{"id":"gptme.org/gptme","name":"gptme","commands":["gptme"],"examples":[{"run":"gptme","does":"Start an interactive chat with tool use"},{"run":"gptme '<task>'","does":"Start a session with a prompt"},{"run":"gptme -n '<task>'","does":"Run fully non-interactively, for scripts and CI"},{"run":"gptme -r","does":"Resume the most recent conversation"}],"description":"Terminal agent with local tools that writes code, runs shell commands and browses the web.","homepage":"https://gptme.org","repository":"https://github.com/gptme/gptme","license":"MIT","agentic":true,"latest_version":"0.36.0","vendor":"gptme (Erik Bjareholt)","install":"curl -sSf https://gptme.ai/install.sh | sh","publisher":"third-party","w3bs":"w3bs install gptme.org/gptme","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":1752,"summary":{"critical":0,"high":10,"medium":48,"low":28,"info":0},"malware":0,"truncated":false,"version":"0.36.0","sources":{"installer":"https://gptme.ai/install.sh","installerSha256":"5f44df78bf160bc1d291d78b3482530f2154a68147897f75bf972945c27fd5c4","repository":"github.com/gptme/gptme","commit":"7a656435f2a56dac98500a3c3559f344546038b5"},"notes":[],"scannedAt":"2026-11-05T12:03:44.778Z","findings":[{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/cli/doctor.py","line":933,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/cli/doctor.py","line":1368,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/eval/suites/practical.py","line":222,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/mcp/registry.py","line":76,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/server/api_v2.py","line":244,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/server/api_v2.py","line":1109,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/tools/restart.py","line":236,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/gptme/util/export.py","line":61,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/scripts/check_model_freshness.py","line":128,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/scripts/verify_cloudflare_pages_deep_links.py","line":46,"malware":false},{"ruleId":"insecure-temp-file","title":"predictable temporary file path","severity":"medium","category":"code","cwe":"CWE-377","file":"source/.github/workflows/self-heal.yml","line":141,"malware":false},{"ruleId":"insecure-temp-file","title":"predictable temporary file path","severity":"medium","category":"code","cwe":"CWE-377","file":"source/.github/workflows/self-heal.yml","line":303,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/cli/main.py","line":1757,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/eval/dspy/prompt_optimizer.py","line":361,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"medium","category":"code","cwe":"CWE-327","file":"source/gptme/eval/run.py","line":650,"malware":false},{"ruleId":"py-unsafe-deserialization","title":"deserialisation of untrusted data","severity":"medium","category":"code","cwe":"CWE-502","file":"source/gptme/lessons/parser.py","line":349,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/mcp/client.py","line":179,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/api_v2_agents.py","line":92,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"medium","category":"code","cwe":"CWE-327","file":"source/gptme/server/api_v2.py","line":740,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"medium","category":"code","cwe":"CWE-327","file":"source/gptme/server/api_v2.py","line":759,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/api_v2.py","line":2844,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"medium","category":"code","cwe":"CWE-327","file":"source/gptme/server/artifacts_api.py","line":197,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/client.py","line":291,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/tools_api.py","line":337,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/tools_api.py","line":354,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":352,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":357,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":441,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":474,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":535,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":538,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":625,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":630,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":692,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/server/workspace_api.py","line":697,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/tools/convert.py","line":1085,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/tools/mcp_adapter.py","line":1237,"malware":false},{"ruleId":"py-unsafe-deserialization","title":"deserialisation of untrusted data","severity":"medium","category":"code","cwe":"CWE-502","file":"source/gptme/tools/python_kernel.py","line":262,"malware":false},{"ruleId":"py-stack-trace-returned","title":"stack trace returned to the caller","severity":"medium","category":"code","cwe":"CWE-209","file":"source/gptme/tools/subagent/batch.py","line":176,"malware":false},{"ruleId":"tpl-vue-v-html","title":"`v-html` binding","severity":"medium","category":"code","cwe":"CWE-79","file":"source/gptme/util/export_templates/index.html","line":138,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/gptme/util/export_templates/main.js","line":532,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/scripts/computer_home/mutter_startup.sh","line":5,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/scripts/computer_home/novnc_startup.sh","line":11,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/scripts/computer_home/tint2_startup.sh","line":5,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/scripts/computer_home/x11vnc_startup.sh","line":9,"malware":false},{"ruleId":"sh-predictable-temp-path","title":"predictable