
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
samarthya-bot
Advanced tools
SamarthyaBot — Privacy-First Local Agentic AI Operating System. Self-hosted multi-agent RPA engine with Telegram, Discord, Web Dashboard, Puppeteer browser control, SSH deployment, encrypted memory, voice transcription, and Indian workflow automation (GST
Multi-Agent · Autonomous · Privacy-First · Offline-Capable · Cross-Platform · Made in India 🇮🇳
Quick Start · Cross-Platform · Skills · Commands · AI Providers · FAQ · Contribute
SamarthyaBot (समर्थ्य बोट) is a privacy-first, self-hosted, multi-agent AI operating system that runs entirely on your machine — Windows, macOS, or Linux. Unlike cloud assistants, it keeps your data local, encrypted, and under your control.
It is not just a chatbot — it's a full RPA (Robotic Process Automation) agent that can:
/slash commands.js file for a new skillThe most feature-rich, self-hosted AI agent that runs identically on all three OSes — with 34 built-in skills, 9 AI providers, and a free fully-offline mode via Ollama.
SamarthyaBot detects your OS at runtime and adapts every shell command, file path, browser launch, and "open" action accordingly. No more "works on Linux, breaks on Windows."
| Capability | 🪟 Windows | 🍎 macOS | 🐧 Linux |
|---|---|---|---|
| Shell execution | cmd.exe | /bin/sh | /bin/sh |
| Open URL/file/app | start | open | xdg-open |
| Live terminal streaming | ✅ Go worker → Node fallback | ✅ Go worker → Node fallback | ✅ Go worker |
| Browser discovery | Chrome / Edge / Brave | Chrome / Chromium / Edge / Brave | Chrome / Chromium / Edge / Brave |
| Clipboard | clip | pbcopy | xclip / xsel / wl-copy |
| Port management (CLI) | netstat + taskkill | lsof | lsof / fuser |
⚙️ How it works: A single source of truth —
backend/services/system/platform.js— resolves OS-specific behaviour. The LLM is also told the exact host OS in its system prompt, so it only emits commands valid for your platform.
🔁 Zero-binary fallback: The optional ultra-fast Go micro-worker streams long commands. If its binary isn't built for your platform, SamarthyaBot transparently falls back to a native Node executor — so heavy DevOps tasks work everywhere, out of the box.
Prerequisites: Node.js 20 LTS · MongoDB (local) Free API keys: Gemini · Ollama (offline)
# 1. Install globally (works on Windows, macOS, Linux)
npm install -g samarthya-bot
# 2. Interactive setup wizard — picks provider, keys, channels
samarthya onboard
# 3. Launch engine + dashboard
samarthya gateway
# 4. (Optional) Expose to internet & link Telegram
samarthya tunnel
🎉 Open http://localhost:5000 for the dashboard.
git clone https://github.com/mebishnusahu0595/SamarthyaBot.git
cd SamarthyaBot
npm install
samarthya onboard
npm run start
| Feature | Description | Status |
|---|---|---|
| 🖥️ True Cross-Platform | OS auto-detected; commands adapt to Windows/macOS/Linux | ✅ Live |
| 🤖 Full RPA Engine | Writes code, commits to GitHub, deploys to VPS | ✅ Live |
| ⚡ Live Terminal | Go micro-worker streaming + automatic Node fallback | ✅ Live |
| 🌍 SSH Deployments | Remote deploy via password or PEM key from a chat prompt | ✅ Live |
| 🕸️ Browser Controller | Puppeteer real DOM — scrape, click, navigate, fill forms | ✅ Live |
| 🛡️ Hardened Sandbox | Workspace path enforcement + chained-command blacklist | ✅ Live |
| 🧠 Autonomous Planner | 20-step ReAct loop with failure recovery & retries | ✅ Live |
| 💬 Slash Commands | /status, /tools, /pack, /model on every channel | ✅ Live |
