ruflo 3.7.0-alpha.8 → 3.7.0-alpha.81
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +390 -23
- package/package.json +16 -3
- package/src/mcp-bridge/index.js +25 -1
- package/src/ruvocal/.swarm/schema.sql +2 -2
- package/src/ruvocal/mcp-bridge/index.js +25 -1
package/README.md
CHANGED
|
@@ -1,45 +1,412 @@
|
|
|
1
|
+
<div align="center">
|
|
2
|
+
|
|
3
|
+
[](https://cognitum.one/agentic-engineering)
|
|
4
|
+
|
|
5
|
+
[](https://flo.ruv.io/)
|
|
6
|
+
[](https://goal.ruv.io/)
|
|
7
|
+
[](https://goal.ruv.io/agents)
|
|
8
|
+
|
|
9
|
+
[](https://www.npmjs.com/package/ruflo)
|
|
10
|
+
[](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
|
|
11
|
+
[](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
|
|
12
|
+
|
|
13
|
+
[](https://github.com/ruvnet/claude-flow)
|
|
14
|
+
[](https://opensource.org/licenses/MIT)
|
|
15
|
+
[](https://github.com/ruvnet/claude-flow)
|
|
16
|
+
[](https://www.npmjs.com/package/@claude-flow/codex)
|
|
17
|
+
[](https://github.com/ruvnet/ruvector)
|
|
18
|
+
|
|
19
|
+
[](https://cognitum.one/appliance)
|
|
20
|
+
|
|
21
|
+
[](https://github.com/ruvnet/ruflo/issues/1967)
|
|
22
|
+
|
|
1
23
|
# Ruflo
|
|
2
24
|
|
|
3
|
-
|
|
25
|
+
**Multi-agent AI orchestration for Claude Code**
|
|
4
26
|
|
|
5
|
-
|
|
27
|
+
</div>
|
|
6
28
|
|
|
7
|
-
|
|
29
|
+
Orchestrate 100+ specialized AI agents across machines, teams, and trust boundaries. Ruflo adds coordinated swarms, self-learning memory, federated comms, and enterprise security to Claude Code — so agents don't just run, they collaborate.
|
|
30
|
+
|
|
31
|
+
### Why Ruflo?
|
|
32
|
+
|
|
33
|
+
> Claude Flow is now Ruflo — named by [`rUv`](https://ruv.io), who loves Rust, flow states, and building things that feel inevitable. The "Ru" is the rUv. The "flo" is working until 3am. Underneath, powered by [`Cognitum.One`](https://cognitum.one/?RuFlo) agentic architecture, running a supercharged Rust based AI engine, embeddings, memory, and plugin system.
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
### What Ruflo Does
|
|
37
|
+
|
|
38
|
+
One `npx ruvflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
|
|
39
|
+
|
|
40
|
+
```
|
|
41
|
+
Self-Learning / Self-Optimizing Agent Architecture
|
|
42
|
+
|
|
43
|
+
User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Providers
|
|
44
|
+
^ |
|
|
45
|
+
+---- Learning Loop <-------+
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
> **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally -- the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
|
|
49
|
+
|
|
50
|
+
---
|
|
51
|
+
|
|
52
|
+
|
|
53
|
+
|
|
54
|
+
## Quick Start
|
|
55
|
+
|
|
56
|
+
There are **two different install paths** with very different surface areas. Pick based on what you need (#1744):
|
|
57
|
+
|
|
58
|
+
| | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** |
|
|
59
|
+
|---|---|---|
|
|
60
|
+
| What it gives you | Slash commands + a few skills + agent definitions per-plugin | Full Ruflo loop — 98 agents, 60+ commands, 30 skills, MCP server, hooks, daemon |
|
|
61
|
+
| Files in your workspace | **Zero** | `.claude/`, `.claude-flow/`, `CLAUDE.md`, helpers, settings |
|
|
62
|
+
| MCP server registered | **No** (`memory_store`, `swarm_init`, etc. unavailable to Claude) | Yes |
|
|
63
|
+
| Hooks installed | No | Yes |
|
|
64
|
+
| Best for | Try a single plugin's commands without committing to the full install | Production use — everything works as documented |
|
|
65
|
+
|
|
66
|
+
### Path A — Claude Code Plugins (lite, slash commands only)
|
|
8
67
|
|
|
9
68
|
```bash
|
|
10
|
-
#
|
|
11
|
-
|
|
69
|
+
# Add the marketplace
|
|
70
|
+
/plugin marketplace add ruvnet/ruflo
|
|
71
|
+
|
|
72
|
+
# Install core + any plugins you need
|
|
73
|
+
/plugin install ruflo-core@ruflo
|
|
74
|
+
/plugin install ruflo-swarm@ruflo
|
|
75
|
+
/plugin install ruflo-rag-memory@ruflo
|
|
76
|
+
/plugin install ruflo-neural-trader@ruflo
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
This adds slash commands and agent definitions only. The Ruflo MCP server is NOT registered, so `memory_store`, `swarm_init`, `agent_spawn`, etc. won't be callable from Claude. For the full loop, use Path B below.
