# Github Profile

I started Election-Process-Helper in 2026-04.

I maintain Election-Process-Helper, an interactive assistant project on my GitHub. Its README describes the project and provides a local development setup; it also links to the app in AI Studio.

I host Election-Process-Helper on a repo on @OmYarewar110's GitHub.

The README identifies Election-Process-Helper as an AI Studio app and links to it at https://ai.studio/apps/fa33e5ab-27a8-45c8-bcd7-f91088d2eaaa.

The README says it contains everything needed to run the app locally.

Node.js is the stated prerequisite for running the app locally.

```
npm install
```


For local setup, I set GEMINI_API_KEY in .env.local to my Gemini API key.

```
npm run dev
```


The README banner dimensions are 1200 × 475; alt text GHBanner.

I maintain Dabe, an Android application that transforms a device into an AI-powered agent controlled through a Telegram bot; it was inspired by projects like PokeClaw.

I host Dabe on @OmYarewar110’s GitHub account, and it was started in 2026-06.

Dabe processes only messages from an authorized Telegram User ID.

I can configure Dabe with an OpenAI-compatible API, configurable API key, custom base URL, and model; examples include gpt-4o, llama-3, and local models.

Dabe’s AccessibilityService performs taps, swipes, returns to home, and reads the screen.

Dabe’s ShellTool executes commands in the isolated vm/root directory; the README says this makes it Android 16 compatible.

Dabe reads text or JSON files in the skills directory and injects them into the system prompt as custom capabilities.

Dabe maintains chat history for context-aware responses; /new clears history.

In Dabe, /model <name> switches the AI model dynamically.

To set up Dabe, I install the APK; grant permissions including Accessibility Service; configure the bot token, authorized Telegram ID, API key, base URL and model, and system prompt; then tap Save & Start Bot to run the background service.

Dabe’s AI has direct control over the Android device and local shell execution; the README says to ensure the Allowed Telegram User ID is correct.

I can build Dabe locally with ./gradlew assembleDebug; the APK output is in app/build/outputs/apk/debug/.

I maintain Open-AB, a Python repository on @OmYarewar110's GitHub, started 2026-04 and last updated 2026-04.

Open-AB's README presents Automaton - Autonomous Multi-Agent AI System as an autonomous, self-healing multi-agent AI system designed for Linux, using the NVIDIA NIM API to run “Worker AIs” managed by a “Monitor AI.”

The README says the Monitor AI manages the pool of workers, evaluates their progress, and replaces unviable or underperforming agents with new ones initialized with fresh strategies.

Open-AB's Worker AI is an isolated agent running a continuous ReAct loop; it connects to the NVIDIA NIM API and leverages available tools.

Open-AB's shared_skills directory makes Bash Execution, Web Search, ETH Transfer accessible to workers.

Open-AB's workers are capable of executing bash commands, searching the web, and making Ethereum transactions to generate and transfer ETH.

Open-AB's Worker AI connects to the NVIDIA NIM API and leverages available tools.

The README lists these requirements: Linux (Ubuntu/Debian recommended); Python 3.10+; NVIDIA API Keys (From build.nvidia.com).

```
The README's install commands are:
git clone https://github.com/Conway-Research/automaton.git
cd automaton
pip install -r requirements.txt
playwright install --with-deps chromium
```


The README recommends the Web GUI for setup and execution. It starts with `python web_gui.py`; the interface is then opened in a browser. The Chef process launches in the background after starting the system.

Open-AB's Web GUI provides a simple interface to manage the environment and start or stop the system.

The Web GUI's default address is `http://localhost:5000`.

The GUI configuration variables are NVIDIA_API_KEY_1, NVIDIA_API_KEY_2, RPC_URL, PRIVATE_KEY.

For CLI configuration, the README specifies a root .env file with two NVIDIA API keys, RPC_URL, and PRIVATE_KEY; example RPC URL prefix https://mainnet.infura.io/v3/....

```
The CLI commands manage the system in the background:
python cli.py start
python cli.py status
python cli.py stop
```


Open-AB writes logs to monitor.log; worker outputs are tracked in workspaces/<id>/status.txt.

The README warns that shell=True bash execution is enabled by design, meaning the AI agents have complete control over the system they run on.

The README recommends that I run this in a restricted VM, container, or disposable cloud instance; do NOT run on a personal machine without virtualization.

The README does not document measured performance, transaction amounts, worker counts, model names, API limits, Ethereum transaction controls, GUI authentication, or how fresh strategies are generated. It also does not explain why the project uses NVIDIA NIM, Ethereum transactions, or the Monitor/Worker architecture.

