CodePilot
by op7418
A multi-model AI agent desktop client — connect any AI provider, extend with MCP & skills, control from your phone. Built with Electron + Next.js.
6,497stars
700forks
TypeScript
Added 2/8/2026
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Installation
# Add to your Claude Code skills
git clone https://github.com/op7418/CodePilotGetting Started
Guides for using ai agents skills like CodePilot.
- Caveman: Cut Claude Token Use by 65%How agent-side prompt compression works, when to use it, and when not to.
- What is an AI Skills Marketplace?Definitions, how marketplaces work, and how to choose between them in 2026.
- Getting Started with AI SkillsFirst-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.
Security ReportIssues
Last scanned: 4/19/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@anthropic-ai/claude-agent-sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@chevrotain/cst-dts-gen: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@chevrotain/gast: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@larksuiteoapi/node-sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "chevrotain: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "chevrotain-allstar: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dagre-d3-es: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "electron: Electron: Context Isolation bypass via contextBridge VideoFrame transfer",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "langium: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "mermaid: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "next: Next.js has a Denial of Service with Server Components",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "wait-on: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-04-19T06:01:11.303Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}Compare with similar skills
See how CodePilot compares with popular alternatives.
CodePilot
A multi-model AI agent desktop client -- connect any AI provider, extend with MCP & skills, control from your phone, and let your assistant learn your workflow.
| Skills and extensions | Connect AI services |
|---|---|
 |
 |
Download | Quick Start | Documentation | Contributing | Community
Download
| Platform | Download | Architecture |
|---|---|---|
| macOS | Apple Silicon (.dmg) · Intel (.dmg) | arm64 / x64 |
| Windows | Installer (.exe) | x64 |
| Linux | AppImage / deb / rpm | x64 / arm64 |
Official macOS stable builds can check, download, and install signed updates in the app. After manually installing the first supported Windows version, later Windows releases can update in the app using unsigned packages from the official GitHub Release; Linux releases remain manual downloads.
Or visit the Releases page for all versions.
Why CodePilot
Multi-provider, one interface
Connect to 17+ AI providers out of the box. Switch providers and models mid-conversation without losing context.
| Category | Providers |
|---|---|
| Direct API | Anthropic, OpenRouter |
| Cloud platforms | AWS Bedrock, Google Vertex AI |
| Chinese AI providers | Zhipu GLM (CN/Global), Kimi, Moonshot, MiniMax (CN/Global), Volcengine Ark (Doubao), Xiaomi MiMo, Aliyun Bailian (Qwen) |
| Local & self-hosted | Ollama, LiteLLM |
| Custom | Any Anthropic-compatible or OpenAI-compatible endpoint |
| Media | Google Gemini (image generation) |
Beyond coding — a full AI agent
CodePilot started as a coding tool but has grown into a general-purpose AI agent desktop:
- Assistant Workspace — Persona files, persistent memory, onboarding flows, and daily check-ins. Your assistant learns your preferences and adapts over time.
- Generative UI — AI can create interactive dashboards, charts, and visual widgets rendered live in-app.
- Remote Bridge — Connect to Telegram, Feishu, Discord, QQ, and WeChat. Send messages from your phone, get responses on your desktop.
- MCP + Skills — Add MCP servers (stdio / sse / http) with runtime monitoring. Define reusable skills or install from the skills.sh marketplace.
- Media Studio — AI image generation with batch tasks, gallery, and tagging.
- Task Scheduler — Schedule recurring tasks with cron expressions or intervals.
Built for daily use
- Pause, resume, and rewind sessions to any checkpoint
- Split-screen dual sessions side by side
- Track token usage and costs with daily charts
- Import Claude Code CLI session history
- Dark / Light theme toggle
- English + Chinese interface
Quick Start
Path A: Download a release (most users)
- Download the installer for your platform from the Download section above
- Launch CodePilot
- Configure a Provider in Settings > Providers — add your API key for any supported provider
- Start a conversation
Note: Installing the Claude Code CLI (
npm install -g @anthropic-ai/claude-code) unlocks additional capabilities like direct file editing, terminal commands, and git operations. It is recommended but not required for basic chat.