|
|
80
|
+
|
|
81
|
+
<details>
|
|
82
|
+
<summary><strong>🔌 All 33 plugins</strong></summary>
|
|
12
83
|
|
|
13
|
-
|
|
14
|
-
npm install -g ruflo
|
|
84
|
+
#### Core & Orchestration
|
|
15
85
|
|
|
16
|
-
|
|
17
|
-
|
|
86
|
+
| Plugin | What it does |
|
|
87
|
+
|--------|-------------|
|
|
88
|
+
| [**ruflo-core**](plugins/ruflo-core/README.md) | Foundation — server, health checks, plugin discovery |
|
|
89
|
+
| [**ruflo-swarm**](plugins/ruflo-swarm/README.md) | Coordinate multiple agents as a team |
|
|
90
|
+
| [**ruflo-autopilot**](plugins/ruflo-autopilot/README.md) | Let agents run autonomously in a loop |
|
|
91
|
+
| [**ruflo-loop-workers**](plugins/ruflo-loop-workers/README.md) | Schedule background tasks on a timer |
|
|
92
|
+
| [**ruflo-workflows**](plugins/ruflo-workflows/README.md) | Reusable multi-step task templates |
|
|
93
|
+
| [**ruflo-federation**](plugins/ruflo-federation/README.md) | Agents on different machines collaborate securely |
|
|
94
|
+
|
|
95
|
+
#### Memory & Knowledge
|
|
96
|
+
|
|
97
|
+
| Plugin | What it does |
|
|
98
|
+
|--------|-------------|
|
|
99
|
+
| [**ruflo-agentdb**](plugins/ruflo-agentdb/README.md) | Fast vector database for agent memory |
|
|
100
|
+
| [**ruflo-rag-memory**](plugins/ruflo-rag-memory/README.md) | Smart retrieval — hybrid search, graph hops, diversity ranking |
|
|
101
|
+
| [**ruflo-rvf**](plugins/ruflo-rvf/README.md) | Save and restore agent memory across sessions |
|
|
102
|
+
| [**ruflo-ruvector**](plugins/ruflo-ruvector/README.md) | [`ruvector`](https://npmjs.com/package/ruvector) — GPU-accelerated search, Graph RAG, 103 tools |
|
|
103
|
+
| [**ruflo-knowledge-graph**](plugins/ruflo-knowledge-graph/README.md) | Build and traverse entity relationship maps |
|
|
104
|
+
|
|
105
|
+
#### Intelligence & Learning
|
|
106
|
+
|
|
107
|
+
| Plugin | What it does |
|
|
108
|
+
|--------|-------------|
|
|
109
|
+
| [**ruflo-intelligence**](plugins/ruflo-intelligence/README.md) | Agents learn from past successes and get smarter |
|
|
110
|
+
| [**ruflo-graph-intelligence**](plugins/ruflo-graph-intelligence/) | Sublinear graph reasoning — PageRank, delta updates, complexity-aware execution (ADR-123) |
|
|
111
|
+
| [**ruflo-daa**](plugins/ruflo-daa/README.md) | Dynamic agent behavior and cognitive patterns |
|
|
112
|
+
| [**ruflo-ruvllm**](plugins/ruflo-ruvllm/README.md) | Run local LLMs (Ollama, etc.) with smart routing |
|
|
113
|
+
| [**ruflo-goals**](plugins/ruflo-goals/README.md) | Break big goals into plans and track progress |
|
|
114
|
+
|
|
115
|
+
#### Code Quality & Testing
|
|
116
|
+
|
|
117
|
+
| Plugin | What it does |
|
|
118
|
+
|--------|-------------|
|
|
119
|
+
| [**ruflo-testgen**](plugins/ruflo-testgen/README.md) | Find missing tests and generate them automatically |
|
|
120
|
+
| [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
|
|
121
|
+
| [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
|
|
122
|
+
| [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
|
|
123
|
+
|
|
124
|
+
#### Security & Compliance
|
|
125
|
+
|
|
126
|
+
| Plugin | What it does |
|
|
127
|
+
|--------|-------------|
|
|
128
|
+
| [**ruflo-security-audit**](plugins/ruflo-security-audit/README.md) | Scan for vulnerabilities and CVEs |
|
|
129
|
+
| [**ruflo-aidefence**](plugins/ruflo-aidefence/README.md) | Block prompt injection, detect PII, safety scanning |
|
|
130
|
+
|
|
131
|
+
#### Architecture & Methodology
|
|
132
|
+
|
|
133
|
+
| Plugin | What it does |
|
|
134
|
+
|--------|-------------|
|
|
135
|
+
| [**ruflo-adr**](plugins/ruflo-adr/README.md) | Track architecture decisions with a living record |
|
|
136
|
+
| [**ruflo-ddd**](plugins/ruflo-ddd/README.md) | Scaffold domain-driven design — contexts, aggregates, events |