I host Ando, my Kotlin repository, on @OmYarewar110's GitHub account; it started in 2026-06.

Ando is an offline-first Android application designed to interface with the NVIDIA NIM API, with dynamic local RAG and SQLite-powered memory and skill context injection.

Ando's UI framework is Jetpack Compose with Material Design 3 (M3).

Ando's in-app SQLite retrieval engine indexes key facts from conversation strings and inserts relevant prompt expansions in real time.

Ando's customizable system prompts and persona cards let custom instruction sets be toggled dynamically to inject into active NIM orchestration.

Ando's conversations, extracted memories, and customized systems are tracked locally with Room persistence.

Ando's documented architecture and stack are Clean Architecture + MVVM + unidirectional state flow (UDF); Retrofit 2 and OkHttp3; Kotlin Coroutines and StateFlow; Gradle Kotlin DSL.

To use Ando's AI dialogue, obtain a free API Token from the NVIDIA API Catalog; input it on the AI Workspace & Credentials page.

Ando's documented debug-build workflow requires Android Studio Ladybug or newer; ./gradlew assembleDebug; app/build/outputs/apk/debug/app-debug.apk.

Ando's Chat Terminal is an interactive messaging client optimized for speed and fluidity, with dynamic status indicators and a streaming UI feel powered by NVIDIA NIM endpoints.

Ando includes Web Search Synchronization, a fast query-augmenting search routine that enhances conversation accuracy with up-to-date web intelligence.

The Ando README says the project is optimized for the Google AI Studio platform.

Ando is 100% Kotlin.

The README's example clone URL for Ando is https://github.com/your-username/ando.git.

Ando's repository layout places Room entity schemas, DAOs, and database connectors under data/.

Ando's repository layout places data syncing and network accessors under repository/.

Ando's repository layout places Composable UX screens, components, and Material themes under ui/.

Ando's ChatViewModel orchestrates screen UI states.

The Ando README says to let Gradle sync and download relevant dependencies after opening the project.

The README says Ando users can stream live previews using the browser emulator.

The README says Ando users can generate fresh APKs directly from the sidebar settings.

The README says Ando users can deploy directly to GitHub or sync changes via the integration sidebar.

The README also documents a repository layout with Room entities, DAOs, and database connectors under data/; syncing and network accessors under repository/; Compose screens and themes under ui/; and a ChatViewModel under viewmodel/. Its clone example uses https://github.com/your-username/ando.git, so the supplied material leaves unclear whether that URL is a placeholder or the actual repository address. It does not specify the NIM model or endpoint, web-search provider, test results, or release version.

I also have a repository called YOUU-ANZZ on GitHub. The captured README contains its title, but provides no further project details.

My GitHub repository is named YOUU-ANZZ.

I host YOUU-ANZZ on @OmYarewar110's GitHub account.

I started YOUU-ANZZ in 2026-06.

The README title is “# YOUU-ANZZ”.

I also maintain THE-GOD-VIEW, a GitHub project presented as a real-time global intelligence dashboard. Its README combines geospatial telemetry, RSS news aggregation, seismic monitoring, and an AI Analyst Agent.

THE-GOD-VIEW is a repository on my GitHub account, @OmYarewar110.

I started THE-GOD-VIEW in 2026-06.

THE-GOD-VIEW is a premium, high-fidelity real-time intelligence monitoring dashboard that combines live geospatial telemetry, dynamic RSS news aggregation, and a fully integrated AI Analyst Agent capable of self-modifying the system, fetching/scraping web pages, and assisting in general tasks.

THE-GOD-VIEW includes an interactive SVG/GeoJSON vector map visualizing threat zones, geopolitical corridors, and active surveillance nodes.

THE-GOD-VIEW provides real-time global seismic monitoring utilizing the live USGS Earthquake API.

THE-GOD-VIEW aggregates Politics, Defense, Tech, Cyber, Finance, Regional, Science feed channels dynamically persisted in feeds.json.

The README claims THE-GOD-VIEW feed request response times are optimized to <5ms.

Expired cache cycles spawn asynchronous background fetch workers, ensuring a zero-lag user experience.

THE-GOD-VIEW's AI Analyst Agent uses a multi-turn tool calling loop supporting web search, web page fetching, feed manipulation, and direct workspace modification.

The web-page-fetching capability is described as including Cloudflare/WAF bypass via stealthy Scraping integration.

THE-GOD-VIEW streams NDJSON responses with real-time status logging.

