by sirquy
Local-first AI action assistant for operators: memory, skills, tools, and permission gates to turn work into controlled action.
# Add to your Claude Code skills
git clone https://github.com/sirquy/bestieLast scanned: 8/5/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiter",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-08-05T06:27:30.649Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}bestie is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by sirquy. Local-first AI action assistant for operators: memory, skills, tools, and permission gates to turn work into controlled action. It has 109 GitHub stars.
bestie returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/sirquy/bestie" and add it to your Claude Code skills directory (see the Installation section above).
bestie is primarily written in TypeScript. It is open-source under sirquy on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh bestie against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Bestie is a self-hosted, local-first AI companion runtime with a Vietnamese-first character, local memory, provider diagnostics, Telegram/Zalo channels, skills, update checks, a localhost Web UI, and a safety-first permission model.
The project is active and practical: the shipped npm CLI/runtime is designed to be inspected, configured, and run locally by its owner.
bestie ui for chat, diagnostics, providers, character, memory, knowledge graph, channels, approvals, MCP, tools, skills, and settings.Bestie is not conscious, human, a therapist replacement, a romantic companion, or a promise of perfect memory. It should not be used as a replacement for professional mental health, legal, medical, or financial advice.
The local MVP foundation is implemented and includes:
bestie ui, with responsive layout, PWA install support, modal confirmations, toast notifications, and update banner.300000ms.telegram, zalo, cron, workforce, ui, or all, with duplicate-process cleanup safeguards.bestie agents management commands.~/.bestie/skills, plus an official remote GitHub skill registry (sirquy/bestie-skills) with verification, cache, preview, diff, install/update, rollback, enable/disable, and uninstall flows.bestie update and throttled update notices for new npm versions.Still intentionally later: hosted/SaaS mode, public marketplace, avatar/body layer, optional Zep, broad autonomous external actions, unrestricted MCP execution, Bestie manager routing, and general multi-agent collaboration beyond the fixed-role Agent Workforce.
ffmpeg, and media provider keys for channel/media featuresnpm ci
npm run build
npm run dev -- onboard
npm run dev -- doctor
npm run dev -- chat
npm run dev -- ui
For a local user install:
./install.sh --skip-onboard
bestie onboard
bestie doctor
bestie chat
bestie ui
For npm install:
npm install -g bestie-agent
bestie onboard
bestie doctor
bestie chat
bestie ui
Useful runtime commands:
bestie status
bestie doctor
bestie ui
bestie ui --port 8717
bestie ui --port 0 --no-open
bestie ui auth reset
bestie ui tunnel setup
bestie ui tunnel status
bestie ui tunnel start
bestie ui tunnel stop
bestie agents hire --id researcher --name Mika --role "Research Assistant" --description "Research and summarize information"
bestie agents assign --agent researcher --title "Market brief" --brief "Summarize this week"
bestie agents list
bestie agents tasks --agent researcher
bestie agents run --agent researcher --limit 1
bestie agents run --watch --interval-ms 30000
bestie channels telegram setup
bestie channels telegram
bestie channels zalo
bestie daemon status --channel all
bestie daemon restart --channel telegram
bestie daemon restart --channel zalo
bestie daemon restart --channel cron
bestie daemon restart --channel workforce
bestie service install
bestie service status
bestie cron list
bestie mcp list
bestie mcp add demo --url https://mcp.example.com/mcp
bestie mcp login demo
bestie skills
bestie update
bestie update --apply
Shared voice helpers:
bestie voice setup-local
bestie voice setup-elevenlabs
bestie voice setup-voicebox
bestie voice models
bestie voice download-model small
bestie voice download-model small --confirm --use
voice is channel-neutral: Telegram, Zalo, Web UI, and future channels should reuse the same top-level speech/transcription config. Use only bestie voice ... for voice setup; channel commands should consume the shared config rather than expose voice setup aliases. setup-local configures local whisper.cpp transcription when the local binary, model, and ffmpeg are present. setup-elevenlabs configures ElevenLabs speech replies and stores only the API key environment value in ~/.bestie/.env. setup-voicebox configures local Voicebox speech and transcription at http://127.0.0.1:17493 by default. models lists local .bin models and marks the configured one; download-model previews by default and downloads only with --confirm.