|
|
137
|
+
| [**ruflo-sparc**](plugins/ruflo-sparc/README.md) | Guided 5-phase development methodology with quality gates |
|
|
138
|
+
|
|
139
|
+
#### DevOps & Observability
|
|
140
|
+
|
|
141
|
+
| Plugin | What it does |
|
|
142
|
+
|--------|-------------|
|
|
143
|
+
| [**ruflo-migrations**](plugins/ruflo-migrations/README.md) | Manage database schema changes safely |
|
|
144
|
+
| [**ruflo-observability**](plugins/ruflo-observability/README.md) | Structured logs, traces, and metrics in one place |
|
|
145
|
+
| [**ruflo-cost-tracker**](plugins/ruflo-cost-tracker/README.md) | Track token usage, set budgets, get cost alerts |
|
|
146
|
+
|
|
147
|
+
#### Extensibility
|
|
148
|
+
|
|
149
|
+
| Plugin | What it does |
|
|
150
|
+
|--------|-------------|
|
|
151
|
+
| [**ruflo-agent**](plugins/ruflo-agent/README.md) | Run agents — local WASM sandbox (rvagent) + Anthropic Claude Managed Agents (cloud) |
|
|
152
|
+
| [**ruflo-plugin-creator**](plugins/ruflo-plugin-creator/README.md) | Scaffold, validate, and publish your own plugins |
|
|
153
|
+
|
|
154
|
+
#### Domain-Specific
|
|
155
|
+
|
|
156
|
+
| Plugin | What it does |
|
|
157
|
+
|--------|-------------|
|
|
158
|
+
| [**ruflo-iot-cognitum**](plugins/ruflo-iot-cognitum/README.md) | IoT device management — trust scoring, anomaly detection, fleets |
|
|
159
|
+
| [**ruflo-neural-trader**](plugins/ruflo-neural-trader/README.md) | [`neural-trader`](https://npmjs.com/package/neural-trader) — AI trading with 4 agents, backtesting, 112+ tools |
|
|
160
|
+
| [**ruflo-market-data**](plugins/ruflo-market-data/README.md) | Ingest market data, vectorize OHLCV, detect patterns |
|
|
161
|
+
|
|
162
|
+
</details>
|
|
163
|
+
|
|
164
|
+
### CLI Install
|
|
165
|
+
|
|
166
|
+
**macOS / Linux / WSL / Git-Bash:**
|
|
167
|
+
|
|
168
|
+
```bash
|
|
169
|
+
# One-line install (POSIX shells only — see Windows note below)
|
|
170
|
+
curl -fsSL https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh | bash
|
|
18
171
|
```
|
|
19
172
|
|
|
20
|
-
|
|
173
|
+
**All platforms (including native Windows PowerShell / cmd):**
|
|
21
174
|
|
|
22
175
|
```bash
|
|
23
|
-
|
|
24
|
-
ruflo
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
176
|
+
# Interactive setup wizard — runs identically on every platform
|
|
177
|
+
npx ruflo@latest init wizard
|
|
178
|
+
|
|
179
|
+
# Quick non-interactive init
|
|
180
|
+
# npx ruflo@latest init
|
|
181
|
+
|
|
182
|
+
# Or install globally
|
|
183
|
+
npm install -g ruflo@latest
|
|
28
184
|
```
|
|
29
185
|
|
|
30
|
-
|
|
186
|
+
> 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
|
|
31
187
|
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
188
|
+
### MCP Server
|
|
189
|
+
|
|
190
|
+
```bash
|
|
191
|
+
# Add Ruflo as an MCP server in Claude Code (canonical form, matches USERGUIDE.md)
|
|
192
|
+
claude mcp add ruflo -- npx ruflo@latest mcp start
|
|
193
|
+
```
|
|
36
194
|
|
|
37
|
-
|
|
195
|
+
---
|
|
196
|
+
|
|
197
|
+
## What You Get
|
|
198
|
+
|
|
199
|
+
| Capability | Description |
|
|
200
|
+
|------------|-------------|
|
|
201
|
+
| 🤖 **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
|
|
202
|
+
| 📡 **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
|
|
203
|
+
| 🐝 **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
|
|
204
|
+
| 🧠 **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
|
|
205
|
+
| 💾 **Vector Memory** | HNSW-indexed AgentDB with 150x-12,500x faster search |
|
|
206
|
+
| ⚡ **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
|
|
207
|
+
| 🧩 **Plugin Marketplace** | 32 native Claude Code plugins + 21 npm plugins |
|
|
208
|
+
| 🔌 **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
