VCP ToolBox
A self-hosted layer that connects model APIs to persistent memory, distributed plugins, and a unified command protocol.
- Source repo
- lioensky/VCPToolBox
- Stars
- ★ 2.4k
- Last updated
- 1d ago
- License
- NOASSERTION
- Primary language
- JavaScript
- FA score
- 11/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A self-hosting developer who wants to place a persistent-context service between an existing model API and a frontend can use VCP to manage memory and conversation state.
- Not a fit if
- Developers wanting a single SDK, not a Node.js/Python/Rust stack
- Teams that cannot send interaction data to third-party API endpoints
- Source review
- 11/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
VCP, short for Variable & Command Protocol, is self-hosted infrastructure positioned between model APIs and frontend applications for long-running agents. It describes a unified factual timeline, OneRing unified context, RiverMemo Topology V3 memory addressing, and a “wave” semantic-dynamics layer for assembling memory, environmental information, and the active conversation. The project documents six plugin protocol types: synchronous, asynchronous, static, service, message-preprocessing, and hybrid, all with distributed deployment support. It also documents semantic model routing, an Agent-TVS template-variable pipeline, a star-shaped distributed network, and frontend paths including VCPChat, a Vue administration panel, and VCPMobile. Its deployment boundary is a server environment with Node.js, Python dependencies, and optional Docker; the administration panel listens on the main service port plus one.
After node server.js starts the service, VCP uses required API keys from config.env. The repository describes building a temporary semantic index before a conversation so that long-term memory, active tasks, tool permissions, and environmental awareness can be surfaced as needed; RiverMemo Topology V3 runs candidate projection, path geometry, topology auditing, and ranking through a Rust/Rayon core submitted as one asynchronous N-API task. Model access can be protocol-bridged to OpenAI-, Anthropic-, and Gemini-style APIs, while plugins are invoked through a plain-text marker protocol instead of native Function Calling. Management is exposed at /AdminPanel on the main port plus one, and deployment options include the lioensky/vcptoolbox:latest image with docker-compose up -d.
- A self-hosting developer who wants to place a persistent-context service between an existing model API and a frontend can use VCP to manage memory and conversation state.
- A team that wants one agent identity to continue across web, mobile, desktop, or group-chat entry points can evaluate its unified factual timeline and VCPChat path.
- An operations team consolidating remote nodes, model sources, vector sources, and plugins can assess VCP’s documented star topology, transparent cross-server file access, and resilience design.
- A developer using a text-output model without native Function Calling can use the documented plain-text marker protocol for plugin operations.
- A deployer who needs to manage agent variables, memory recall, or model-related settings from a browser can use
/AdminPanelon the service port plus one.
How do you install or deploy this agent?
Prepare Node.js, Python, and network access to a model API. Run:
git clone https://github.com/lioensky/VCPToolBox.git
cd VCPToolBox
npm install
pip install -r requirements.txt
cp config.env.example config.envEdit config.env to add the required API keys, then run node server.js. Alternatively, run docker pull lioensky/vcptoolbox:latest and then docker-compose up -d. The supplied material does not include a copyable first chat/API request; after startup, open http://<server-address>:<main-port+1>/AdminPanel.
How do you use this agent?
Start the main service with node server.js, then open http://<server-address>:<main-port+1>/AdminPanel; for example, a main service on 6005 has an administration panel on 6006. Configure the required config.env values for a model API using a compatible OpenAI, Anthropic, or Gemini format. VCP exposes plugin capability to models through its plain-text marker protocol and recommends VCPChat as a frontend. The supplied README does not document panel configuration steps, request-body fields, or an end-to-end API-call example.
What are this agent's strengths and limitations?
- Its documented plain-text marker protocol does not depend on native model Function Calling, providing a tool path for text-output models.
- It combines persistent memory, context folding, model routing, template variables, distributed nodes, and frontend management rather than documenting only a retrieval or tool layer.
