CodePilot

Name: CodePilot
Author: op7418

Issues

A multi-model AI agent desktop client — connect any AI provider, extend with MCP & skills, control from your phone. Built with Electron + Next.js.

5,825stars

629forks

TypeScript

Added 2/8/2026

View on GitHub Download ZIP

AI Agentsaianthropicclaudeclaude-codedesktop-app

Installation

# Add to your Claude Code skills
git clone https://github.com/op7418/CodePilot

Getting Started

Guides for using ai agents skills like CodePilot.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 4/19/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@anthropic-ai/claude-agent-sdk: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@chevrotain/cst-dts-gen: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@chevrotain/gast: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@larksuiteoapi/node-sdk: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "chevrotain: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "chevrotain-allstar: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dagre-d3-es: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "electron: Electron: Context Isolation bypass via contextBridge VideoFrame transfer",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono missing validation of cookie name on write path in setCookie()",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "langium: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash-es: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mermaid: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "next: Next.js has a Denial of Service with Server Components",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "wait-on: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-04-19T06:01:11.303Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

194,955

deepchat XcodeBuildMCP

CodePilot

A multi-model AI agent desktop client -- connect any AI provider, extend with MCP & skills, control from your phone, and let your assistant learn your workflow.

中文文档 | 日本語

🚧 Project Refactor Notice / 项目重构公告

EN: CodePilot is undergoing a larger product refactor before the next release. We are rebuilding the runtime/session foundation, background resident tasks and local notifications, scheduled AI work, Markdown/Artifact previews, and local agent adapters such as Codex. Existing releases remain available; the next versions will focus on making these foundations stable and useful.

中文： CodePilot 正在进行一次较大的产品重构，为下一轮正式发布整理底层能力。重点包括会话级 Runtime、后台常驻任务与本机通知、定时提醒和后台 AI 任务、Markdown / Artifact 预览稳定性，以及 Codex 等本地 Agent 适配。现有版本仍可下载使用；接下来的版本会优先把这些基础能力做稳、做好用。

CodePilot

Download | Quick Start | Documentation | Contributing | Community

Download

| Platform | Download | Architecture | |---|---|---| | macOS | Apple Silicon (.dmg) · Intel (.dmg) | arm64 / x64 | | Windows | Installer (.exe) | x64 + arm64 | | Linux | AppImage · .deb · .rpm | x64 + arm64 |

Or visit the Releases page for all versions.

Why CodePilot

Multi-provider, one interface

Connect to 17+ AI providers out of the box. Switch providers and models mid-conversation without losing context.

| Category | Providers | |---|---| | Direct API | Anthropic, OpenRouter | | Cloud platforms | AWS Bedrock, Google Vertex AI | | Chinese AI providers | Zhipu GLM (CN/Global), Kimi, Moonshot, MiniMax (CN/Global), Volcengine Ark (Doubao), Xiaomi MiMo, Aliyun Bailian (Qwen) | | Local & self-hosted | Ollama, LiteLLM | | Custom | Any Anthropic-compatible or OpenAI-compatible endpoint | | Media | Google Gemini (image generation) |

Beyond coding — a full AI agent

CodePilot started as a coding tool but has grown into a general-purpose AI agent desktop:

Assistant Workspace — Persona files, persistent memory, onboarding flows, and daily check-ins. Your assistant learns your preferences and adapts over time.
Generative UI — AI can create interactive dashboards, charts, and visual widgets rendered live in-app.
Remote Bridge — Connect to Telegram, Feishu, Discord, QQ, and WeChat. Send messages from your phone, get responses on your desktop.
MCP + Skills — Add MCP servers (stdio / sse / http) with runtime monitoring. Define reusable skills or install from the skills.sh marketplace.
Media Studio — AI image generation with batch tasks, gallery, and tagging.
Task Scheduler — Schedule recurring tasks with cron expressions or intervals.

Built for daily use

Pause, resume, and rewind sessions to any checkpoint
Split-screen dual sessions side by side
Track token usage and costs with daily charts
Import Claude Code CLI session history
Dark / Light theme toggle
English + Chinese interface

Quick Start

Path A: Download a release (most users)

Download the installer for your platform from the Download section above
Launch CodePilot
Configure a Provider in Settings > Providers — add your API key for any supported provider
Start a conversation

Note: Installing the Claude Code CLI (npm install -g @anthropic-ai/claude-code) unlocks additional capabilities like direct file editing, terminal commands, and git operations. It is recommended but not required for basic chat.

