
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
@agentic.artists/openanalysis
Advanced tools
A local BYOK MCP server that helps AI assistants choose models using OpenRouter ZDR endpoint data and Artificial Analysis benchmarks.
Stop guessing which AI model to use.
OpenAnalysis is a local, bring-your-own-key MCP server that gives your AI assistant current model-selection context from OpenRouter Zero Data Retention endpoints and Artificial Analysis benchmarks.
No hosted service. No account. No deployment. Your API keys stay on your machine and are used only to call the upstream services directly.
Model choice is no longer just "which model has the highest benchmark score?" The right answer depends on the workload and the endpoint you can actually use.
OpenAnalysis helps your chat agent reason over:
Hard constraints are checked against a single real ZDR endpoint. A model does not qualify for tool use plus 100k context unless at least one current ZDR endpoint satisfies both.
The chat model makes the final recommendation based on your use case. OpenAnalysis deliberately does not impose one universal ranking formula.
Requirements:
git clone https://github.com/AgenticArtists/OpenAnalysis.git
cd OpenAnalysis
npm.cmd install
npm.cmd run setup
npm.cmd run setup:
.env.localIf PowerShell blocks npm.ps1, use npm.cmd as shown above. You do not need to change your execution policy.
git clone https://github.com/AgenticArtists/OpenAnalysis.git
cd OpenAnalysis
npm install
npm run setup
The same setup command generates absolute Node and server paths for the machine it runs on.
After running setup, copy the Hermes Desktop / Cursor MCP config it prints.
In Hermes Desktop, open Skills & Tools → MCP, import the JSON, and save it. Hermes should discover three tools:
recommend_modelscompare_modelsopenanalysis_statusThen start a normal chat and ask something like:
I need a model for a long-running autonomous coding agent. ZDR is mandatory, tool calling is required, and I need at least 100k context. Quality matters more than cost, but I care about value. What should I use?
More client setup examples and manual configuration are in LOCAL_MCP.md.
What's the cheapest model I'd trust with repetitive coding subagents? ZDR and tool use are required.
I need 200k context, tool use, and ZDR. What are my best current options?
Is the premium frontier model actually worth the price for this coding workload?
Best model for extracting structured data from thousands of documents while keeping output cost low?
I need maximum autonomous coding performance under $10 per million output tokens. What should I use?
recommend_modelsThe primary tool. It accepts a workload plus hard constraints such as:
It returns current candidates that are both ZDR-eligible and confidently matched to Artificial Analysis data. The host model then makes the recommendation.
compare_modelsReturns current Artificial Analysis benchmark information and OpenRouter ZDR endpoint information for a specific shortlist of OpenRouter model IDs.
openanalysis_statusShows match coverage, ambiguous/unmatched records, cache state, and Artificial Analysis rate-limit metadata.
The Artificial Analysis Free API does not expose an OpenRouter model ID. OpenAnalysis therefore reconciles models conservatively:
OpenAnalysis does not fuzzy-match uncertain model variants. This is intentional: a missing candidate is better than attaching benchmark data to the wrong model.
Verified aliases live in config/aliases.json.
OpenAnalysis identifies models with current ZDR-capable OpenRouter endpoints. If you later call a selected model through OpenRouter, enforce ZDR again in the actual inference request:
{
"provider": {
"zdr": true,
"require_parameters": true
}
}
OpenAnalysis uses data accessed with your own API credentials.
OpenAnalysis is not affiliated with or endorsed by Artificial Analysis or OpenRouter.
The OpenAnalysis source code is licensed under the MIT License. Upstream data and APIs remain subject to their respective terms. In particular, Artificial Analysis API access may have restrictions on external use and redistribution. OpenAnalysis does not bundle or host their dataset; each user accesses upstream data with their own credentials and is responsible for complying with the applicable terms.
See ATTRIBUTION.md for more detail.
.env.local is gitignored.If you discover a security issue, see SECURITY.md.
If you prefer not to use the setup script:
Copy-Item .env.local.example .env.local
notepad .env.local
Add:
ARTIFICIAL_ANALYSIS_API_KEY=your_key_here
OPENROUTER_API_KEY=your_key_here
Then use one of the MCP configurations in LOCAL_MCP.md.
Install dependencies and run validation:
npm.cmd install
npm.cmd test
npm.cmd run check
Test the MCP process manually:
npm.cmd run mcp
A healthy server prints:
OpenAnalysis MCP server running on stdio
and waits for an MCP client. Press Ctrl+C to stop it.
Contributions are welcome. See CONTRIBUTING.md.
MIT. See LICENSE.
FAQs
A local BYOK MCP server that helps AI assistants choose models using OpenRouter ZDR endpoint data and Artificial Analysis benchmarks.
The npm package @agentic.artists/openanalysis receives a total of 5 weekly downloads. As such, @agentic.artists/openanalysis popularity was classified as not popular.
We found that @agentic.artists/openanalysis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.