During bestie channels telegram setup, leave the owner prompt blank to detect the owner from the latest message sent to the bot. You can also run bestie channels telegram whoami after messaging the bot to print the numeric id and username.
Human-facing CLI commands print a built-in Bestie Agent ASCII banner. In an interactive terminal the banner animates briefly; piped output uses the static banner. Set BESTIE_NO_BANNER=1 to hide it, or BESTIE_BANNER=static to keep it still. JSON modes such as bestie doctor --json suppress the banner automatically.
Bestie uses colored badges, tables, and short progress indicators for human output. Set NO_COLOR=1 to disable ANSI colors. Raw and machine-readable commands stay script-friendly.
Bestie keeps local runtime files under ~/.bestie/ by default. Secrets belong in ~/.bestie/.env; config files store environment variable names, not secret values.
Example ~/.bestie/.env:
OPENAI_API_KEY=your-openai-key
ANTHROPIC_API_KEY=your-claude-key
GEMINI_API_KEY=your-gemini-key
OPENROUTER_API_KEY=your-openrouter-key
QUOTACHEAP_API_KEY=your-quotacheap-key
BESTIE_TELEGRAM_BOT_TOKEN=your-telegram-token
Example provider config:
{
"llm": {
"primary": "openai/gpt-4o-mini",
"fallbacks": ["anthropic/claude-sonnet-4-5"],
"authProfile": "openai:api-key",
"timeoutMs": 300000,
"profiles": {
"openai:api-key": {
"provider": "openai",
"mode": "api-key",
"baseUrl": "https://api.openai.com/v1",
"apiKeyEnv": "OPENAI_API_KEY"
},
"anthropic:api-key": {
"provider": "anthropic",
"mode": "api-key",
"baseUrl": "https://api.anthropic.com/v1",
"apiKeyEnv": "ANTHROPIC_API_KEY"
},
"gemini:api-key": {
"provider": "gemini",
"mode": "api-key",
"apiKeyEnv": "GEMINI_API_KEY"
}
},
"modelCatalog": {
"openai/gpt-4o-mini": { "profile": "openai:api-key" },
"anthropic/claude-sonnet-4-5": { "profile": "anthropic:api-key" },
"gemini/gemini-2.5-flash": { "profile": "gemini:api-key" }
}
}
}
Model refs use provider/model. Profiles hold endpoint and auth metadata; secrets live in .env through apiKeyEnv. HTTP providers store baseUrl; native Gemini API-key profiles intentionally omit baseUrl; local Ollama profiles use mode: "local" and do not need an API key. Gemini CLI, Claude CLI, and Codex CLI profiles use provider: "gemini-cli", provider: "claude-cli", or provider: "codex-cli", mode: "local", no baseUrl, and reuse the user's local CLI login/config as middleware.
Run bestie llm providers to list supported providers, bestie llm models --provider gemini to inspect built-in refs, bestie llm setup --provider gemini-cli --set-default, bestie llm setup --provider claude-cli --set-default, or bestie llm setup --provider codex-cli --set-default to route Bestie through a local CLI, bestie llm setup to configure another provider, bestie llm test --model provider/model to test without switching primary, and bestie llm fallbacks list|add|remove to manage fallback order.
See docs/CONFIG_SPEC.md for full config details, including llm.image, workspace.externalPaths, internalTools.exec.timeoutMs, skills.registry, channels, MCP, transcription, and speech.
Run the local console with:
bestie ui
By default it binds to 127.0.0.1. Use bestie ui --no-open for terminal-only sessions, bestie ui --port 8717 for a fixed port, or bestie ui --port 0 --no-open for smoke-friendly dynamic ports. The current CLI prints the local URL; automatic browser ope