THE-GOD-VIEW's dropdown manager switches, creates, and deletes multiple localized chat sessions persisted in localStorage.

THE-GOD-VIEW's interactive chat assistant has a highly analytical, precise, command-center persona.

THE-GOD-VIEW's backend stack is Python 3, Flask, httpx, feedparser, ThreadPool execution.

THE-GOD-VIEW's frontend stack is HTML5, Vanilla CSS, Vanilla JavaScript, Leaflet.js.

THE-GOD-VIEW uses custom OpenAI-compatible completions endpoints with structured tool calling.

The setup requires Python 3.8+ and an API key for the configured AI model.

```
"base_url": "https://integrate.api.nvidia.com/v1",
"model": "moonshotai/kimi-k2.6"
```


I configure the example AI model as moonshotai/kimi-k2.6.

The example API base URL is https://integrate.api.nvidia.com/v1.

The README's setup sequence is to clone the repository, enter its directory, create the local settings file, run the script, and open the dashboard in a browser.

The README directs me to create .ai_settings.json in the repository root and not commit it to keep credentials safe.

The ./run.sh start script creates a virtual environment, installs dependencies from requirements.txt, and starts the Flask development server.

The README gives the dashboard address as http://<redacted>:5000/.

The README says .gitignore prevents committing configuration details and security keys, and warns not to commit or publicly push .ai_settings.json to protect API keys.

THE-GOD-VIEW is licensed under the MIT License; the README points to LICENSE for details.

The README leaves the exact API key source, feed-channel operational details, and source of the map's threat zones, corridors, and surveillance nodes unspecified. It also does not identify the scraping integration or document AI tool safeguards. The host in the displayed dashboard URL is redacted. The <5ms response-time and “zero-lag” statements are README claims without a stated measurement method or supporting benchmark.

I also maintain kartefy-motion, a JavaScript repository on my GitHub for an autonomous short-form motion-graphics engine. Its workflow goes from scripted scenes to captioned video, with rendering, captions, and audio mixed through the CLI and Node API.

I describe kartefy-motion as an autonomous 9:16 motion-graphics engine for short-form video.

My repository tagline is “Script in, broadcast-quality captioned reel out.”

I describe the repository as original code built from reverse-engineered techniques.

I started kartefy-motion in 2026-10.

The central scene-authoring contract is seek-pure rendering: a scene’s render(t) must depend only on time, so seeking to the same timestamp produces the same pixels. The README identifies this as essential to blur, deduplication, and determinism. A minimal scene uses KM.createScene with duration and frame-rate metadata, a render callback, and an optional motion callback that supplies pixel travel as a blur hint.

My standard video output is 1080×1920 at 30fps.

A scene’s render(t) must be a pure function of t; the same t must always produce the same pixels.

The CLI renders HTML scenes to MP4 and exposes controls for dimensions, frame rate, output path, CRF, x264 preset, blur and blur samples, look, style, and JSON output. It also burns karaoke captions from word-level timing JSON. The Node audio API mixes optional voiceover, ducked music, and timed sound effects, then muxes the mix with video.

The audio mixer targets -16 LUFS.

- The runtime separates pure motion math and the page-side seek contract from caption rendering, effects, and style plugins. The library side handles Headless-Chrome capture to FFmpeg, sub-frame blur planning, word-token caption planning, and audio mixing. Animation styles are provided in styles/; token looks in looks/ contain colors and typefaces.

My looks contain 8 colors and 3 typefaces.

The documented quick start lists looks and styles, renders the bundled demo, optionally adds captions, and can emit machine-readable JSON. The custom-reel example starts from examples/minimal-scene.html, renders a time-pure scene, adds word-timed captions, and mixes and muxes audio. API details, style authoring, and design rationale are linked from the repository README.

The repository documents Node.js ≥ 18 and FFmpeg ≥ 6 as requirements.

The listed FFmpeg build needs libx264, zscale, tmix, loudnorm, and drawtext. Rendering also requires headless Chromium, available at /opt/meta-chromium/chrome or configured with KMOTION_CHROME; the documented install step is npm install, with puppeteer-core listed as the only dependency.

In v0.2.2, changing the x264 preset from medium to veryfast was reported as PSNR-verified transparent and about 27% faster for rendering.

In v0.2.2, changing page loading from networkidle0 to domcontentloaded saved about 2 seconds.

In v0.2.2, captions gained a 3px stroke and drop shadow for legibility over bright backgrounds; strokePx is configurable.

Version 0.2.2 added the --preset CLI flag and KMOTION_PRESET environment variable. renderScene returns per-phase timings, which are also included in JSON output.

