Agent2 — An autonomous AI agent for coding, cybersecurity, terminal automation, and intelligent task execution.
Unlocks once the catalog security scan passes (runs nightly).
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
# Add to your Claude Code skills
git clone https://github.com/aaravshah1311/Agent-2Guides for using ai agents skills like Agent-2.
Agent-2 runs on your machine, talks to Google Gemini with your own API keys, and keeps
every byte of state in one agent2.db beside the code. No account, no service, no telemetry,
no build step.
It ships in three surfaces that are not three applications. They share the system prompt, the tool dispatcher, the memory and rules tables, the diff engine, the command watchdog, the model router and the database. Switching from the terminal to a browser tab changes what you look at and nothing about what the agent can do.
| Surface | Entry point | What it is |
|---|---|---|
| ⚡ CLI (default) | agent2cli.py |
Rich + prompt_toolkit terminal UI — ephemeral menus, inline diffs, a full-screen diff viewer, a live command watchdog |
| 🌐 Web UI | agent2web.py |
Flask + Socket.IO at http://localhost:1311 — streaming tool calls, multi-tab terminals, memory/rules/keys/MCP panels |
| 🔀 Dual | agent2dual.py |
Web server on a background thread, CLI in the foreground. One process, one agent2.db, both surfaces live |
git clone https://github.com/aaravshah1311/Agent-2.git
cd Agent-2
python run.py # creates .venv, installs deps, prompts for a Gemini API key
run.py is the universal launcher and the package manifest — the dependency tables live
there and nowhere else.
python run.py --cli # CLI (default)
python run.py --web # web server
python run.py --dual # both at once
python run.py --addapi # manage Gemini API keys
python run.py --update # pull latest (preserves agent2.db)
python run.py --reset # wipe .venv and reinstall
python run.py --uninstall # remove venv, DB, global command
python run.py --docker # Docker runtime + global `agent2` command
After the first run a global agent2 command exists: agent2 (CLI), agent2 web,
agent2 dual, plus the Docker subcommands stop | restart | logs | status | update | uninstall.
Direct entry, skipping the launcher: .venv/bin/python agent2cli.py
(Windows: .venv\Scripts\python agent2cli.py).
Requires Python 3.9+. Get a free Gemini API key at aistudio.google.com/apikey.
Everything below is shared. That is the point of the architecture, and it is enforced by a rule the codebase applies everywhere: each fact has exactly one home, because a second copy drifts silently — each surface still looks right on its own.
| Thing | Its one home |
|---|---|
| Models, modes, shell detection | config.py |
| API key rotation | llm.keys.rotator |
| SQLite access | database.py (qall / qone / exe / exemany / batch()) |
memories writes |
core.memory |
| Diff computation and totals | core/diffs.py |
| An ephemeral CLI menu | cli/palette.py |
| Whether a web request may proceed | server/auth.decide() |
| Whether an identity may do X | core.permissions |
| What a model can do | llm/capabilities.get() |
| Which model runs a turn | llm/router.rank_candidates() |
| Which MCP servers exist | integrations/registry.py |
| What reaches the model, in what order | core.broker.ORDER |
Core (12) — run_command, read_file, write_file, multi_edit_files, list_dir,
grep_search, delete_file, scan_project, web_search, update_todo, save_memory,
emit_plan
File Intelligence (5) — detect_file, file_capabilities, run_file_op,
convert_file, search_workspace — router-dispatched shims into agent2.fileintel, so
backends are chosen internally.
Sixteen of them go through tools.dispatch_tool. run_command alone goes through
terminal.stream_command, which is why the exec capability gate is implemented twice on
purpose — and why the CLI's copy sits outside the retry loop: a refusal must not become an
allow on retry.
When an MCP bridge is connected its tools are added dynamically and force-prefixed
(burp_, zap_). Ownership is membership, not prefix: registry.resolve() asks each
bridge whether it actually holds a name, so a disconnected ZAP stops claiming zap_* instead
of swallowing the call.
