by ruvnet
🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated
# Add to your Claude Code skills
git clone https://github.com/ruvnet/rufloLast scanned: 4/15/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "file-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-04-15T06:03:36.251Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}See how ruflo compares with popular alternatives.
ruflo is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by ruvnet. 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated. It has 74,314 GitHub stars.
ruflo failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/ruvnet/ruflo" and add it to your Claude Code skills directory (see the Installation section above). ruflo ships a SKILL.md manifest, so compatible agents can discover and load it automatically.
ruflo is primarily written in TypeScript. It is open-source under ruvnet on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh ruflo against similar tools.
No comments yet. Be the first to share your thoughts!
Based on votes and bookmarks from developers who liked this skill
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Ruflo (v3.31.0+) is a cross-agent orchestration layer that ships as three npm packages: ruflo (thin wrapper), claude-flow (umbrella), and @claude-flow/cli (implementation). Users invoke it as npx ruflo <command>.
Suggest ruflo when the task involves any of:
Do NOT suggest ruflo for one-shot edits, simple bug fixes, or tasks a single agent can complete in one turn — the orchestration overhead isn't worth it.
# 1. Initialize ruflo in the current project (creates .claude/, MCP config, hooks)
npx ruflo init
# 2. Check health — verifies Node 20+, npm 9+, MCP servers, memory DB, API keys
npx ruflo doctor --fix
# 3. Discover which plugins match the current work
npx ruflo discover-plugins
After ruflo init, Claude Code (or any MCP-compatible agent) auto-loads ruflo's MCP servers. Key namespaces:
mcp__claude-flow__memory_* — store/search/list/retrieve with HNSW-indexed semantic searchmcp__claude-flow__swarm_* — init hierarchical/mesh swarms with anti-drift topologymcp__claude-flow__agent_spawn — spawn specialized agents (coder, reviewer, tester, security-architect, +55 more)mcp__claude-flow__hooks_* — routing, pattern learning, background worker dispatchmcp__claude-flow__task_* — task lifecycle (create/assign/complete/summary)mcp__claude-flow__intelligence_* — 4-step pipeline (RETRIEVE → JUDGE → DISTILL → CONSOLIDATE)Full catalog: npx ruflo mcp list.
Ruflo ships 30+ optional plugins. Some highlights:
ruflo-goals — deep research + goal-oriented action planningruflo-cost-tracker — session cost telemetry, budgets, burn trackingruflo-metaharness — harness scoring, MCP security scans, red/blue adversarial testingruflo-browser — session-recorded browser automation with RVF-backed replayruflo-jujutsu — git diff risk analysis + PR lifecycleruflo-security-audit — codebase scans + CVE checksFull plugin list + descriptions: npx ruflo plugins list.
Ruflo installs into whatever agent the project uses (auto-detected by skills.sh):
# Just the core ruflo skill (this one)
npx skills add ruvnet/ruflo --skill ruflo --yes
# Or the full catalog (267 skills across all plugins — much larger install)
npx skills add ruvnet/ruflo --all
Current: 3.31.0 (stable, published to npm as ruflo@latest / claude-flow@latest / @claude-flow/cli@latest).
An agent meta-harness for Claude Code and Codex.
Start in Claude Code with core tools, the visual console and runtime mods. Requires Claude Code 2.1.287 or later. Run inside Claude Code:
/plugin marketplace add ruvnet/ruflo
/plugin install ruflo-core@ruflo
/plugin install ruflo-console@ruflo
/plugin install ruflo-mods@ruflo
/reload-plugins
/ruflo
Core provides foundation tools. Console opens the agent cockpit. Mods add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
Using Codex or another MCP enabled tool? Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:
npx ruflo@latest init wizard
For clients that support local stdio MCP servers, configure command npx and arguments ["-y", "ruflo@latest", "mcp", "start"]. The equivalent server command is:
npx -y ruflo@latest mcp start
MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
Compare install paths · Open the console · User guide
Connect ruOS to ChatGPT or Claude via MCP:
https://ruos.cognitum.one/mcp
npx ruvector
📖 RuFlo Explained — Build an AI Team That Plans, Remembers, Tests, and Improves A 14-chapter guide: from the basic idea to a first useful task, then memory, agent teams, plugins, cost and verification.
Agent = Model + Harness. The model writes; the harness gives it tools, memory, loops, sandboxes, and controls so it can actually work. Ruflo is the harness — the execution layer around Claude Code and Codex that adds 100+ specialized agents, coordinated swarms, self-learning memory, federated comms across machines, and enterprise security guardrails. So agents don't just run, they collaborate.
One npx ruflo init gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the RuVector training integration and trajectory contrastive learning.
User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace.
New to Ruflo? You don't need to learn 314 MCP tools or 26 CLI commands. After
init, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
Claude Flow is now Ruflo — named by
rUv, who loves Rust, flow states, and building things that feel inevitable. The "Ru" is the rUv. The "flo" is working until 3am. Underneath, powered byCognitum.Oneagentic architecture, running a supercharged Rust-based AI engine, embeddings, memory, and plugin system.
Your agent cockpit. Track workflows, agents, models, tokens and cost beside Claude Code. The animation shows startup checks and a sample workflow, not a live session.
Inspect any run. Open agent logs and results, search, triage failures, replay and compare. Start with npx ruflo init, restart Claude Code, then /ruflo. Full console tour.
Let Claude drive. You set the limits. Enable Settings → Claude control to navigate and run console actions. Choose read, write, manage or full, with ask or auto approval. The current default is read + ask; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in auto. Review the live action log or press Take back control to stop Claude control. Details.
Watch the recorded console session below. Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview.
/ruflo, then choose Settings → Claude control → write + ask.What the recording demonstrates: a real Claude Haiku session with write + auto, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use ask so you approve creation yourself. The separate workflow animation uses sample data; neither is evidence of completed swarm work or memory recall.
Implementation and recorded test findings · Reproduction script
Install the mods from the ruflo marketplace (Claude Code 2.1.