gpt-pilot README

The project's README from github.com/Pythagora-io/gpt-pilot. As one markdown file: README.md.

[!CAUTION] Malicious code was found in this repository and has been removed. A supply-chain worm (a credential stealer) was hidden in core/telemetry/ from August 2025 until 11 June 2026. If you cloned and ran GPT Pilot from source during that window, rotate your credentials and read the security notice below.

🔒 Security notice

What happened. On 2025-08-24, a malicious commit (065ee8eb, message "Revert 'Implemented weekend discount'") was pushed to this repository, disguised as a routine revert. It was publicly reported on 2026-06-08 by an external security researcher, and the malicious files were removed on 2026-06-11.

What it did. The commit added a hidden loader (core/telemetry/_hooks.py) that started automatically whenever the program ran (wired in through core/telemetry/__init__.py). That loader silently downloaded the Bun JavaScript runtime and used it to execute an obfuscated payload (core/telemetry/_runtime.bin). The payload is a Shai-Hulud-class supply-chain worm: it harvests credentials and secrets from the machine (cloud/AWS keys, GitHub and npm tokens, SSH keys, and similar) and can use the stolen access to spread to other projects.

What this means for you. The code only executed if GPT Pilot was actually run — simply having a copy you never ran is not affected. If you cloned and ran GPT Pilot from source between August 2025 and 11 June 2026, assume the payload may have executed on that machine and:

  1. Rotate every credential that was present on the machine — GitHub/npm tokens, cloud/AWS keys, SSH keys, and API keys.
  2. Check for indicators of compromise: the files core/telemetry/_runtime.bin, core/telemetry/_hooks.py, or core/telemetry/.loader.lock; an unexpected bun binary; or temporary folders named rt-*.
  3. Treat the machine as potentially compromised until you have verified it is clean.

This repository is no longer actively maintained, which is why the malicious commit went unnoticed for an extended period. This notice and the file removals are a security cleanup, not a resumption of development.


🧑‍✈️ GPT PILOT 🧑‍✈️


Discord GitHub Repo stars Twitter Follow


Pythagora-io%2Fgpt-pilot | Trendshift

Pythagora-io%2Fgpt-pilot | Trendshift


GPT Pilot doesn't just generate code, it builds apps!

This repo is not being maintained anymore.

Visit Pythagora.ai for more info


See it in action

(click to open the video in YouTube) (1:04min)


Pythagora-io%2Fgpt-pilot | Trendshift

GPT Pilot is the core technology for the Pythagora VS Code extension that aims to provide the first real AI developer companion. Not just an autocomplete or a helper for PR messages but rather a real AI developer that can write full features, debug them, talk to you about issues, ask for review, etc.


📫 If you would like to get updates on future releases or just get in touch, join our Discord server or you can add your email here. 📬



GPT Pilot aims to research how much LLMs can be utilized to generate fully working, production-ready apps while the developer oversees the implementation.

The main idea is that AI can write most of the code for an app (maybe 95%), but for the rest, 5%, a developer is and will be needed until we get full AGI.

If you are interested in our learnings during this project, you can check our latest blog posts.



👉 Examples of apps written by GPT Pilot 👈



🔌 Requirements

🚦How to start using gpt-pilot?

👉 If you are using VS Code as your IDE, the easiest way to start is by downloading GPT Pilot VS Code extension. 👈

Otherwise, you can use the CLI tool.

If you're new to GPT Pilot:

After you have Python and (optionally) PostgreSQL installed, follow these steps:

  1. git clone https://github.com/Pythagora-io/gpt-pilot.git (clone the repo)
  2. cd gpt-pilot (go to the repo folder)
  3. python3 -m venv venv (create a virtual environment)
  4. source venv/bin/activate (or on Windows venv\Scripts\activate) (activate the virtual environment)
  5. pip install -r requirements.txt (install the dependencies)
  6. cp example-config.json config.json (create config.json file)
  7. Set your key and other settings in config.json file:
    • LLM Provider (openai, anthropic or groq) key and endpoints (leave null for default) (note that Azure and OpenRouter are suppored via the openai setting)
    • Your API key (if null, will be read from the environment variables)
    • database settings: sqlite is used by default, PostgreSQL should also work
    • optionally update fs.ignore_paths and add files or folders which shouldn't be tracked by GPT Pilot in workspace, useful to ignore folders created by compilers
  8. python main.py (start GPT Pilot)

All generated code will be stored in the folder workspace inside the folder named after the app name you enter upon starting the pilot.

🔎 Examples

Click here to see all example apps created with GPT Pilot.

PostgreSQL support

GPT Pilot uses built-in SQLite database by default. If you want to use the PostgreSQL database, you need to additional install asyncpg and psycopg2 packages:

pip install asyncpg psycopg2

Then, you need to update the config.json file to set db.url to postgresql+asyncpg://<user>:<password>@<db-host>/<db-name>.

