantom’s HTTP MCP service requires the additional
mcp-remotebridge.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Phantom Autonomous Co-worker This agent | 59 · Major gaps | Self-hosted serviceFreemium | ★ 1.5k | 4mo ago | TypeScript | Claude Code · Claude API |
| Agency Orchestrator: One Sentence to Orchestrate an AI Expert Team | 71 · Some gaps | CLIFree + model costs | ★ 2.5k | 5d ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| Dokploy MCP Server | 62 · Some gaps | MCP serverFree | ★ 426 | 1mo ago | TypeScript | Claude Code · Claude.ai |
| OpenSandbox Runtime | 74 · Some gaps | Library / SDKFree | ★ 17k | today | Python | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The security documents disclose full shell and network access plus Docker socket access that is root-equivalent, and recommend a dedicated machine. However, the agent can install software and create tools and infrastructure without asking permission, so least privilege and pre-action confirmation are weak. Credential encryption, hashed tokens, subprocess environment isolation, scoped authentication, and audit logging are described concretely, but security claims are largely documentary and the packet provides no dependency vulnerability handling evidence. Evolution versions can be rolled back, while recovery for ordinary external effects is unclear. Publisher identity and maintenance responsibility are unverified.
The repository describes CI workflows, frozen-lockfile installs, and health checks, but the README test badge says 1819 while its development setup comment says 1584. The security document also describes a web UI login delivery path that differs from other provided material. This limits self-consistency. Startup logs, doctor checks, and troubleshooting steps provide some failure visibility.
The materials address non-engineers, software engineering, sales, analytics, and operations, and describe Slack and Web Chat scenarios. The security document lists permission boundaries, a dangerous-command blocker, and known risks, but the agent retains broad autonomy and its boundaries and confirmation controls are incomplete. Multiple model providers and Docker, local, and VM deployments support varied environments; scenario limits and trigger conditions remain only partly precise.
Documentation is organized around installation, architecture, security, channels, and providers, with command examples, troubleshooting, and an explicit Docker socket warning. The supplied files are truncated, so complete FAQ and limitations coverage cannot be established. Names and CLI version align in the visible files. Apache 2.0 is supported by license text. A version is visible, but no changelog is included in the packet; the security policy gives a reporting address and response targets, while long-term maintenance responsibility is weakly evidenced and the publisher is unverified.
The product combines persistent memory, multi-channel interaction, MCP, and agent-created tools, with concrete examples of shareable outputs, indicating substantial potential value. Outputs can be delivered through chat, email, pages, and MCP. However, broad autonomous build and outbound capabilities increase review and operating burden, and the cost claim is a promotional estimate without a verifiable comparison across models, deployment, and maintenance, so cost-benefit scores low.
Architecture, security, and installation claims map to specific documents, configuration, and source paths; the CI workflow describes automated checks, and the security document identifies implementation locations. However, production stories and test counts are primarily README/CLAUDE.md assertions, with no corroborating story artifacts or test results in the packet. Some security claims also lack corroboration in the supplied implementation files. Fact and inference are not consistently separated, so points are deducted.
- Mounting the Docker socket gives the agent root-equivalent control of the host Docker daemon. Deploy on a dedicated VM and carefully limit the data and credentials it can access.
- The product claims autonomous tool creation, software installation, and message sending. Review its actual access, outbound destinations, and recovery options before use.
- The README and development instructions give different test counts. This was a static review; tests and production stories were not executed or independently verified.
Maintain this project? Add the FARS badge to your README
[](https://followagents.com/en/agents/phantom)<a href="https://followagents.com/en/agents/phantom"><img src="https://followagents.com/badge/phantom.svg" alt="FARS review"></a>FAQ
Does Phantom operate on my personal computer?
Is it limited to Claude?
How does it remember and change over time?
What can Claude Code do through Phantom?
/mcp with a bearer token, Claude Code can query Phantom’s memory, ask it questions, check status, and use dynamic tools that Phantom has created.Thanks — we use this to improve the page.