Swarm Orchestrator
A command-line coding agent that must prove its work with evidence: restricted edits, sealed gates from real project checks, and tamper-evident signed evidence records.
- Source repo
- moonrunnerkc/swarm-orchestrator
- Stars
- ★ 111
- Last updated
- today
- License
- ISC
- Primary language
- TypeScript
- FA score
- 78/100 · Good
At a glance
- Works with
- Universal · cross-platform
- You'll need
- Typical use
- Restricted edits in git repositories via a command-line coding agent
- Main limitation
- No sandboxed execution by default (path policy only)
- Source review
- 78/100 · Good
What does this agent do, and when should you use it?
Swarm Orchestrator is a command-line coding agent for git repositories: you describe changes in natural language, and local or hosted models edit the working tree. It runs the project's own checks as unbypassable sealed gates and produces tamper-evident signed evidence records. Sandbox isolation is not enabled by default (path policy only unless --isolation is passed). The published 14.4.0 release predates the docs, so a source build is required.
Takes natural-language change descriptions, edits the git working tree with local (Ollama) or hosted models, and verifies the work with real project checks and signed evidence.
- Restricted edits in git repositories via a command-line coding agent
- Automated coding tasks requiring verifiable, tamper-evident evidence of work
How do you install or deploy this agent?
No current npm release is available; published 14.4.0 predates the docs and a source build is required. Requires Node.js 22+ (24 recommended), git, and Ollama for local models.
How do you use this agent?
Describe changes in natural language on the command line; pass --isolation if sandboxed execution is needed.
What are this agent's strengths and limitations?
- Proves work with evidence
- Restricted edits sealed by real project checks
- Tamper-evident signed evidence records
- Supports local models and is free
- No sandboxed execution by default (path policy only)
- Source build required; no current npm release
- Experimental tool with documented accuracy limits
How does this agent compare with similar options?
Unlike typical coding agents, it emphasizes verifiability and tamper-evident evidence records, with local model support.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Swarm Orchestrator This agent | 78 · Good | — | ★ 111 | today | TypeScript | — |
| Dexto | 51 · Major gaps | CLIFree + model costs | ★ 657 | 2d ago | TypeScript | Claude Code · OpenAI API · Claude API |
| Late | 50 · Major gaps | CLIFree + model costs | ★ 448 | 6d ago | Go | OpenAI API |
| DeepTide - AI Coding Agent by DeepSeek | 44 · Major gaps | CLIFree + model costs | ★ 1.1k | 2mo ago | Rust | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows a path policy, a denied-path list, one-time confirmation of unlisted commands, signed hash-chained evidence bundles, and fail-safe secret scrubbing. Deductions are explicit in the files: default mode is a lexical path policy, not a sandbox (git config --list and node -e attacks still succeed), the scrub path had two real defects (now fixed), and 328 orphaned processes were measured and remain unsolved.
Outcome blocks define clear exit codes and next steps; CI runs gates and packaged checks on Node 22/24 across two OSes. Deductions: scrub/verify consistency is runtime behavior not provable statically, and self-reported eval success is very low (one of six launches).
Boundary claims are unusually honest (anti-tampering may refuse a needed refactor, model-written checks cannot establish a requirement alone, experimental). Environment fit is evidenced (Node 22/24, macOS case-insensitivity fix, Docker browser runtime). Deduction: trigger precision and scenario coverage rest on very small eval blocks (three tasks, two samples).
Information architecture, a fully reproducible scratch-repo example, a limitations section, and ISC licensing are full-mark quality. Deductions: the npm-published 14.4.0 predates the page so source build is required; CHANGELOG is listed in files but its content is not shown; maintenance rests on one contact email and a single-maintainer repo with no update commitments.
Output usability is strong (outcome first line, scope line, bundle path, offline verify.mjs). Deductions: the README itself concedes no general advantage over OpenCode on the latest eval block at ~1.7x wall time, so marginal value and cost-benefit are only ordinary.
security-coverage.md is exemplary auditable documentation: every claim names tool, version, scope and evidence, and it separates verified from unverified (CROSSFIRE's structural blind spots, items needing human review). Deduction: external corroboration is largely self-built fixtures and evals; no independent third-party review is evidenced.
- Default host mode is a lexical path policy, not a sandbox: git config --list and node -e still bypass the deny list; use --isolation in sensitive environments.
- Orphaned processes after command exit are unsolved (328 measured); long suites may exhaust resources.
- The npm-published release lags the source; build from source per the README.
- The project self-describes as experimental; eval blocks are tiny and show no general advantage over OpenCode.
- Publisher identity is unverified by the FollowAgents registry; evaluate credential exposure yourself.
- Regex-safety fixes (1) and (3) still lack regression tests (acknowledged in the docs).