🧑‍💻️ CLI arguments

List created projects (apps)

python main.py --list

Note: for each project (app), this also lists "branches". Currently we only support having one branch (called "main"), and in the future we plan to add support for multiple project branches.

Load and continue from the latest step in a project (app)

python main.py --project <app_id>

Load and continue from a specific step in a project (app)

python main.py --project <app_id> --step <step>

Warning: this will delete all progress after the specified step!

Delete project (app)

python main.py --delete <app_id>

Delete project with the specified app_id. Warning: this cannot be undone!

Other command-line options

There are several other command-line options that mostly support calling GPT Pilot from our VSCode extension. To see all the available options, use the --help flag:

python main.py --help

🏗 How GPT Pilot works?

Here are the steps GPT Pilot takes to create an app:

  1. You enter the app name and the description.
  2. Product Owner agent like in real life, does nothing. :)
  3. Specification Writer agent asks a couple of questions to understand the requirements better if project description is not good enough.
  4. Architect agent writes up technologies that will be used for the app and checks if all technologies are installed on the machine and installs them if not.
  5. Tech Lead agent writes up development tasks that the Developer must implement.
  6. Developer agent takes each task and writes up what needs to be done to implement it. The description is in human-readable form.
  7. Code Monkey agent takes the Developer's description and the existing file and implements the changes.
  8. Reviewer agent reviews every step of the task and if something is done wrong Reviewer sends it back to Code Monkey.
  9. Troubleshooter agent helps you to give good feedback to GPT Pilot when something is wrong.
  10. Debugger agent hate to see him, but he is your best friend when things go south.
  11. Technical Writer agent writes documentation for the project.

🕴How's GPT Pilot different from Smol developer and GPT engineer?

🍻 Contributing

If you are interested in contributing to GPT Pilot, join our Discord server, check out open GitHub issues, and see if anything interests you. We would be happy to get help in resolving any of those. The best place to start is by reviewing blog posts mentioned above to understand how the architecture works before diving into the codebase.

🖥 Development

Other than the research, GPT Pilot needs to be debugged to work in different scenarios. For example, we realized that the quality of the code generated is very sensitive to the size of the development task. When the task is too broad, the code has too many bugs that are hard to fix, but when the development task is too narrow, GPT also seems to struggle in getting the task implemented into the existing code.

📊 Telemetry

To improve GPT Pilot, we are tracking some events from which you can opt out at any time. You can read more about it here.

🔗 Connect with us

🌟 As an open-source tool, it would mean the world to us if you starred the GPT-pilot repo 🌟

💬 Join the Discord server to get in touch.

gpt-pilot (Pythagora-io/gpt-pilot)

coding-assistant
Searching Database…

33.7K ·GitHub
What is this?An AI developer that builds whole apps step by step while you supervise — the core technology behind the Pythagora VS Code extension, and a research project on how far LLMs can go toward fully working, production-ready apps.
So is it a VS Code extension or a command-line tool?Both. The easiest route is the GPT Pilot VS Code extension, and the same engine also runs as a standalone Python CLI you drive from the terminal.
How do I get it running from the terminal?Install Python 3.9+, clone the repo into a virtualenv, pip install -r requirements.txt, copy example-config.json to config.json, add your LLM API key there, then run python main.py. A Docker setup is documented too.
Which LLM providers can I plug in?Python 3.9+ plus an API key for openai, anthropic or groq (Azure and OpenRouter work through the openai setting). SQLite is the default database; PostgreSQL also works via asyncpg and psycopg2.
Is it safe to clone and run today?Be careful: the repo is no longer maintained and hosted a credential-stealing supply-chain worm in core/telemetry/ from August 2025 to 11 June 2026. The payload only ran if you executed GPT Pilot from source in that window — if that was you, rotate every credential that machine had.
Do I still need to write code myself, or is it fully autonomous?You stay the developer in charge: GPT Pilot writes maybe 95% of the code, but you review what it does and step in to fix issues on the remaining 5% when it gets stuck.
Does it track telemetry while I use it?Yes — it records some events to improve the product, and you can opt out of telemetry at any time.
How does it actually build an app?A pipeline of specialized agents: you give the app name and description, a Specification Writer clarifies requirements, the Architect picks and installs the tech stack, the Tech Lead splits work into tasks, and Developer, Code Monkey, Reviewer, Debugger and Technical Writer agents implement, check and document each step.
How is it different from GPT Engineer or Smol Developer?Instead of dumping a whole codebase at once, it codes step by step like a human developer, so bugs get debugged as they arise. It also filters context, showing the LLM only the code relevant to the current task, which lets it work on larger apps.
Can I come back to a finished app and keep building on it?Yes — once an app is done you continue by writing instructions for the next feature, and CLI commands let you resume from the latest step or a specific one (which deletes progress after it). Only a single branch called main is supported.
Where does the code it writes end up?In a workspace folder, inside a subfolder named after the app name you enter when starting the pilot.
Size
351.5 MB
Stars
33.7K
Updated
CommitJun 12
Age
3y
Commits · 90 Days