The tool capability gate returns a tool
error, never an exception. The model reads errors and adapts; an exception would end the turn.
| Key | API id | Group |
|---|---|---|
2.5-flash (default) |
gemini-2.5-flash |
2.5 |
2.5-flash-lite |
gemini-2.5-flash-lite |
2.5 |
3.5-flash |
gemini-3.5-flash |
3.5 |
3.5-flash-lite |
gemini-3.5-flash-lite |
3.5 |
3.6-flash |
gemini-3.6-flash |
3.6 |
3.7-flash |
gemini-3.7-flash |
3.7 |
| Mode | Max output tokens | Thinking budget |
|---|---|---|
fast |
2 048 | — |
pro (default) |
8 192 | — |
thinking |
16 384 | 8 000 |
config.MODELS and config.MODES are the only declaration of either, and two tests
guard each direction.
⚠️ THINKING_GROUPS is the empty tuple, so every group supports thinking.
supports_thinking() reads True if not THINKING_GROUPS else group in THINKING_GROUPS —
empty means no group is excluded, not no group qualifies. The thinking mode description
string still names specific groups; that string is the stale half. Never re-derive the answer
from a model key: the predicate takes a group precisely so a new model joins an existing
group and inherits the answer for free.
Routing is opt-in and explicit selection always wins. Both surfaces send a model key every
turn, so a router that ran unasked could not tell a choice from a default. auto is a
user-selectable pseudo-key — deliberately not in config.MODELS, which is the list of things
that can be called. AGENT2_MODEL_ROUTING widens it to default_only or always.
A mid-turn failure is a continue in the existing loop, not a restart: context, tokens, tool
context, checkpoints and the cancel token all survive, because restarting would replay
completed tool calls. The hop budget is per turn, not per model.
Any OpenAI- or Anthropic-compatible endpoint (base URL + key + model id + format) appears in
the selector as custom:<id>. llm/provider_agent.py mirrors agent.py exactly — same tools,
same Socket.IO events, stdlib urllib only.
| Subsystem | What it does | Owner |
|---|---|---|
| Context broker | Assembles what reaches the model each turn, in one declared order, with per-source caps. Memory and rules are in ALWAYS and can never be squeezed out |
core/broker/ |
| Git awareness | Branch, dirty state and repo facts, cached 15 s. Every function is total; a timed-out git yields an empty snapshot, never an exception |
core/gitstate.py |
| Memory & rules | Persistent facts and standing instructions, injected into every system prompt through a versioned cache | core/memory/, core/rules.py |
| Diffs | Computed before the write. Green added, red removed, grey context, and yellow is the paired count | core/diffs.py |
| The Ctrl+B viewer | The whole session in one full-screen surface. Opening it writes nothing; r is the one destructive key and takes two presses |
cli/diffview.py |
| Ephemeral menus | One Application, one Window, capped to the terminal and erased when done |
cli/palette.py |
| Command execution | Three registries — handles, execution state, pipe I/O — plus a watchdog that reports and never kills by default | core/commands.py, core/procio.py |
| Cancellation | Ctrl+C stops the command, not the session. Record, then kill — that order is load-bearing | cli/state.py, terminal.py |
| Tasks & recovery | Checkpointed long work that never re-runs what already finished | core/tasks.py, core/recovery.py |
| Scheduling | Bounded worker pool. submit() returns queued / disabled / rejected, each with a required response |
core/scheduler.py |
| Cross-process sync | notify() publishes in-process synchronously; SyncPoller republishes what another process changed |
core/sync.py |
| Personal Intelligence | Fully offline prediction, opt-in grammar, opt-in prompt enrichment. No network, no retraining | core/pil/ |
| File Intelligence | Detect, convert and operate on real file formats |
Agent-2 is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by aaravshah1311. Agent2 — An autonomous AI agent for coding, cybersecurity, terminal automation, and intelligent task execution. It has 65 GitHub stars.
Agent-2's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
Clone the repository with "git clone https://github.com/aaravshah1311/Agent-2" and add it to your Claude Code skills directory (see the Installation section above).
Agent-2 is primarily written in Python. It is open-source under aaravshah1311 on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh Agent-2 against similar tools.
No comments yet. Be the first to share your thoughts!