Weaver Agent Platform
A self-hosted platform for deep research, tool use, browser automation, and sandboxed code execution.
Per-dimension scores and reasoning
The README discloses high-impact capabilities and major flows, including code execution, browser automation, optional desktop control, MCP, external model providers, and search services; the architecture diagram identifies the main components. CI is scoped to contents: read, while SECURITY.md documents private vulnerability reporting, secret rotation, and a lightweight secret scan. Deductions apply because the supplied files do not demonstrate per-tool privilege isolation, user-confirmation gates, request-level disclosure of outbound data, MCP trust boundaries, or authorization controls for desktop operations. Dependencies are only partly pinned, and pip check is present without vulnerability scanning, an SBOM, or demonstrated automated security updates. Cancellation and protocol rollback are referenced but do not establish compensation or recovery for external side effects. Attribution is limited to generic Weaver contributors, with no clearly identified maintainer or concrete private contact.
The README's Python, frontend, OpenAPI, Docker, and testing descriptions broadly align with the workflows and tests. CI performs compilation, pip consistency checking, pytest, frontend lint/build, API type-drift checking, and image construction; middleware tests also cover retry and tool-call limits. Deductions apply because many dependencies use broad lower bounds, optional heavyweight packages remain in the main requirements file, and availability or fallback policies for external APIs and browser services are not shown. No evidence establishes user-facing error classification, retry-exhaustion messages, degraded-mode notices, or recovery guidance. The manual quick test mostly prints observations and does not assert its computed wiring checks if collected by pytest.
The sources identify four routing strategies and a broad set of research, coding, browser, RAG, multimodal, and MCP scenarios. Multiple model providers, local and Docker setups, PostgreSQL support, and an in-memory test checkpointer provide reasonable environment flexibility. Deductions apply because the enterprise positioning and capability boundaries are mainly asserted in the README; the supplied files do not show role-specific configurations, resource ceilings, unsupported cases, or precise tool eligibility rules. Automatic routing and triggers are mentioned, but their predicates, priority handling, ambiguity resolution, and false-trigger safeguards are not evidenced.
Information architecture is strong: the README provides clear navigation for setup, architecture, configuration, usage, deployment, security, APIs, streaming, MCP, benchmarks, and roadmap material. The full MIT text is present and consistent with the metadata. Setup instructions identify runtime versions, commands, ports, and baseline keys, while OpenAPI-to-TypeScript drift checks support contract and naming stability. Deductions apply because the referenced documentation bodies are absent, preventing confirmation of advanced troubleshooting, comprehensive examples, or an FAQ. No explicit known-limitations section, release/version policy, or changelog is supplied. Maintenance ownership remains generic, and the security policy's instruction to email the maintainer does not identify one.
Clickable citations, SSE activity displays, long-code viewing, export-related dependencies, a unified web interface, and selectable execution modes indicate practical output usability. Combining research, sandbox execution, browsing, and MCP offers credible marginal value, and scheduled plus manual benchmark workflows exist. Deductions apply because no benchmark results, representative outputs, user evaluations, or comparative evidence quantify the claimed benefit. The platform may require paid model, search, and sandbox services alongside substantial dependencies, but the supplied material gives no cost, latency, resource-budget, or default-limit analysis.
Architecture, installation, and engineering-process claims can be traced across the README, dependency manifest, workflows, and focused tests. The OpenAPI drift guard and benchmark entry points add cross-file corroboration. Deductions apply because prominent claims such as 62+ tools, enterprise readiness, two-minute setup, live cancellation, multimodality, memory management, and Deep Research quality are not individually linked to implementations, tests, or reports in the supplied evidence. A scheduled benchmark proves intended execution, not benchmark outcomes. The README also does not consistently distinguish implemented, optional, planned, and promotional claims.
- Code execution, browser automation, optional desktop control, and MCP can create external side effects; do not use sensitive or production data until privilege isolation, per-action approval, network egress controls, and auditing are verified.
- The SECURITY.md secret guidance is baseline hygiene rather than evidence of runtime secret management; verify whether secrets can enter prompts, logs, SSE events, tool arguments, or third-party services.
- The dependency surface is large and many packages specify only minimum versions; create reproducible lockfiles, run vulnerability scans, and review Python, Node, container, and GitHub Actions supply-chain exposure before deployment.
- Deployment hardening, MCP security, rollback, and benchmark documents are referenced but not included in the evidence, so their controls and results cannot be assumed.
- Unknown publisher identity is not itself adverse, but the supplied material does not establish maintenance ownership, a concrete private security address, support duration, or an upgrade path.
What does this agent do, and when should you use it?