Path B: Build from source (developers)
| Prerequisite | Minimum version |
|---|---|
| Node.js | 18+ |
| npm | 9+ (ships with Node 18) |
git clone https://github.com/op7418/CodePilot.git
cd CodePilot
npm install
npm run dev # browser mode at http://localhost:3000
# -- or --
npm run electron:dev # full desktop app
Core Capabilities
Conversation & Interaction
| Capability | Details |
|---|---|
| Interaction modes | Code / Plan / Ask |
| Reasoning effort | Low / Medium / High / Max + Thinking mode |
| Permission control | Default / Full Access, per-action approval |
| Session control | Pause, resume, rewind to checkpoint, archive |
| Model switching | Change model mid-conversation |
| Split screen | Side-by-side dual sessions |
| Attachments | Files and images with multimodal vision support |
| Slash commands | /help /clear /cost /compact /doctor /review and more |
Extensions & Integrations
| Capability | Details |
|---|---|
| Providers | 17+ providers: Anthropic, OpenRouter, Bedrock, Vertex, Zhipu GLM, Kimi, Moonshot, MiniMax, Volcengine, MiMo, Bailian, Ollama, LiteLLM, custom endpoints |
| MCP servers | stdio / sse / http, runtime status monitoring |
| Skills | Custom / project / global skills, skills.sh marketplace |
| Bridge | Telegram / Feishu / Discord / QQ / WeChat remote control |
| CLI import | Import Claude Code CLI .jsonl session history |
| Image generation | Gemini image gen, batch tasks, gallery |
Data & Workspace
| Capability | Details |
|---|---|
| Assistant Workspace | Persona files (soul.md, user.md, claude.md, memory.md), onboarding, daily check-ins, persistent memory |
| Generative UI | AI-created interactive dashboards and visual widgets |
| File browser | Project file tree with syntax-highlighted preview |
| Git panel | Status, branches, commits, worktree management |
| Usage analytics | Token counts, cost estimates, daily usage charts |
| Task scheduler | Cron-based and interval scheduling with persistence |
| Local storage | SQLite (WAL mode), all data stays on your machine |
| i18n | English + Chinese |
| Themes | Dark / Light, one-click toggle |
First Launch
- Configure a Provider — Go to Settings > Providers and add credentials for the provider you want to use. CodePilot includes presets for all major providers — just pick one and enter your API key.
- Create a conversation — Pick a working directory, select a mode (Code / Plan / Ask), and choose a model.
- Set up Assistant Workspace (optional) — Go to Settings > Assistant, choose a workspace directory, and enable Onboarding. CodePilot creates
soul.md,user.md,claude.md, andmemory.mdat the workspace root. - Add MCP servers (optional) — Go to the MCP page in the sidebar to add and manage MCP servers. Custom skills are managed on the separate Skills page.
- Install Claude Code CLI (optional) — For advanced features like file editing and terminal commands, install the CLI:
npm install -g @anthropic-ai/claude-code
Platform & Installation Notes
macOS stable builds are signed with Developer ID, notarized, stapled, and verified by Gatekeeper. If macOS reports that the developer cannot be verified or the file is damaged, stop and report it instead of bypassing the warning. Windows builds are unsigned and may show SmartScreen. After manually installing the first Windows updater-capable release, later stable versions can update in-app from the official op7418/CodePilot GitHub Release; the app verifies the metadata SHA-512 but does not claim independent Authenticode publisher verification. Linux updates remain manual.
- Delete the rejected copy and download it again from the official GitHub Release.
- Verify the file against
SHA256SUMS.txtfrom the same Release. - If Gatekeeper still rejects it, do not remove quarantine attributes or bypass the warning; report the macOS version, download URL, and checksum on GitHub Issues.
Verify the installer against SHA256SUMS.txt from the same official Release first. If the checksum matches and the source is op7418/CodePilot, click "More info", then "Run anyway". If organization policy removes that option, contact the device administrator instead of weakening system-wide protection.
Documentation
📖 Full documentation: English | 中文
Getting started:
- Quick Start -- Download or build from source
- First Launch -- Provider setup, workspace configuration
- Installation Guide -- Detailed setup instructions
User guides:
- Providers -- Configuring AI providers and custom endpoints
- MCP Servers -- Adding and managing Model Context Protocol servers
- Skills -- Custom skills, project skills, and the skills.sh marketplace
- Bridge -- Remote control via Telegram, Feishu, Discord, QQ, WeChat
- [Assistant Workspace](https://www.codepilot.sh/docs/assis
Frequently Asked Questions
What is CodePilot?
CodePilot is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by op7418. A multi-model AI agent desktop client — connect any AI provider, extend with MCP & skills, control from your phone. Built with Electron + Next.js. It has 6,497 GitHub stars.
Is CodePilot safe to use?
CodePilot failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
How do I install CodePilot?
Clone the repository with "git clone https://github.com/op7418/CodePilot" and add it to your Claude Code skills directory (see the Installation section above).
What programming language is CodePilot written in?
CodePilot is primarily written in TypeScript. It is open-source under op7418 on GitHub, so you can review or fork the full source.
Are there alternatives to CodePilot?
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh CodePilot against similar tools.
Comments (0)
to leave a comment.
No comments yet. Be the first to share your thoughts!
Related Skills
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
276,163
41,206
JavaScript
AI Agentsai-agentsanthropic
Skills for Real Engineers. Straight from my .agents directory.
250,518
21,171
Shell
AI Agents
An agentic skills framework & software development methodology that works.
234,966
20,863
Shell
AI Agentsaibrainstorming
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
206,873
61,040
TypeScript
MCP Serversaiapis