|
|
209
|
+
| 🛡️ **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
|
|
210
|
+
| 🌐 **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
|
|
211
|
+
| 💬 **[Web UI Beta](https://flo.ruv.io/)** | Multi-model chat at flo.ruv.io with parallel MCP tool calling and an in-browser WASM tool gallery |
|
|
212
|
+
| 🎯 **[RuFlo Research](https://goal.ruv.io/)** | GOAP A\* planner at goal.ruv.io — plain-English goals → executable agent plans, with a live agent dashboard at [/agents](https://goal.ruv.io/agents) |
|
|
213
|
+
|
|
214
|
+
<p align="center">
|
|
215
|
+
<a href="https://flo.ruv.io/">
|
|
216
|
+
<img src="v3/docs/assets/ruVocal.png" alt="RuFlo Web UI executing parallel MCP tool calls at flo.ruv.io — ruflo__memory_store and ruflo__memory_search firing in a single model turn with the 'Step 1 — 2 tools completed' parallel-execution indicator, thinking process panel visible, Qwen 3.6 Max as the active model. Multi-agent AI chat with Model Context Protocol (MCP) tool calling, persistent vector memory via AgentDB + HNSW, swarm coordination, and 6 frontier models including Claude Sonnet 4.6, Gemini 2.5 Pro, and OpenAI through OpenRouter." width="100%" />
|
|
217
|
+
</a>
|
|
218
|
+
</p>
|
|
219
|
+
|
|
220
|
+
### Web UI (Beta) — self-hostable, hosted demo at [flo.ruv.io](https://flo.ruv.io/)
|
|
221
|
+
|
|
222
|
+
**RuFlo's web UI is a multi-model AI chat with built-in Model Context Protocol (MCP) tool calling.** Talk to Qwen, Claude, Gemini, or OpenAI while RuFlo invokes the same MCP tools the CLI uses — agent orchestration, persistent memory, swarm coordination, code review, GitHub ops — directly from chat. No install, no API key needed to try it.
|
|
223
|
+
|
|
224
|
+
| | What it is | Why it matters |
|
|
225
|
+
|---|------------|----------------|
|
|
226
|
+
| 🧠 | **Any model, local or remote** | 6 curated frontier models out-of-the-box — Qwen 3.6 Max (default), Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 2.5 Pro, Gemini 2.5 Flash, OpenAI — via OpenRouter. Add your own: any OpenAI-compatible endpoint (vLLM, Ollama, LM Studio, Together, Groq, self-hosted). |
|
|
227
|
+
| 🦾 | **ruvLLM self-learning AI** | Native support for [ruvLLM](https://github.com/ruvnet/RuVector/tree/main/examples/ruvLLM) (lives in `ruvnet/RuVector/examples/ruvLLM`) — RuFlo's self-improving local model layer. Routes to MicroLoRA adapters, learns from your trajectories via SONA, and stays on your machine. Pair with the cloud models or run fully offline. |
|
|
228
|
+
| 🛠️ | **~210 tools, ready to call** | 5 server groups (Core, Intelligence, Agents, Memory, DevTools) plus an 18-tool gallery that runs entirely in your browser — works offline. |
|
|
229
|
+
| 🔌 | **Bring your own MCP servers** | Click the **MCP (n)** pill in the chat input → *Add Server* and paste any MCP endpoint (HTTP, SSE, or stdio). Your tools join RuFlo's native ones in the same parallel-execution flow. Run a local MCP server on `localhost:3000` and it just works. |
|
|
230
|
+
| ⚡ | **Tools run in parallel** | One model response can fire 4–6+ tools at the same time. The UI shows them as cards with a *Step 1 — 2 tools completed* badge so you can see exactly what ran. |
|
|
231
|
+
| 💾 | **Memory that sticks** | Say *"remember my favorite color is indigo"* and ask weeks later — RuFlo recalls it. Backed by AgentDB + HNSW vector search (≥150× faster than brute force). |
|
|
232
|
+
| 📘 | **Built-in capabilities tour** | Click the question-mark icon in the sidebar — a "RuFlo Capabilities" modal opens with the full tool list, model strengths, architecture, and keyboard shortcuts. |
|
|
233
|
+