Weaver is an open-source LangGraph-based agent platform with a FastAPI backend and a Next.js web interface. Its Router selects among direct, web, agent, and deep execution strategies, while a tool registry connects workflows to a code sandbox, browser automation, and third-party tools through MCP. Deep Research performs parallel retrieval and iterative investigation, returning citations that users can inspect in the UI. Execution is streamed over SSE with tool activity views and dedicated handling for long code output; the platform also lists cancellation, memory management, and multimodal interaction. It can be run locally and has documentation for Docker and Compose deployment, but search-enabled operation requires model-provider configuration and a Tavily API key.
A task submitted through the Next.js Web UI reaches the FastAPI API and Router, which selects Direct, Web Search, Agent Tools, or Deep Research. Agent and Deep Research workflows call the Tool Registry, which can connect to E2B Sandbox, Browser Automation, and an MCP Bridge; documented tool areas include code execution, browser control, file and document generation, and optional desktop control. Deep Research runs parallel searches and multiple refinement rounds, then produces cited results with evidence that can be opened from the UI. The backend emits SSE events while the frontend displays tool activity and long code output with search, fullscreen viewing, and virtual scrolling. An OpenAPI-based generation workflow produces TypeScript types for the frontend and SDK to reduce contract drift.
- Engineering teams that need a research assistant on infrastructure they control can use Weaver for parallel retrieval, iterative analysis, and inspectable citations.
- Application developers building long-running coding workflows can reuse its FastAPI API, SSE event stream, and E2B sandbox integration.
- QA or operations teams that need automated interaction with websites can configure its browser automation path.
- Enterprise platform teams with internal services can expose additional capabilities through the Tool Registry and MCP Bridge.
- Teams using OpenAI, Anthropic, or a DeepSeek-compatible configuration can connect their chosen model service to one self-hosted interface.
- Full-stack teams concerned about backend and client contract drift can use its OpenAPI-to-TypeScript type generation workflow.
What are this agent's strengths and limitations?
- A single Router covers direct responses, web search, tool-using agents, and multi-stage deep research.
- Deep Research explicitly combines parallel retrieval, iterative investigation, and clickable citation evidence.
- The tool layer spans sandboxed code execution, browser automation, file and document generation, and MCP-based extension.
- SSE streaming, task cancellation, and a tool activity panel are useful for observable, long-running workflows.
- OpenAPI-to-TypeScript generation provides a concrete mechanism for keeping backend, frontend, and SDK contracts aligned.
- Documented OpenAI, Anthropic, and DeepSeek-compatible configuration paths avoid dependence on one model provider.
- The quick start requires both a model-provider credential and a Tavily API key, potentially adding external-service cost and network dependency.
- Operating the full stack involves a Python backend, a Next.js frontend, pnpm, and several optional integrations, making it more complex than a single-process agent.
- E2B, Playwright, MCP, and Docker Compose require setup beyond the commands included in the quick start.
- The supplied material contains no measured throughput, latency, resource usage, or production-scale benchmark results.
- Desktop control is described as optional, but supported operating systems, permissions, and isolation boundaries are not specified.
How do you install or deploy this agent?
Prepare Python 3.11+, pnpm, and network access to the selected model provider and Tavily. Run:
git clone https://github.com/skygazer42/weaver.git
cd weaver
cp .env.example .env
cp web/.env.local.example web/.env.local
make setup
pnpm -C web install --frozen-lockfileIn the root .env, provide OPENAI_API_KEY, or use ANTHROPIC_API_KEY or a DeepSeek-compatible configuration. Also provide TAVILY_API_KEY. Start the backend and frontend with:
.venv/bin/python main.py
pnpm -C web devKeep the two processes running separately.
How do you use this agent?
After startup, open http://localhost:3100 and submit a task through the web interface. The API is available at http://localhost:8001 by default, and its OpenAPI documentation is at http://localhost:8001/docs; the backend port can be changed with PORT in the root .env. The Router selects direct, web, agent, or deep mode, and execution progress and tool activity arrive over SSE. Code execution, Playwright, MCP, and Docker Compose require their additional documented setup; the supplied quick-start section does not include complete configuration commands for those optional paths.
How does this agent compare with similar options?
The repository description positions its multi-agent configuration as Manus-like. Compared with a single-path chat application, Weaver emphasizes configurable agent workflows, a tool registry, code execution, and deep research; the supplied material does not provide a feature-by-feature, performance, or cost comparison with Manus.
FAQ
Which credentials are required?
OPENAI_API_KEY, or alternatively ANTHROPIC_API_KEY or a DeepSeek-compatible configuration, plus TAVILY_API_KEY.