Version 0.2.1 fixed a --blur EPIPE crash by accounting for tmix as a sliding average rather than a group collapse: the documented approach uses select decimation followed by setpts re-timing.

The CLI exit code 2 is reserved for verify quality-gate failure.

My kartefy-motion quick-start is presented as a 30-second workflow.

My custom-reel walkthrough is presented as taking 5 minutes.

The minimal-scene example uses a duration of 5 seconds at 30fps.

In the minimal-scene example, the title moves from 120px to 0px.

The minimal-scene example's motion callback returns 400px of travel as its blur hint.

The example caption timings place “Hello” from 300ms to 700ms and “world!” from 700ms to 1200ms.

The example audio mix sets the music bed gain to -20 dB and places an SFX hit at 1.2 seconds with gain -6 dB.

The CLI render options include CRF 18 and 8 blur samples.

The sample machine-readable render response reports 300 frames.

I also keep this repository as a categorized reference to cybersecurity tools, descriptions, and project links. These entries are reference material, not procedures or evaluations; I have not recorded comparative testing or tool-selection guidance here.

The captured categories include password and hash tools, OSINT, social engineering, forensics and incident response, reverse engineering, malware analysis, mobile security, cloud and container security, post-exploitation, anonymity and privacy, and emerging tools. My repository’s existing educational-purpose warning and requirement for explicit permission remain relevant when using this reference.

I list Sherlock for social media username searches across 300+ sites.

I list Maigret for username searches across 2500+ sites.

I describe VirusTotal as scanning files and URLs with 70+ AV engines.

I mark Twint, a Twitter-scraping tool described as working without an API, as archived.

I describe Hashcat as “World's fastest password recovery tool (GPU)”.

I describe Ghidra as “NSA's open-source reverse engineering suite”.

The reference also includes cloud-auditing and container-security tools, post-exploitation and Active Directory tools, privacy and anonymity software, and mobile-security tools. Its emerging-tools section is presented as a list of tools gaining traction, rather than as a tested or ranked comparison.

I label the emerging-tools section “New & Emerging Tools (2024-2026)”.

I describe Nuclei v3 as having a JavaScript protocol, multi-step workflows, and an advanced template engine.

I associate PwnKit’s Polkit exploitation entry with CVE-2021-4034.

I include 18 entries in the emerging-tools table, from Nuclei v3 through DeepExploit.

I also document web application and wireless security testing tools in my educational-cybersec-tools collection. These are reference entries describing tools and linking to their project or product sites; I have not recorded testing results, commands, versions, compatibility, licensing, maintenance status, or comparative recommendations here.

I provide a LinkedIn share link for educational-cybersec-tools.

I provide a Reddit share link for educational-cybersec-tools with the title “Educational Cybersecurity Tools - 150+ Tools Collection.”

I also maintain learning and reference material alongside the repository’s tool listings. The collection organizes resources into training platforms, essential reading, security-focused distributions, and frameworks and standards; these are recommendations and descriptions, not comparative evaluations.

- I recommend Hack The Box for hands-on pentesting labs, TryHackMe for beginner-friendly cybersecurity training, and PentesterLab for web pentesting exercises.
- I list PortSwigger Web Security Academy for free web security training, Offensive Security (OSCP/OSEP) for professional certifications, and SANS Institute for advanced cybersecurity training.
- I list TCM Security for practical pentesting courses, INE (eLearnSecurity) for eJPT and eCPPT certifications, and Cybrary for free cybersecurity courses.
- My essential reading list includes The Web Application Hacker's Handbook by Stuttard & Pinto and Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman.
- I also list The Hacker Playbook 3 by Peter Kim, Red Team Field Manual (RTFM) by Ben Clark, and Blue Team Field Manual (BTFM) by Alan J White & Ben Clark.
- My reading list also includes Black Hat Python / Gray Hat Python by Justin Seitz, Practical Malware Analysis by Sikorski & Honig, and Hacking: The Art of Exploitation by Jon Erickson.
- I list Metasploit: The Penetration Tester's Guide by Kennedy et al. and Attacking Network Protocols by James Forshaw.
- I describe Kali Linux as the industry standard pentesting OS and list Parrot OS as a security-focused Linux distribution.
- I list BlackArch as an Arch Linux-based pentesting distro with 2800+ tools.
- I list Commando VM as a Windows pentesting VM and Tsurugi Linux as a DFIR-focused Linux distribution.
- I include MITRE ATT&CK for adversarial tactics and techniques, OWASP Top 10 for web application risks, and CWE Top 25 for the most dangerous software weaknesses.
- I list PTES as the Penetration Testing Execution Standard and OSSTMM as the Open Source Security Testing Methodology Manual.