temporary file","severity":"medium","category":"code","cwe":"CWE-377","file":"source/scripts/computer_home/x11vnc_startup.sh","line":31,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"medium","category":"code","cwe":"CWE-327","file":"source/scripts/treeofthoughts.py","line":145,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/site/next/src/client.ts","line":12,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/components/CodeDisplay.tsx","line":74,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/components/TabbedCodeBlock.tsx","line":90,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/webui/src/utils/consoleProxy.ts","line":61,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/markdownRenderer.ts","line":131,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/markdownRenderer.ts","line":154,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/markdownRenderer.ts","line":180,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/markdownRenderer.ts","line":214,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/markdownRenderer.ts","line":279,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/webui/src/utils/navigation.ts","line":8,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/webui/src/utils/taskApi.ts","line":229,"malware":false},{"ruleId":"insecure-temp-file","title":"predictable temporary file path","severity":"low","category":"code","cwe":"CWE-377","file":"source/docs/releases/v0.32.0.md","line":1211,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/gptme/eval/suites/practical9.py","line":178,"malware":false},{"ruleId":"py-shell-command-string","title":"shell command built from a string","severity":"low","category":"code","cwe":"CWE-78","file":"source/gptme/eval/swe_extra/swe_bench_test_spec.py","line":137,"malware":false},{"ruleId":"py-shell-command-string","title":"shell command built from a string","severity":"low","category":"code","cwe":"CWE-78","file":"source/gptme/eval/swe_extra/swe_bench_test_spec.py","line":147,"malware":false},{"ruleId":"py-shell-command-string","title":"shell command built from a string","severity":"low","category":"code","cwe":"CWE-78","file":"source/gptme/eval/swe_extra/swe_bench_test_spec.py","line":157,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/site/next/scripts/check-assets.test.mjs","line":77,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/tauri/src-tauri/src/lib.rs","line":1191,"malware":false},{"ruleId":"insecure-temp-file","title":"predictable temporary file path","severity":"low","category":"code","cwe":"CWE-377","file":"source/tests/test_cli.py","line":1500,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"low","category":"code","cwe":"CWE-327","file":"source/tests/test_eval.py","line":1264,"malware":false},{"ruleId":"py-weak-hash","title":"broken hash algorithm","severity":"low","category":"code","cwe":"CWE-327","file":"source/tests/test_eval.py","line":1265,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"low","category":"code","cwe":"CWE-918","file":"source/tests/test_server_bad_input.py","line":82,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"low","category":"code","cwe":"CWE-918","file":"source/tests/test_server_bad_input.py","line":199,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"low","category":"code","cwe":"CWE-918","file":"source/tests/test_server_bad_input.py","line":278,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"low","category":"code","cwe":"CWE-918","file":"source/tests/test_server_startup.py","line":114,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/tests/test_shell_redact_secrets.py","line":24,"malware":false},{"ruleId":"secret-jwt","title":"JSON Web Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/tests/test_shell_redact_secrets.py","line":71,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/tests/test_subagent_unit.py","line":2872,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/tests/test_subagent_unit.py","line":2873,"malware":false},{"ruleId":"py-unsafe-deserialization","title":"deserialisation of untrusted data","severity":"low","category":"code","cwe":"CWE-502","file":"source/tests/test_tools_python_kernel.py","line":436,"malware":false},{"ruleId":"py-unsafe-deserialization","title":"deserialisation of untrusted data","severity":"low","category":"code","cwe":"CWE-502","file":"source/tests/test_tools_python_kernel.py","line":451,"malware":false},{"ruleId":"insecure-temp-file","title":"predictable temporary file path","severity":"low","category":"code","cwe":"CWE-377","file":"source/tests/test_tools_shell.py","line":1684,"malware":false},{"ruleId":"py-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/tests/test_tools_watch.py","line":710,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/tests/test_util_review.py","line":4050,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/tests/test_util_review.py","line":4071,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/webui/src/contexts/__tests__/SettingsContext.test.tsx","line":65,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/webui/src/contexts/__tests__/SettingsContext.test.tsx","line":66,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/__tests__/markdownUtils.test.ts","line":150,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/webui/src/utils/__tests__/markdownUtils.test.ts","line":207,"malware":false}]}}