
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
@agentic.artists/openanalysis
Advanced tools
A local BYOK MCP server that helps AI assistants choose models using OpenRouter ZDR endpoint data and Artificial Analysis benchmarks.
Stop guessing which AI model to use.
OpenAnalysis is a local, bring-your-own-key MCP server that gives your AI assistant current model-selection context from OpenRouter Zero Data Retention endpoints and Artificial Analysis benchmarks.
No hosted service. No account. No deployment. Your API keys are supplied locally and used only to call the upstream services directly.
Model choice is no longer just "which model has the highest benchmark score?" The right answer depends on the workload and the endpoint you can actually use.
OpenAnalysis helps your chat agent reason over:
Hard constraints are checked against a single real ZDR endpoint. A model does not qualify for tool use plus 100k context unless at least one current ZDR endpoint satisfies both.
The chat model makes the final recommendation based on your use case. OpenAnalysis deliberately does not impose one universal ranking formula.
Requirements:
OpenAnalysis is published on npm as:
@agentic.artists/openanalysis
Most stdio MCP hosts can launch OpenAnalysis directly with npx.
{
"mcpServers": {
"openanalysis": {
"command": "npx",
"args": ["-y", "@agentic.artists/openanalysis"],
"env": {
"ARTIFICIAL_ANALYSIS_API_KEY": "YOUR_KEY",
"OPENROUTER_API_KEY": "YOUR_KEY"
}
}
}
}
On Windows GUI clients where npx is not available on the app's PATH, use the full path to npx.cmd or use the local-clone setup below.
.env.localThis option keeps the API keys in a local gitignored file and generates client config with absolute Node/server paths.
git clone https://github.com/AgenticArtists/OpenAnalysis.git
cd OpenAnalysis
npm.cmd install
npm.cmd run setup
git clone https://github.com/AgenticArtists/OpenAnalysis.git
cd OpenAnalysis
npm install
npm run setup
The setup command:
.env.localIf PowerShell blocks npm.ps1, use npm.cmd; you do not need to change your execution policy.
Either use the npm config above or run the local setup command and paste the generated Hermes Desktop / Cursor MCP config.
In Hermes Desktop, open Skills & Tools → MCP, import the JSON, and save it. Hermes should discover three tools:
recommend_modelscompare_modelsopenanalysis_statusThen start a normal chat and ask something like:
I need a model for a long-running autonomous coding agent. ZDR is mandatory, tool calling is required, and I need at least 100k context. Quality matters more than cost, but I care about value. What should I use?
More client setup examples and manual configuration are in LOCAL_MCP.md.
What's the cheapest model I'd trust with repetitive coding subagents? ZDR and tool use are required.
I need 200k context, tool use, and ZDR. What are my best current options?
Is the premium frontier model actually worth the price for this coding workload?
Best model for extracting structured data from thousands of documents while keeping output cost low?
I need maximum autonomous coding performance under $10 per million output tokens. What should I use?
recommend_modelsThe primary tool. It accepts a workload plus hard constraints such as:
It returns current candidates that are both ZDR-eligible and confidently matched to Artificial Analysis data. The host model then makes the recommendation.
compare_modelsReturns current Artificial Analysis benchmark information and OpenRouter ZDR endpoint information for a specific shortlist of OpenRouter model IDs.
openanalysis_statusShows match coverage, ambiguous/unmatched records, cache state, and Artificial Analysis rate-limit metadata.
The Artificial Analysis Free API does not expose an OpenRouter model ID. OpenAnalysis therefore reconciles models conservatively:
OpenAnalysis does not fuzzy-match uncertain model variants. This is intentional: a missing candidate is better than attaching benchmark data to the wrong model.
Verified aliases live in config/aliases.json.
OpenAnalysis identifies models with current ZDR-capable OpenRouter endpoints. If you later call a selected model through OpenRouter, enforce ZDR again in the actual inference request:
{
"provider": {
"zdr": true,
"require_parameters": true
}
}
OpenAnalysis uses data accessed with your own API credentials.
OpenAnalysis is not affiliated with or endorsed by Artificial Analysis or OpenRouter.
The OpenAnalysis source code is licensed under the MIT License. Upstream data and APIs remain subject to their respective terms. In particular, Artificial Analysis API access may have restrictions on external use and redistribution. OpenAnalysis does not bundle or host their dataset; each user accesses upstream data with their own credentials and is responsible for complying with the applicable terms.
See ATTRIBUTION.md for more detail.
.env.local is gitignored for the clone-based setup.If you discover a security issue, see SECURITY.md.
Install dependencies and run validation:
npm.cmd install
npm.cmd test
npm.cmd run check
npm.cmd run pack:check
Test the MCP process manually:
npm.cmd run mcp
A healthy server prints:
OpenAnalysis MCP server running on stdio
and waits for an MCP client. Press Ctrl+C to stop it.
Contributions are welcome. See CONTRIBUTING.md.
MIT. See LICENSE.
FAQs
A local BYOK MCP server that helps AI assistants choose models using OpenRouter ZDR endpoint data and Artificial Analysis benchmarks.
The npm package @agentic.artists/openanalysis receives a total of 5 weekly downloads. As such, @agentic.artists/openanalysis popularity was classified as not popular.
We found that @agentic.artists/openanalysis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.