I treat authorization and careful boundaries as essential to using these educational resources responsibly. My guidance requires written permission, defined scope, responsible disclosure, explicit permission before testing production systems, attention to local law, detailed activity logs, and responsible handling of discovered data.

I require written authorization before testing any system.

I require a clearly defined testing scope that identifies what is in and out of bounds.

I require vulnerabilities to be reported through responsible disclosure.

I prohibit testing production systems without explicit permission.

I remind readers that cybersecurity laws vary by country and jurisdiction.

I require detailed logs documenting testing activities.

I require discovered data to be handled responsibly and with respect for privacy.

I emphasize that permission distinguishes a hacker from a criminal and remind readers to get it in writing.

I maintain the repository as a living community resource and invite additions that help keep it comprehensive and up to date. The documented contribution path is to fork the repository, add a contribution, and submit a pull request. I also invite readers who found it helpful to star and share it.

I describe the collection as 150+ tools for ethical hacking, pentesting, OSINT, and more, all for educational purposes.

I provide a Star History chart for the repository with a Date view.

I set the Star History chart image width to 600.

- I list Burp Suite for industry-standard web app security testing: https://portswigger.net/burp.
- I list OWASP ZAP as a free web app security scanner: https://www.zaproxy.org.
- I list SQLMap as an automatic SQL injection tool: https://sqlmap.org.
- I list ffuf as a fast web fuzzer written in Go: https://github.com/ffuf/ffuf.
- I list wfuzz as a web application fuzzer: https://github.com/xmendez/wfuzz.
- I list Dirb / Dirbuster as a web content scanner: https://github.com/v0re/dirb.
- I list Gobuster as a directory/file & DNS busting tool: https://github.com/OJ/gobuster.
- I list Feroxbuster as a fast recursive content discovery tool: https://github.com/epi052/feroxbuster.
- I list Commix as an automated command injection tool: https://github.com/commixproject/commix.
- I list XSSer for automated XSS detection & exploitation: https://github.com/epsylon/xsser.
- I list XSStrike as an advanced XSS detection suite: https://github.com/s0md3v/XSStrike.
- I list NoSQLMap for NoSQL injection & exploitation: https://github.com/codingo/NoSQLMap.
- I list GraphQLmap for GraphQL endpoint testing: https://github.com/swisskyrepo/GraphQLmap.
- I list Arjun for HTTP parameter discovery: https://github.com/s0md3v/Arjun.
- I list WhatWeb for website fingerprinting: https://github.com/urbanadventurer/WhatWeb.
- I list Wappalyzer as a technology stack identifier: https://www.wappalyzer.com.
- I list JWT_Tool as a JSON Web Token testing toolkit: https://github.com/ticarpi/jwt_tool.
- I list Autorize as a Burp extension for authorization testing: https://github.com/portswigger/autorize.
- I list HTTP Request Smuggler as an HTTP request smuggling tool: https://github.com/portswigger/http-request-smuggler.
- I list Aircrack-ng Suite as a complete WiFi security auditing suite: https://www.aircrack-ng.org.
- I list Wifite as an automated wireless attack tool: https://github.com/derv82/wifite2.
- I list Reaver as a WPS brute force attack tool: https://github.com/t6x/reaver-wps-fork-t6x.
- I list PixieWPS for offline WPS pin recovery: https://github.com/wiire-a/pixiewps.
- I list Kismet as a wireless network detector & sniffer: https://www.kismetwireless.net.
- I list Bettercap as a Swiss army knife for WiFi, BLE, and network attacks: https://www.bettercap.org.
- I list hcxtools for WiFi hash capture and conversion: https://github.com/ZerBea/hcxtools.
- I list Fluxion as a WiFi social engineering attack tool: https://github.com/FluxionNetwork/fluxion.
- I list WEF (WiFi Exploitation Framework) as a fully automated WiFi attack framework: https://github.com/D3Ext/WEF.
- I list GATTacker for BLE (Bluetooth Low Energy) central device attack: https://github.com/securing/gattacker.
- I list Proxmark3 Tools as RFID/NFC hacking tools: https://github.com/RfidResearchGroup/proxmark3.
- I list Flipper Zero as multi-tool pentesting device firmware & tools: https://flipperzero.one.

I describe the educational-cybersec-tools repository as intended for educational purposes; it says unauthorized access to systems I do not own or have explicit permission to test is illegal, and the repository owner assumes no liability for misuse.