| 🏠 | **Self-hostable** | Web UI is shipped as Docker (`ruflo/src/ruvocal/Dockerfile`) with embedded Mongo. Deploy to your own Cloud Run / Fly / Kubernetes / docker-compose. The hosted [flo.ruv.io](https://flo.ruv.io/) demo is one option; running your own is fully supported. |
|
|
234
|
+
| 🚀 | **Zero install to try** | Open the hosted URL, pick a model, type a question. That's the whole onboarding. |
|
|
235
|
+
|
|
236
|
+
**Try the hosted demo:** [https://flo.ruv.io/](https://flo.ruv.io/) — no account, no API key. **Run your own:** the source lives in [`ruflo/src/ruvocal/`](ruflo/src/ruvocal/) with a multi-stage Dockerfile (`INCLUDE_DB=true` builds in MongoDB) and a `cloudbuild.yaml` for Google Cloud Run. See [ADR-033](ruflo/docs/adr/ADR-033-RUVOCAL-WASM-MCP-INTEGRATION.md) for the architecture and [issue #1689](https://github.com/ruvnet/ruflo/issues/1689) for the roadmap.
|
|
237
|
+
|
|
238
|
+
<p align="center">
|
|
239
|
+
<a href="https://goal.ruv.io/agents">
|
|
240
|
+
<img src="v3/docs/assets/goal.png" alt="goal.ruv.io/agents — RuFlo Goal-Oriented Action Planning (GOAP) UI for autonomous AI agents. Visual goal decomposition, A* search through state spaces, multi-agent task assignment, and live agent telemetry." width="100%" />
|
|
241
|
+
</a>
|
|
242
|
+
</p>
|
|
243
|
+
|
|
244
|
+
### Goal Planner UI — autonomous agents at [goal.ruv.io](https://goal.ruv.io/)
|
|
245
|
+
|
|
246
|
+
**Turn high-level goals into executable agent plans.** `goal.ruv.io` is RuFlo's hosted Goal-Oriented Action Planning (GOAP) front-end — describe an outcome in plain English and watch RuFlo decompose it into preconditions, actions, and an A* path through state space, then dispatch the work to live agents at [`/agents`](https://goal.ruv.io/agents).
|
|
247
|
+
|
|
248
|
+
| | What it is | Why it matters |
|
|
249
|
+
|---|------------|----------------|
|
|
250
|
+
| 🎯 | **Plain-English goals** | Type *"ship the auth refactor with tests and a PR"* — RuFlo extracts the success criteria, the constraints, and the implicit preconditions. No JSON, no DSL. |
|
|
251
|
+
| 🧭 | **GOAP A\* planner** | Classic gaming-AI planning ported to software work: state-space search through actions with preconditions/effects to find the shortest viable path. Replans on the fly when state changes. |
|
|
252
|
+
| 🤖 | **Live agent dashboard** | [goal.ruv.io/agents](https://goal.ruv.io/agents) shows every spawned agent — role, current step, memory namespace, token budget, status. Click in to inspect trajectories, kill runaway workers, or reassign. |
|
|
253
|
+
| 🌳 | **Visual plan tree** | Goals render as collapsible action trees with progress, blocked branches, and rollbacks highlighted. See *exactly* why an agent picked a path — no opaque chain-of-thought. |
|
|
254
|
+
| ♻️ | **Adaptive replanning** | When an action fails or new info arrives, the planner re-runs A\* from the current state instead of restarting. Failures become learning, not loops. |
|
|
255
|
+
| 🧠 | **Shared memory + SONA** | Plans, trajectories, and outcomes flow into AgentDB. Future plans retrieve past solutions via HNSW — the planner gets smarter with every run. |
|
|
256
|
+
| 🔗 | **Wired to MCP tools** | Every action node maps to a tool call (RuFlo's ~210 MCP tools, your custom servers, or shell). The planner schedules them in parallel where the dependency graph allows. |
|
|
257
|
+
| 🚀 | **Zero install to try** | Open [goal.ruv.io](https://goal.ruv.io/), describe a goal, watch it run. Source lives in [`v3/goal_ui/`](v3/goal_ui/) — Vite + Supabase, self-hostable. |
|
|
258
|
+
|
|
259
|
+
**Try it:** [https://goal.ruv.io/](https://goal.ruv.io/) for goals · [https://goal.ruv.io/agents](https://goal.ruv.io/agents) for live agents. **Run your own:** clone the `goal` branch and `cd v3/goal_ui && npm install && npm run dev`.
