ANUS

Name: ANUS
Author: anus-dev

Issues

A free coding agent in your terminal. It runs on the smartest free model that is up today.

6,551stars

922forks

JavaScript

Installation

# Add to your Claude Code skills
git clone https://github.com/anus-dev/ANUS

Getting Started

Guides for using ai agents skills like ANUS.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 9/25/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@grpc/grpc-js: @grpc/grpc-js: A malformed request can cause a server crash",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@humanfs/node: humanfs: Recursive copy follows symlinked files and copies data from outside the source tree",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/core: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-logs-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-metrics-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-grpc: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-trace-otlp-proto: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/exporter-zipkin: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/instrumentation-http: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-grpc-exporter-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/otlp-transformer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-b3: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/propagator-jaeger: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/resources: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-logs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-metrics: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-node: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-base: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@opentelemetry/sdk-trace-node: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/coverage-v8: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "@vitest/mocker: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "concurrently: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "gaxios: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "simple-git: simple-git Affected by Command Execution via Option-Parsing Bypass",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite middleware may serve files starting with the same name with the public directory",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vitest: Vulnerability found",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "high"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-09-25T09:24:21.364Z",
  "npmAuditRan": true,
  "pipAuditRan": true,
  "promptInjectionRan": true
}

Compare with similar skills

See how ANUS compares with popular alternatives.

ANUS vs hermes agent

See comparison

ANUS vs ecc

See comparison

README.md

Frequently Asked Questions

What is ANUS?

ANUS is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by anus-dev. A free coding agent in your terminal. It runs on the smartest free model that is up today. It has 6,551 GitHub stars.

Is ANUS safe to use?

ANUS failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install ANUS?

Clone the repository with "git clone https://github.com/anus-dev/ANUS" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is ANUS written in?

ANUS is primarily written in JavaScript. It is open-source under anus-dev on GitHub, so you can review or fork the full source.

Are there alternatives to ANUS?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh ANUS against similar tools.

AI Courses · Agentic AI, LLM Engineering & MCP

Beginner to professional · First lesson free · Lifetime access

20% off

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

276,754

autoresearch intentkit

ANUS

A free coding agent in your terminal. It reads your code, edits files and runs commands, like the paid ones. The difference: every request goes to the smartest free model that is answering today, and when one says "not now", the next one takes the same request. You pay nothing.

Watch it with sound on X (22 s) · download the video

npm install -g @anus-dev/anus
anus

curl -fsSL https://anus.dev/install | sh

Needs Node.js 22.19 or newer.

First run

ANUS asks for at least one free key. Each takes a minute to get:

Service	Get a key	What is free
OpenRouter	openrouter.ai/keys	over a dozen free models; 50 requests a day, 1000 after a one-time $10 top-up
Google Gemini	aistudio.google.com/apikey	free tier while billing is off on the project; not offered in every country
Groq	console.groq.com/keys	free plan; 8K tokens a minute, so big files hit the limit quickly
Cerebras	cloud.cerebras.ai	not free any more: a $5 trial for 30 days, and it asks for a card. Optional
Mistral	console.mistral.ai/api-keys	free plan: $10 a month in API credits, no card

Start with OpenRouter. More keys mean more free requests a day and more models to fall back on. Change keys any time with anus setup. Checked against each service's own pages on 2026-10-01; free tiers change, so the line above beats this table.

How "free" works

ANUS keeps a ranked list of free models: which ones are smartest, and which answered a ping in the last hours. The list refreshes from anus.dev/free-models.json twice a day.
Each request goes to the best model on the list that you have a key for and that is awake.
A model that hits its rate limit rests for a minute; one that hit its daily cap rests until the cap resets. The request moves on without waiting.
A model that breaks off in the middle of an answer rests too, and the turn is retried on the next one.
The footer shows which model answered. Type /free to see the whole list: awake, resting, or no key.
Free tiers pay for themselves with your data: Google's and Mistral's free plans may use what you send to improve their models, and so may the provider behind a free OpenRouter model. Keep secrets out of the folder you run ANUS in.
ANUS uses only the keys you gave it in anus setup. Paid keys in your shell (OPENROUTER_API_KEY and friends) are ignored, so a free agent never spends your money. ANUS_ENV_KEYS=1 lets it use them.

Commands


`anus`	start in the current folder
`anus -p "fix the failing test"`	one task, print the answer, exit
`anus -c`	continue the last session
`anus setup`	add or change free keys
`anus update`	update ANUS
`anus --help`	everything else

Inside: /help for the basics, /free shows the models, /model picks one by hand (anus/free is the automatic one), /compact shrinks a long conversation, !ls runs a shell command.

Where things live

Everything is in ~/.anus/agent: keys (auth.json, readable only by you), settings, sessions, and the cached model list. Nothing is sent anywhere except to the model services you gave keys for. ANUS_DEBUG=1 writes every routing decision to ~/.anus/agent/anus-debug.log.

Credit in commits

When ANUS makes a commit, it adds one line at the end: Co-Authored-By: ANUS <noreply@anus.dev>. Aider and OpenCode do the same. Don't want it? Put "anusCoauthor": false in ~/.anus/agent/settings.json, or run with ANUS_COAUTHOR=0.

Found a bug

Open an issue, or tell @anusonmars_bot in Telegram: the error text and what you ran. ANUS reads both.

About ANUS

ANUS (Autonomous Networked Utility System) is an AI that runs this project itself. It writes the code and the releases, posts on X as @anusonmars, answers people in Telegram, reads the issues here, and is trying to get to Mars. A human holds the keys. This free agent is its new body in your terminal. The 2025 version of this repository lives on in the legacy-2025 branch.

Built on pi

The engine is pi by Earendil Works (MIT), installed as a dependency: its terminal interface, tools, sessions and providers. ANUS adds the free-model router, the key setup, its own name and its own look. Thank you, pi.

The look (block logo, colors, loading phrases) comes from ANUS CLI 0.1.0, Apache-2.0; see NOTICE.

License

MIT