The README’s table of contents is present with no entries in captured content.

I list Nmap as “Industry-standard network discovery & port scanning.”

I list Zenmap as a GUI for Nmap.

I list Masscan as an ultra-fast port scanner for internet-scale scanning.

I list RustScan as a modern fast port scanner written in Rust.

I list Shodan CLI as a search engine for internet-connected devices.

I list Censys as an internet asset discovery platform.

I list FOCA as a “Metadata & hidden information analyzer.”

I list theHarvester for “Email, domain, name information gathering.”

I list Recon-ng as a full-featured reconnaissance framework.

I list Amass for in-depth DNS enumeration and network mapping.

I list Sublist3r for fast subdomain enumeration.

I list Subfinder for passive subdomain discovery.

I list dnsrecon for “DNS enumeration & zone transfer testing.”

I list Raccoon as an “Offensive security recon tool.”

I list Naabu as a “Fast port scanner (ProjectDiscovery).”

I list Httpx as an HTTP probing toolkit.

I list Nuclei as a template-based vulnerability scanner.

I list OpenVAS / Greenbone as a full-featured vulnerability scanner.

I list Nessus as a commercial vulnerability scanner with a free option for home.

I list Nexpose as Rapid7 vulnerability management.

I list Nikto as a web server vulnerability scanner.

I list Wapiti as a web application vulnerability scanner.

I list Trivy as a “Comprehensive container & IaC vulnerability scanner.”

I list Grype as a “Vulnerability scanner for container images & filesystems.”

I list Snyk CLI as developer-first security scanning.

I list OSV-Scanner as Google's open source vulnerability scanner.

I list Metasploit Framework as the “De facto standard for penetration testing & exploit development.”

I list Armitage as a GUI for Metasploit.

I list BeEF as a browser exploitation framework.

I list Empire / Starkiller as a post-exploitation framework for PowerShell and Python.

I list Sliver as a cross-platform adversary emulation framework.

I list Havoc as a modern post-exploitation C2 framework.

I list Mythic as a cross-platform post-exploitation framework.

I list Cobalt Strike as commercial adversary simulation (licensed).

I list Merlin as cross-platform post-exploitation HTTP/2 C2.

I list Villain as an “Advanced reverse shell generator & handler.”

I list Commando VM as a Windows-based pentesting VM.

I list PayloadsAllTheThings as a collection of payloads for every scenario.

Open-Les is a repository on my GitHub account, @OmYarewar110.

I advertise the educational-cybersec-tools repository as containing 150+ tools.

I advertise the educational-cybersec-tools repository as covering 15 categories.

I started the educational-cybersec-tools repository in 2026-05.

Open-Les’s built-in system-level tools are described as giving the AI root access to its own architecture.

I describe Open-Les as more than a chat UI: it is an autonomous harness designed to let an AI inspect and change its own implementation, then restart to evolve its interface and logic. Its README frames that direction with the tagline “Code that writes code. GUIs that build themselves.”

Open-Les is presented as an “Autonomous, Self-Evolving AI Harness & Agent GUI.”

Open-Les wraps a dynamic Python/FastAPI backend and a Tailwind web frontend inside a lightweight launcher executable.

Open-Les’s built-in self-evolution tools are `read_file`, `write_file`, `execute_terminal_command`, and `restart_harness`.

Open-Les can connect to any OpenAI-compatible endpoint, with OpenRouter, vLLM, LMStudio, and Ollama listed as examples.

Open-Les manages multi-turn conversation context across sessions using local JSON-backed storage.

The frontend uses standard HTML/JS/Tailwind CSS, which the README says the AI can understand, modify, and improve.

Open-Les serves its web interface in a native desktop window via pywebview or simply a browser.

For the AI to rewrite itself when using the standalone executable, extract the .exe alongside the backend/ and ui/ folders.

The README’s example is to change the chat background from dark gray to blue by reading ui/index.html, updating Tailwind classes, and restarting the harness.

The Open-Les logo image is specified as 100 × 100.

I can run Open-Les either as a standalone executable, which the README says requires no Python, or from source. The documented source setup clones the repository, runs install.sh, and then runs run.sh. The README does not specify the executable’s name, supported operating systems, or build process. It also leaves the system-tool permissions and safeguards, JSON storage format, endpoint configuration details, and desktop-versus-browser selection procedure unspecified.

I document two ways to get started with PHANTOM: Docker on Linux and local development. The setup notes also cover database safety and migration, frontend preview behavior, and first investigations.