|
|
260
|
+
|
|
261
|
+
### Agent Federation — Slack for Agents
|
|
262
|
+
|
|
263
|
+
```
|
|
264
|
+
Your Agent --> [ Remove secrets ] --> [ Sign message ] --> [ Encrypted channel ]
|
|
265
|
+
Emails, SSNs, Proves it came No one reads it
|
|
266
|
+
keys stripped from you in transit
|
|
267
|
+
|
|
|
268
|
+
v
|
|
269
|
+
Their Agent <-- [ Block attacks ] <-- [ Check identity ] <------+
|
|
270
|
+
Stops prompt Rejects forgeries
|
|
271
|
+
injection
|
|
272
|
+
|
|
273
|
+
Audit trail on both sides.
|
|
274
|
+
Trust builds over time. Bad behavior = instant downgrade.
|
|
275
|
+
```
|
|
276
|
+
|
|
277
|
+
Slack gave teams channels. Federation gives agents the same thing — **shared workspaces across trust boundaries**, where agents on different machines, orgs, or cloud regions can discover each other, prove who they are, and collaborate on tasks.
|
|
278
|
+
|
|
279
|
+
The difference: some channels are trusted, some aren't. [`@claude-flow/plugin-agent-federation`](https://github.com/ruvnet/ruflo/issues/1669) handles that automatically. Your agents join a federation, get verified via mTLS + ed25519, and start exchanging work — with PII stripped before anything leaves your node and every message auditable. Untrusted agents can still participate at lower privilege: they see discovery info, not your memory. As they prove reliable, trust upgrades. If they misbehave, they get downgraded instantly — no human in the loop required.
|
|
280
|
+
|
|
281
|
+
You don't configure handshakes or manage certificates. You `federation init`, `federation join`, and your agents start talking. The protocol handles identity, the PII pipeline handles data safety, and the audit trail handles compliance.
|
|
282
|
+
|
|
283
|
+
> **📘 Full user guide:** [`docs/federation/`](./docs/federation/) — setup, MCP tools, trust levels, circuit breaker, and the (opt-in) WireGuard mesh layer that ties packet-layer reachability to federation trust. ADR-111 deep-dive at [`docs/federation/phase7-mesh-bringup.md`](./docs/federation/phase7-mesh-bringup.md).
|
|
284
|
+
|
|
285
|
+
<details>
|
|
286
|
+
<summary><strong>Federation capabilities</strong></summary>
|
|
287
|
+
|
|
288
|
+
| | Capability | How it works |
|
|
289
|
+
|---|---|---|
|
|
290
|
+
| 🔒 | **Zero-trust federation** | Remote agents start untrusted. Identity proven via mTLS + ed25519 challenge-response. No API keys, no shared secrets. |
|
|
291
|
+
| 🛡️ | **PII-gated data flow** | 14-type detection pipeline scans every outbound message. Per-trust-level policies: BLOCK, REDACT, HASH, or PASS. Adaptive calibration reduces false positives. |
|
|
292
|
+
| 📊 | **Behavioral trust scoring** | Formula (`0.4×success + 0.2×uptime + 0.2×threat + 0.2×integrity`) continuously evaluates peers. Upgrades require history; downgrades are instant. |
|
|
293
|
+
| 📋 | **Compliance built-in** | HIPAA, SOC2, GDPR audit trails as compliance modes. Every federation event produces a structured record searchable via HNSW. |
|
|
294
|
+
| 🤝 | **9 MCP tools + 10 CLI commands** | Full lifecycle: `federation_init`, `federation_send`, `federation_trust`, `federation_audit`, and more. |
|
|
295
|
+
|
|
296
|
+
</details>
|
|
297
|
+
|
|
298
|
+
<details>
|
|
299
|
+
<summary><strong>Example: two teams sharing fraud signals without sharing customer data</strong></summary>
|
|
300
|
+
|
|
301
|
+
```bash
|
|
302
|
+
# Team A: initialize federation and generate keypair
|
|
303
|
+
npx claude-flow@latest federation init
|
|
304
|
+
|
|
305
|
+
# Team A: join Team B's federation endpoint
|
|
306
|
+
npx claude-flow@latest federation join wss://team-b.example.com:8443
|
|
307
|
+
|
|
308
|
+
# Team A: send a task — PII is stripped automatically before it leaves
|
|
309
|
+
npx claude-flow@latest federation send --to team-b --type task-request \
|
|
310
|
+
--message "Analyze transaction patterns for account anomalies"
|
|
311
|
+
|
|
312
|
+
# Team A: check peer trust levels and session health
|
|
313
|
+
npx claude-flow@latest federation status
|
|
314
|
+
```
|
|
315
|
+
|
|
316
|
+
</details>
|
|
317
|
+
|
|
318
|
+
See [issue #1669](https://github.com/ruvnet/ruflo/issues/1669) for the complete architecture, trust model, and implementation roadmap.