- RiverMemo Topology V3 is described as moving candidate processing and ranking into a Rust/Rayon native core, with one N-API boundary to reduce JavaScript-to-Rust round trips.
- The repository documents both Node.js/Python deployment and Docker deployment, plus compatibility bridges for OpenAI-, Anthropic-, and Gemini-style APIs.
- Deployment requires API keys, and the project explicitly warns against unofficial, mirror, or relay APIs because untrusted endpoints may expose interaction data, memory contents, and keys.
- The runtime spans Node.js, Python, Rust/N-API-related implementation, and optional Docker, creating more operational surface area than a single SDK or hosted service.
- The supplied README does not provide concrete API requests, configuration-field details, resource requirements, cost estimates, or troubleshooting procedures, so initial integration requires the broader documentation set.
- The project describes distributed-system-level permissions and explicitly advises non-specialists to deploy cautiously, so permission boundaries need review before production use.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| VCP ToolBox This agent | 11 · Major gaps | Self-hosted serviceFree + model costs | ★ 2.4k | 1d ago | JavaScript | OpenAI API · Claude API |
| Agents Squads | 73 · Some gaps | CLIFree + model costs | ★ 56 | 16d ago | TypeScript | Claude Code |
| taOS Self-Hosted Agent OS | 71 · Some gaps | Self-hosted serviceFree | ★ 603 | today | Python | Claude Code · OpenAI API · Claude API |
| nanobot | 62 · Some gaps | CLIFree + model costs | ★ 50k | today | Python | OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence: README warns against unofficial APIs and mentions sensitive data leakage risks, but no specific security mechanisms, least privilege, user confirmation, or data flow transparency are provided. Dependency list includes many third-party packages without security audit or vulnerability scanning evidence. External effects (e.g., network operations, file access) are not clearly restricted or require user confirmation. Rollback mechanism not mentioned. Source attribution: author clearly lioensky, but publisher unverified. Deductions: lack of concrete security implementation and permission control evidence.
Evidence: README claims system maturity and stability, but no test results or runtime evidence. Some unit tests exist (e.g., reorderClusters.test.ts) but coverage is limited. Dependency list is complete but no version locking or integrity checks. Failure messages not documented. Deductions: self-consistency based only on documentation, lack of actual verification; dependency availability not locked or mirrored; failure handling not mentioned.
Evidence: README describes multiple usage scenarios (web, mobile, desktop, group chat) and provides installation and configuration instructions. But capability boundaries are not clear, e.g., which operations require permissions or may have impact. Trigger precision not specified, e.g., how to control AI's autonomous behavior. Environment fit: Docker and multiple frontends provided, but system requirements or compatibility limitations not stated. Deductions: capability boundaries and trigger precision lack specific documentation.
Evidence: README provides project overview, installation steps, documentation index, and license (CC BY-NC-SA 4.0). But naming stability not stated; version numbers inconsistent (package.json 1.0.0 vs pyproject.toml 0.1.0). Known limitations not mentioned. Changelog linked externally but not in repo. Maintenance responsibility: author clear, but maintenance policy not stated. Deductions: naming inconsistency, missing known limitations and internal changelog.
Evidence: README describes rich features, but no actual output examples or user feedback. Marginal value: claims persistent existence and memory, but no comparison with alternatives. Cost-benefit: no performance data or resource consumption. Deductions: lack of verifiable output and cost data.
Evidence: README contains many technical claims (e.g., RiverMemo topology V3, Rust kernel), but no verifiable tests or benchmarks. Cross-source corroboration: no third-party verification. Fact-inference separation: document mixes vision and facts without clear distinction. Deductions: all claims lack reproducible evidence.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- The repository claims low-level system permissions but provides no security audit or permission control details; review code carefully before deployment.
- Many dependencies without version locking pose supply chain risks; use lock files and update regularly.
- Technical claims in README (e.g., memory engine, Rust kernel) lack verifiable tests or benchmarks; treat with caution.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.