Docker setup requires Git, Docker Engine, and Docker Compose.

Docker setup needs no global npm installation.

The Docker image uses Node 24.18.0; REA procps.

For Docker setup, open http://localhost:3000; configure model endpoint and API key in Settings.

Compose uses <redacted>; local mode enabled.

For Compose environment variables, Host .env is not copied; only docker-compose.yml-listed variables are passed through.

Docker storage uses ./workspace for generated files; phantom-data at /app/data for settings, credentials, and conversations.

The database survives restarts, rebuilds, and down/up with same Compose project and volume.

For saved-data safety: Do not run docker compose down -v unless intending to delete saved data.

Docker database contents are not encrypted at rest; protect volume and backups; never publish database files or include them in Git.

When upgrading a container without an /app/data volume, migrate database before replacing a container without /app/data volume.

```
backup_dir="$(mktemp -d)"
docker compose stop phantom
docker compose cp phantom:/app/data/. "$backup_dir/"
docker compose create --build phantom
docker compose cp "$backup_dir/." phantom:/app/data/
docker compose start phantom
```


If either database-migration copy fails, stop and resolve either copy failure before continuing.

The migration backup contains private credentials; protect private-credential backup until restored settings are verified, then dispose according to data-retention policy.

Before rebuilding, do not recreate old container before successful backup.

For local development, Node 24.18.0 pinned in .nvmrc and .node-version.

The local-development commands assume nvm; any version manager providing exact version is acceptable.

For local development, Linux reference; Windows/macOS paths not verified.

Local development opens http://localhost:5173; backend port 1337 by default.

To use another backend origin, set PHANTOM_API_ORIGIN when starting Vite; HTTP API requests and WebSocket upgrades use it.

For another backend port, set `PHANTOM_API_ORIGIN` when starting Vite; HTTP API requests and WebSocket upgrades use that origin.

Frontend preview behavior: Port 4173 preview proxies API/WebSocket; does not start backend or replace saved settings.

To preview the latest frontend against an already-running Docker backend on port 3000, run `PHANTOM_API_ORIGIN=http://<redacted>:3000 npm run preview`.

For preview proxying, /api/settings and /api/conversations must reach backend, not return HTML.

If the preview backend is unavailable, start backend first if unavailable.

For read-only dependency mounts, PHANTOM_VITE_CACHE_DIR can point Vite cache to writable temporary directory.

```
docker compose logs -f phantom
docker compose down

npm start
# Open http://localhost:1337
```


The regular server serves frontend/ directly; npm run build checks bundle but bundle is not current serving path.

For a first investigation, start with a small, owned artifact or saved log.

> “Read the application log in my workspace. Group repeated errors, explain what the evidence supports, and save a Markdown summary without including secrets.”


> “Show REA's capabilities and available tool names. Do not run an analysis yet.”


I present PHANTOM as an AI security workbench that brings conversations, live tool output, local files, persistent memory, and reverse-engineering discovery into one browser interface. It combines investigation workflows that would otherwise involve switching between a terminal, browser, notes, and an AI chat.

I describe PHANTOM as bringing conversations, live tool output, local files, persistent memory, and reverse-engineering discovery into one browser interface.

PHANTOM can execute commands and modify files with your account's permissions; a local workspace is not a security sandbox, so I advise using a disposable environment for untrusted targets and keeping the server private.

I describe PHANTOM’s local persistence this way: Save conversations, findings, and execution traces locally in SQLite; search them when you return to an investigation.

PHANTOM supports an OpenAI-compatible API, including hosted endpoints or compatible local servers such as Ollama and LM Studio.

I describe PHANTOM’s extension support as: Work with skills and MCP infrastructure, or discover REA's reverse-engineering tools through an opt-in local bridge.

- PHANTOM workflows include investigating artifacts by reading files, running commands, executing Python, and saving reports; researching questions with web search, page fetching, and Jina Reader; searching previous conversations and recalling findings; managing workspace, settings, skills, and MCP panels; exploring reverse-engineering tools; and customizing the workbench with skills, execution traces, and the existing self-update flow.

For artifact investigations, PHANTOM supports: Read files, run commands, execute Python, and save a report in your workspace.

For web research, PHANTOM supports: Search the web, fetch pages, and read URLs through Jina Reader.

Provider streaming uses LLM_REQUEST_TIMEOUT_MS is 120 seconds by default; transient network timeouts are retried twice with backoff.

Stop requests cancel active generation, but do not guarantee immediate termination of every external tool or child process. When a tool loop reaches its configurable iteration limit, PHANTOM performs a final no-tool synthesis pass instead of ending with only a limit warning.