| 🔐 Encrypted Memory | AES-256-CBC encrypted local memory in MongoDB | ✅ Live |
| 🇮🇳 Indian Localization | GST, UPI, QR codes, IRCTC, Hindi/Hinglish | ✅ Live |
| 🛠️ 34 Built-in Skills | Files, web, crypto, translate, QR, currency & more | ✅ Live |
| 📱 Telegram + Discord | Two-way bots with webhooks, mentions & voice | ✅ Live |
| 🌐 React Dashboard | Dark glassmorphism UI with realtime updates | ✅ Live |
| 🔌 Plugin System | Drop a .js file → new AI skill, zero restart | ✅ Live |
| 🎙️ Voice (Whisper) | Groq/Whisper transcription for voice notes | ✅ Live |
| 💓 Heartbeat Tasks | Periodic autonomous tasks from HEARTBEAT.md | ✅ Live |
| 📁 Files & System | 🌐 Web & Network |
|---|---|
|
|
| 🇮🇳 India & Productivity | 🔐 Utilities & Security |
|
|
Control the agent directly from any channel (Web, Telegram, Discord) — instant, no LLM call:
| Command | Action |
|---|---|
/help | List all commands |
/status | Provider, model, active pack & host OS |
/tools /skills | List skills in your current pack |
/pack [name] | Show or switch pack (student/business/developer/personal) |
/model | Show active AI provider + model |
/memory | Count of stored memories |
/whoami | Your profile & permissions |
/new /clear /reset | Start a fresh conversation |
/version | SamarthyaBot version |
| Provider | Models | Cost | Best For |
|---|---|---|---|
| Google Gemini | gemini-2.5-flash / pro | 🟢 Free tier | Default, great balance |
| Ollama | Llama 3, Mistral, Dolphin | 🟢 Free (local) | 100% offline, zero data leakage |
| Groq | Llama 3.3 70B, Qwen3 32B | 🟢 Free tier | Fastest inference |
| Anthropic | Claude 3.5 Sonnet / Opus | 🟡 Paid | Smartest reasoning |
| OpenAI | GPT-5.2, GPT-5-mini, o3-mini | 🟡 Paid | Coding & agentic tasks |
| DeepSeek | DeepSeek Chat / Coder | 🟢 Budget | Affordable coding |
| Qwen | Qwen Max / Turbo | 🟢 Budget | Alibaba's best |
| OpenRouter | 100+ models | 🟡 Varies | Access any model |
| Mistral | Mistral Large 3, Devstral 2 | 🟡 Paid | EU privacy, code agents |
| Channel | Setup | Status |
|---|---|---|
| 📱 Telegram | Bot token + samarthya tunnel | ✅ Live |
| 🟣 Discord | Bot token + intents + invite URL | ✅ Live |
| 🌐 Web Dashboard | Built-in at http://localhost:5000 | ✅ Live |
| Business API integration | 🔜 Coming | |
| 💼 Slack | Webhook + App | 📋 Planned |
@BotFather → /newbot → copy token.env: TELEGRAM_BOT_TOKEN=YOUR_BOT_TOKENsamarthya gateway then samarthya tunnel (new terminal). The tunnel auto-sets the webhook. 🚀.env:
DISCORD_BOT_TOKEN=YOUR_BOT_TOKEN
DISCORD_ALLOW_FROM=YOUR_USER_ID
bot → invite → samarthya gatewaySamarthyaBot is defense-in-depth by default:
| Layer | What it does |
|---|---|
| 🏠 Local control plane | Runs entirely on your machine — zero cloud dependency |
| 🔐 AES-256-CBC | All memories & secrets encrypted at rest |
| 🛡️ Workspace sandbox | File reads/writes confined to the workspace (RESTRICT_TO_WORKSPACE) — enforced in every file tool |
| 🚫 Command blacklist | Blocks rm -rf, mkfs, dd, fork bombs, format, del /f, remote-shell downloads — per-segment, so echo x && rm -rf / is also blocked |
| 🌐 SSRF guard | http_request rejects non-http(s) schemes; file:// is blocked |
| 🔑 Secret-safe | Generated passwords are never logged or stored |
| 🔌 Offline mode | Ollama = 100% offline, zero data leakage |
| 🚨 Kill switch | samarthya stop — instant shutdown |
🧪 Hardened in v2.3.0: the workspace sandbox is now wired into
file_read/file_write/file_list, and the command guard validates every segment of chained commands. See SECURITY.md to report issues.