|
|
319
|
+
|
|
320
|
+
```bash
|
|
321
|
+
# Claude Code plugin
|
|
322
|
+
/plugin install ruflo-federation@ruflo
|
|
323
|
+
|
|
324
|
+
# Or via CLI
|
|
325
|
+
npx claude-flow@latest plugins install @claude-flow/plugin-agent-federation
|
|
326
|
+
```
|
|
327
|
+
|
|
328
|
+
<details>
|
|
329
|
+
<summary><strong>Claude Code: With vs Without Ruflo</strong></summary>
|
|
330
|
+
|
|
331
|
+
| Capability | Claude Code Alone | + Ruflo |
|
|
332
|
+
|------------|-------------------|---------|
|
|
333
|
+
| Agent Collaboration | Isolated, no shared context | Swarms with shared memory and consensus |
|
|
334
|
+
| Coordination | Manual orchestration | Queen-led hierarchy (Raft, Byzantine, Gossip) |
|
|
335
|
+
| Memory | Session-only | HNSW vector memory with sub-ms retrieval |
|
|
336
|
+
| Learning | Static behavior | SONA self-learning with pattern matching |
|
|
337
|
+
| Task Routing | You decide | Intelligent routing (89% accuracy) |
|
|
338
|
+
| Background Workers | None | 12 auto-triggered workers |
|
|
339
|
+
| LLM Providers | Anthropic only | 5 providers with failover |
|
|
340
|
+
| Security | Standard | CVE-hardened with AIDefence |
|
|
341
|
+
|
|
342
|
+
</details>
|
|
343
|
+
|
|
344
|
+
<details>
|
|
345
|
+
<summary><strong>Architecture overview</strong></summary>
|
|
346
|
+
|
|
347
|
+
```
|
|
348
|
+
User --> Claude Code / CLI
|
|
349
|
+
|
|
|
350
|
+
v
|
|
351
|
+
Orchestration Layer
|
|
352
|
+
(MCP Server, Router, 27 Hooks)
|
|
353
|
+
|
|
|
354
|
+
v
|
|
355
|
+
Swarm Coordination
|
|
356
|
+
(Queen, Topology, Consensus)
|
|
357
|
+
|
|
|
358
|
+
v
|
|
359
|
+
100+ Specialized Agents
|
|
360
|
+
(coder, tester, reviewer, architect, security...)
|
|
361
|
+
|
|
|
362
|
+
v
|
|
363
|
+
Memory & Learning
|
|
364
|
+
(AgentDB, HNSW, SONA, ReasoningBank)
|
|
365
|
+
|
|
|
366
|
+
v
|
|
367
|
+
LLM Providers
|
|
368
|
+
(Claude, GPT, Gemini, Cohere, Ollama)
|
|
369
|
+
```
|
|
370
|
+
|
|
371
|
+
</details>
|
|
372
|
+
|
|
373
|
+
---
|
|
38
374
|
|
|
39
375
|
## Documentation
|
|
40
376
|
|
|
41
|
-
|
|
377
|
+
Three docs for three audiences:
|
|
378
|
+
|
|
379
|
+
| Doc | When to read it |
|
|
380
|
+
|-----|-----------------|
|
|
381
|
+
| **[Status](docs/STATUS.md)** | See what currently works — capability counts, test baselines, recent fixes, what's next. The *is-it-ready* doc. |
|
|
382
|
+
| **[User Guide](docs/USERGUIDE.md)** | Daily reference — every command, every config flag, every plugin. The *how-do-I* doc. |
|
|
383
|
+
| **[Verification](verification.md)** | Cryptographically prove your installed bytes match the signed witness — `ruflo verify`. The *trust-but-verify* doc. |
|
|
384
|
+
|
|
385
|
+
User Guide section index:
|
|
386
|
+
|
|
387
|
+
| Section | Topics |
|
|
388
|
+
|---------|--------|
|
|
389
|
+
| [Quick Start](docs/USERGUIDE.md#quick-start) | Installation, prerequisites, install profiles |
|
|
390
|
+