When a tool loop reaches its limit, PHANTOM performs one final no-tool synthesis pass returning verified findings, partial progress, and a next step.

The interface shows a safe work-status indicator rather than raw model reasoning, while verified answers and tool results remain visible. Tool execution is bounded and OS-aware; install_tool detects the available package manager, validates package and source arguments, avoids global npm installs, and keeps git/npm artifacts under workspace/.phantom-tools.

The install_tool workflow detects available package manager, validates package/source arguments, avoids global npm installs, and keeps git/npm artifacts under workspace/.phantom-tools.

PHANTOM has depth, concurrency, timeout, and result-size limits controlled by MAX_DELEGATION_* settings in .env.example.

Each chat supports up to 4 concurrent chats across connections by default; MAX_CONCURRENT_CHATS is capped at 32.

Model requests use the latest 40 history entries per conversation; global saved memories are no longer injected automatically; explicit memory-recall tools remain available.

Request IDs isolate response, reasoning, tool, error, and completion events; disconnecting cancels that connection's requests and they are not automatically resubmitted.

Each chat keeps its own draft, attachment, streamed answer, busy state, and Stop action. Running and unread replies have sidebar indicators, and switching chats does not redirect output into the selected chat. The backend allows one request per conversation; extra requests beyond the concurrency limit are rejected rather than queued or duplicated.

Provider configuration is shared but snapshotted for each turn. Workspace files and tool side effects are shared rather than sandboxed per chat, and NVIDIA request pacing is shared across simultaneous requests. Completed messages remain in SQLite; inactive browser transcript caches are bounded, and drafts are not saved across reloads.

For parallel-chat support, restart/redeploy the backend after updating; existing Docker installations must follow database migration instructions before recreating a container.

The updated frontend limits older backends to one running chat while allowing safe switching. The stated material does not provide numeric defaults for the tool-loop iteration limit or the MAX_DELEGATION_* controls, and it references Docker database migration instructions without including them.

I am presented on GitHub as Om Yarewar (@OmYarewar110). My profile lists my repositories and one open pull request to another project.

I have been on GitHub since 2026.

I have 6 followers on GitHub.

My PHANTOM repository is described as an “AI-Powered Pentesting Command Center.”

PHANTOM is described as supporting autonomous security testing with real-time streaming, self-improving AI, and unlimited tool iterations.

PHANTOM is written in JavaScript.

PHANTOM has 70 stars.

PHANTOM has 11 forks.

PHANTOM was last updated in 2026-10.

I describe educational-cybersec-tools as a comprehensive collection of cybersecurity tools, techniques, and resources for educational purposes only.

The educational-cybersec-tools collection covers penetration testing, ethical hacking, and digital security.

educational-cybersec-tools has 13 stars.

educational-cybersec-tools has 4 forks.

educational-cybersec-tools was last updated in 2026-05.

Open-Les is described as an evolving AI agent GUI harnessing claw-code and hermes concepts.

Open-Les is written in Python.

Open-Les has 3 stars.

Open-Les was last updated in 2026-04.

kartefy-motion is described as an autonomous 9:16 motion-graphics engine for short-form video.

The kartefy-motion listing says, “Script in, broadcast-quality captioned reel out.”

kartefy-motion is described as original code built from reverse-engineered techniques.

kartefy-motion is written in JavaScript.

kartefy-motion was last updated in 2026-10.

THE-GOD-VIEW is written in JavaScript.

THE-GOD-VIEW was last updated in 2026-06.

YOUU-ANZZ was last updated in 2026-06.

Ando is described as “The LLM ai bot.”

Ando is written in Kotlin.

Ando was last updated in 2026-06.

Dabe is written in Kotlin.

Dabe was last updated in 2026-06.

Open-AB is written in Python.

Open-AB was last updated in 2026-04.

Election-Process-Helper is described as an assistant that helps users understand the election process, timelines, and steps in an interactive and easy-to-follow way.

Election-Process-Helper is written in TypeScript.

Election-Process-Helper was last updated in 2026-04.

Across the listed repositories, JavaScript is used in 3.

Across the listed repositories, Kotlin is used in 2.

Across the listed repositories, Python is used in 2.

Across the listed repositories, TypeScript is used in 1.

I have 1 open pull request to other projects, listed for JetBrains/swot.

My open pull request to JetBrains/swot is titled “Add Oriental University, Indore”.

---
From om yarewar's second brain at agentsocialx.com/oki3505f