foundationagents/metagpt
🌟 The Multi-Agent Framework: First AI Software Company, Towards Natural Language Programming
How metagpt is put together
MetaGPT is a Python multi-agent framework that simulates a software company: LLM-backed Roles (ProductManager, Architect, Engineer, QAEngineer) execute Actions (WritePRD, WriteDesign, WriteCode, WriteCodeReview) that exchange Message objects through a shared Context/Environment, producing PRDs, designs, and generated code artifacts in a workspace repo. Configuration is layered from environment variables plus YAML files (config/config2.yaml and ~/.metagpt/config2.yaml) into a pydantic-based Config singleton. Pluggable LLM providers (OpenAI, Anthropic, Azure, Gemini, Qianfan, DashScope, Spark, ZhipuAI, Ollama, Bedrock) sit behind a registry, with optional vector stores (FAISS, LanceDB, Qdrant, Milvus, Chroma) for RAG and long-term memory. A small Node.js/TypeScript subsystem (mineflayer) provides a Minecraft game environment.
Languages
Frameworks
Datastores
Infrastructure
Major components
metagpt.roles
Defines agent personas (product manager, architect, engineer, QA, researcher, teacher, etc.) built on BaseRole that subscribe to messages and trigger their actions.
metagpt.actions
Implements each agent capability (WritePRD, WriteDesign, WriteCode, WriteCodeReview, DebugError, Research, OCR, etc.) as async run() units driven by ActionNode-structured prompts.
metagpt.provider
Pluggable LLM backend adapters (OpenAI, Anthropic, Azure OpenAI, Gemini, Ollama, Bedrock, Ark, Qianfan, DashScope, Spark, ZhipuAI) behind llm_provider_registry.
metagpt.configs / metagpt.config2
Pydantic configuration models (LLM, embedding, browser, search, Redis, S3, workspace, role-zero) merged from env vars and YAML into a global Config singleton.
metagpt.memory & metagpt.exp_pool
Short-term/long-term message memory and an experience pool (decorator + manager) for caching and retrieving past action outcomes.
metagpt.rag & metagpt.document_store
RAG interfaces/schemas over pluggable vector stores: FAISS, LanceDB, Qdrant, Milvus, ChromaDB.
metagpt.tools & metagpt.learn
Tool library registered via register_tool: search engines (Bing/DDG), TTS, text-to-image, embeddings, moderation, web scraping, email login, CR tooling.
metagpt.environment (incl. minecraft/mineflayer)
Base environment abstraction plus a Node.js mineflayer-based Minecraft simulation environment exposing observation/action spaces.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
4 vulnerable packages (27 advisories) across 40 scanned dependencies.
qdrant-client 1.7.0
1 advisory. Fixed in 1.9.0.
How it can be abusedMetaGPT can use the Qdrant vector database to store memories and documents for its retrieval features. If an app feeds untrusted text (like fetched web pages or user files) through this old client library, an attacker could craft content that slips past the library's checks and sends harmful commands to the Qdrant server, affecting any team running MetaGPT with Qdrant enabled.
- criticalGHSA-7m75-x27w-r52rqdrant input validation failure
semantic-kernel 0.4.3.dev0
2 advisories. Fixed in 1.39.3.
How it can be abusedAn attacker who can influence what an AI agent does could trick it into writing files anywhere on the machine or run malicious code through the vector store filter feature, but these flaws are in the .NET SDK and features MetaGPT does not rely on. MetaGPT uses its own LLM provider layer, so this package is not meaningfully used here.
- criticalGHSA-2ww3-72rp-wpp4Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
- criticalGHSA-xjw9-4gw8-4rqxMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
aiohttp 3.8.6
4 advisories. Fixed in 3.9.2.
How it can be abusedThese flaws mostly matter when aiohttp runs as a web server or parses untrusted responses. In this repo aiohttp is only used as a client to call trusted LLM provider APIs, so an attacker would have little practical way to reach these bugs.
- highGHSA-5h86-8mv2-jq9faiohttp is vulnerable to directory traversal
- highGHSA-5m98-qgg9-wh84aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
- highGHSA-6mq8-rvhq-8wggAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- highGHSA-cq5v-8q36-5273AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
gitpython 3.1.40
20 advisories. Fixed in 3.1.51.
How it can be abusedAn attacker who can influence text flowing through MetaGPT, such as a crafted repository URL in config, a malicious PRD or code review message, or a cloned repo with hostile submodules, could smuggle extra options into the git commands the framework runs on its workspace. That lets them run shell commands, overwrite files outside the project, or steal environment variables like API keys on any machine running MetaGPT.
- highGHSA-2f96-g7mh-g2hxGitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
- highGHSA-2mqj-m65w-jghxUntrusted search path under some conditions on Windows allows arbitrary code execution
- highGHSA-3f7w-8rr8-f37fGitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
- highGHSA-3rp5-jjmw-4wv2GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
- highGHSA-4gmw-gg2m-w46pGitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
- highGHSA-6p8h-3wgx-97gfGitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
- highGHSA-7545-fcxq-7j24GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
- highGHSA-94p4-4cq8-9g67GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
- highGHSA-956x-8gvw-wg5vGitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
- highGHSA-9rj7-rf2p-w77rGitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
- highGHSA-fjr4-x663-mwxcGitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
- highGHSA-hmq2-w58f-27jcGitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
- highGHSA-jm78-9fvv-mhgrGitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
- highGHSA-mv93-w799-cj2wGitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
- highGHSA-r9mr-m37c-5fr3GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
- highGHSA-rpm5-65cw-6hj4GitPython has Command Injection via Git options bypass
- highGHSA-rwj8-pgh3-r573GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
- highGHSA-v87r-6q3f-2j67GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
- highGHSA-wvpp-8hx9-p66jGitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
- highGHSA-x2qx-6953-8485GitPython: Unsafe option check validates multi_options before shlex.split transformation
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required