Path B: Build from source (developers)

| Prerequisite | Minimum version | |---|---| | Node.js | 18+ | | npm | 9+ (ships with Node 18) |

git clone https://github.com/op7418/CodePilot.git
cd CodePilot
npm install
npm run dev              # browser mode at http://localhost:3000
# -- or --
npm run electron:dev     # full desktop app

Core Capabilities

Conversation & Interaction

| Capability | Details | |---|---| | Interaction modes | Code / Plan / Ask | | Reasoning effort | Low / Medium / High / Max + Thinking mode | | Permission control | Default / Full Access, per-action approval | | Session control | Pause, resume, rewind to checkpoint, archive | | Model switching | Change model mid-conversation | | Split screen | Side-by-side dual sessions | | Attachments | Files and images with multimodal vision support | | Slash commands | /help /clear /cost /compact /doctor /review and more |

Extensions & Integrations

| Capability | Details | |---|---| | Providers | 17+ providers: Anthropic, OpenRouter, Bedrock, Vertex, Zhipu GLM, Kimi, Moonshot, MiniMax, Volcengine, MiMo, Bailian, Ollama, LiteLLM, custom endpoints | | MCP servers | stdio / sse / http, runtime status monitoring | | Skills | Custom / project / global skills, skills.sh marketplace | | Bridge | Telegram / Feishu / Discord / QQ / WeChat remote control | | CLI import | Import Claude Code CLI .jsonl session history | | Image generation | Gemini image gen, batch tasks, gallery |

Data & Workspace

| Capability | Details | |---|---| | Assistant Workspace | Persona files (soul.md, user.md, claude.md, memory.md), onboarding, daily check-ins, persistent memory | | Generative UI | AI-created interactive dashboards and visual widgets | | File browser | Project file tree with syntax-highlighted preview | | Git panel | Status, branches, commits, worktree management | | Usage analytics | Token counts, cost estimates, daily usage charts | | Task scheduler | Cron-based and interval scheduling with persistence | | Local storage | SQLite (WAL mode), all data stays on your machine | | i18n | English + Chinese | | Themes | Dark / Light, one-click toggle |

First Launch

Configure a Provider — Go to Settings > Providers and add credentials for the provider you want to use. CodePilot includes presets for all major providers — just pick one and enter your API key.
Create a conversation — Pick a working directory, select a mode (Code / Plan / Ask), and choose a model.
Set up Assistant Workspace (optional) — Go to Settings > Assistant, choose a workspace directory, and enable Onboarding. CodePilot creates soul.md, user.md, claude.md, and memory.md at the workspace root.
Add MCP servers (optional) — Go to the MCP page in the sidebar to add and manage MCP servers. Custom skills are managed on the separate Skills page.
Install Claude Code CLI (optional) — For advanced features like file editing and terminal commands, install the CLI: npm install -g @anthropic-ai/claude-code

Platform & Installation Notes

macOS builds are code-signed with a Developer ID certificate but not notarized, so Gatekeeper may still prompt on first launch. Windows and Linux builds are unsigned.

Option 1 -- Right-click CodePilot.app in Finder > Open > confirm.

Option 2 -- System Settings > Privacy & Security > scroll to Security > click Open Anyway.

Option 3 -- Run in Terminal:

xattr -cr /Applications/CodePilot.app

Option 1 -- Click "More info" on the SmartScreen dialog, then "Run anyway".

Option 2 -- Settings > Apps > Advanced app settings > set App Install Control to allow apps from anywhere.

Documentation

📖 Full documentation: English | 中文

Getting started:

Quick Start -- Download or build from source
First Launch -- Provider setup, workspace configuration
Installation Guide -- Detailed setup instructions

User guides:

Providers -- Configuring AI providers and custom endpoints
MCP Servers -- Adding and managing Model Context Protocol servers
Skills -- Custom skills, project skills, and the skills.sh marketplace
Bridge -- Remote control via Telegram, Feishu, Discord, QQ, WeChat
Assistant Workspace -- Persona files, onboarding, memory, daily check-ins
FAQ -- Common issues and solutions

Developer docs:

ARCHITECTURE.md -- Architecture, tech stack, directory structure, data flow
docs/handover/ -- Design decisions and handover documents
docs/exec-plans/ -- Execution plans and tech debt tracker