Telegram / Discord / WebUI / CLI
│
▼
┌────────────────────────────────────────────┐
│ SamarthyaBot Gateway │
│ (Control Plane :5000) │
├────────────────────────────────────────────┤
│ ┌────────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Slash-Cmds │ │ Planner │ │ LLM Hub │ │
│ │ (instant) │ │ (ReAct) │ │ (9 prov) │ │
│ └────────────┘ └────┬─────┘ └────┬─────┘ │
│ │ │ │
│ ┌───────────────────┴────────────┴──────┐ │
│ │ Tools Engine (34 skills + plugins) │ │
│ └───────────────────┬───────────────────┘ │
│ │ │
│ ┌───────────┐ ┌─────┴──────┐ ┌──────────┐ │
│ │ platform │ │ Go Worker │ │ Sandbox /│ │
│ │ helper │ │ + Node │ │ Security │ │
│ │ (OS-aware)│ │ fallback │ │ guard │ │
│ └───────────┘ └────────────┘ └──────────┘ │
│ ┌───────────┐ ┌────────────┐ ┌──────────┐ │
│ │ Memory │ │ Browser │ │ Heartbeat│ │
│ │ (AES-256) │ │(Puppeteer) │ │ / Cron │ │
│ └───────────┘ └────────────┘ └──────────┘ │
└────────────────────────────────────────────┘
│
▼
MongoDB (Local, Encrypted)
Give your AI new superpowers — drop a .js file in ~/SamarthyaBot_Files/plugins/:
// weather.js
module.exports = {
name: 'get_weather',
description: 'Gets current weather for a city',
parameters: { city: { type: 'string', required: true } },
execute: async (args) => {
const res = await fetch(`https://wttr.in/${args.city}?format=j1`);
const data = await res.json();
return {
success: true,
result: `${args.city}: ${data.current_condition[0].temp_C}°C`
};
}
};
Restart the gateway — the agent can now check weather autonomously! 🌦️
| Command | Action |
|---|---|
samarthya onboard | Interactive setup wizard |
samarthya gateway | Start backend engine + dashboard |
samarthya tunnel | Expose to internet & link Telegram |
samarthya model | Swap LLM provider/model |
samarthya telegram / discord | Configure a channel |
samarthya config | View current configuration |
samarthya status | Show engine status |
samarthya stop / restart | Stop / restart the gateway |
| OpenClaw | PicoClaw | SamarthyaBot 🇮🇳 | |
|---|---|---|---|
| Cross-Platform | ✅ | ✅ | ✅ OS auto-adapts |
| Browser Control | ❌ / search | ❌ search only | ✅ Real Puppeteer DOM |
| Web Dashboard | ✅ | ❌ CLI only | ✅ React glassmorphism |
| Live Terminal | ❌ | ❌ async spawn | ✅ Go + Node fallback |
| Slash Commands | ✅ | partial | ✅ Every channel |
| Indian Workflows | ❌ | ❌ | ✅ GST/UPI/QR/IRCTC |
| Encrypted Memory | ❌ plaintext | ❌ markdown | ✅ AES-256-CBC + Mongo |
| Built-in Skills | 100+ external | skills folder | 34 built-in + plugins |
| SSH Deploy | ❌ | ❌ | ✅ Password + PEM |
| Install | moderate | single binary | npm i -g samarthya-bot |
| AI Providers | many | 3-4 | 9 providers, 20+ models |
PRs welcome! See CONTRIBUTING.md and our Code of Conduct.
git clone https://github.com/mebishnusahu0595/SamarthyaBot.git
cd SamarthyaBot && npm install
Yes. SamarthyaBot detects your OS at runtime and adapts every shell command, file path, browser launch and "open" action. The LLM is told your exact OS so it only emits valid commands, and the live-terminal worker falls back to native Node if the Go binary isn't built for your platform.
Yes — 100% free and open-source under MIT. It supports free providers like Gemini and Ollama (fully offline).
Yes. With Ollama, SamarthyaBot runs 100% offline with zero data leakage.
Everything runs on your machine. Memories are AES-256-CBC encrypted, file tools are sandboxed to your workspace, and dangerous commands are blocked per-segment.
Drop a .js file in ~/SamarthyaBot_Files/plugins/ with name, description, parameters, and an execute function. See Developing Plugins.
MIT License — free to use, modify, and distribute.
Built with ❤️ in India 🇮🇳 by Bishnu Prasad Sahu
📦 NPM · 🐙 GitHub · 🐛 Report Bug · ✨ Request Feature
If SamarthyaBot helps you, please give it a ⭐ — it really helps!
FAQs
SamarthyaBot — Privacy-First Local Agentic AI Operating System. Self-hosted multi-agent RPA engine with Telegram, Discord, Web Dashboard, Puppeteer browser control, SSH deployment, encrypted memory, voice transcription, and Indian workflow automation (GST
The npm package samarthya-bot receives a total of 102 weekly downloads. As such, samarthya-bot popularity was classified as not popular.
We found that samarthya-bot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.