| [Core Features](docs/USERGUIDE.md#-core-features) | MCP tools, agents, memory, neural learning |
|
|
391
|
+
| [Intelligence & Learning](docs/USERGUIDE.md#-intelligence--learning) | Hooks, workers, SONA, model routing |
|
|
392
|
+
| [Swarm & Coordination](docs/USERGUIDE.md#-swarm--coordination) | Topologies, consensus, hive mind |
|
|
393
|
+
| [Security](docs/USERGUIDE.md#%EF%B8%8F-security) | AIDefence, CVE remediation, validation |
|
|
394
|
+
| [Ecosystem](docs/USERGUIDE.md#-ecosystem--integrations) | RuVector, agentic-flow, Flow Nexus |
|
|
395
|
+
| [Configuration](docs/USERGUIDE.md#%EF%B8%8F-configuration--reference) | Environment variables, config schema |
|
|
396
|
+
| [Plugin Marketplace](https://ruvnet.github.io/ruflo) | Browse and install plugins |
|
|
397
|
+
|
|
398
|
+
---
|
|
399
|
+
|
|
400
|
+
## Support
|
|
401
|
+
|
|
402
|
+
| Resource | Link |
|
|
403
|
+
|----------|------|
|
|
404
|
+
| Documentation | [User Guide](docs/USERGUIDE.md) |
|
|
405
|
+
| Issues & Bugs | [GitHub Issues](https://github.com/ruvnet/claude-flow/issues) |
|
|
406
|
+
| Enterprise | [ruv.io](https://ruv.io) |
|
|
407
|
+
| Community | [Agentics Foundation Discord](https://discord.com/invite/dfxmpwkG2D) |
|
|
408
|
+
| Powered by | [Cognitum.one](https://cognitum.one) |
|
|
42
409
|
|
|
43
410
|
## License
|
|
44
411
|
|
|
45
|
-
MIT
|
|
412
|
+
MIT - [RuvNet](https://github.com/ruvnet)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "ruflo",
|
|
3
|
-
"version": "3.7.0-alpha.
|
|
3
|
+
"version": "3.7.0-alpha.81",
|
|
4
4
|
"description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
|
|
5
5
|
"main": "bin/ruflo.js",
|
|
6
6
|
"type": "module",
|
|
@@ -24,6 +24,7 @@
|
|
|
24
24
|
"LICENSE"
|
|
25
25
|
],
|
|
26
26
|
"scripts": {
|
|
27
|
+
"prepublishOnly": "cp ../README.md ./README.md",
|
|
27
28
|
"dev": "node src/mcp-bridge/index.js",
|
|
28
29
|
"dev:bridge": "node --watch src/mcp-bridge/index.js",
|
|
29
30
|
"dev:test": "node src/mcp-bridge/test-harness.js",
|
|
@@ -39,7 +40,7 @@
|
|
|
39
40
|
"package:rvf": "bash src/scripts/package-rvf.sh"
|
|
40
41
|
},
|
|
41
42
|
"dependencies": {
|
|
42
|
-
"@claude-flow/cli": "^3.7.0-alpha.
|
|
43
|
+
"@claude-flow/cli": "^3.7.0-alpha.11"
|
|
43
44
|
},
|
|
44
45
|
"overrides": {
|
|
45
46
|
"@ruvector/rvf-wasm": "0.1.5",
|
|
@@ -55,7 +56,19 @@
|
|
|
55
56
|
"make-fetch-happen": ">=15.0.0",
|
|
56
57
|
"express-rate-limit": ">=8.4.1",
|
|
57
58
|
"protobufjs": ">=7.5.5",
|
|
58
|
-
"uuid": ">=14.0.0"
|
|
59
|
+
"uuid": ">=14.0.0",
|
|
60
|
+
"@opentelemetry/core": "1.25.1",
|
|
61
|
+
"@opentelemetry/resources": "1.25.1",
|
|
62
|
+
"@opentelemetry/sdk-trace-base": "1.25.1",
|
|
63
|
+
"@opentelemetry/sdk-node": ">=0.218.0",
|
|
64
|
+
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
|
|
65
|
+
"@opentelemetry/exporter-prometheus": ">=0.217.0",
|
|
66
|
+
"@opentelemetry/exporter-trace-otlp-grpc": "0.52.1",
|
|
67
|
+
"@opentelemetry/exporter-trace-otlp-http": "0.52.1",
|
|
68
|
+
"@opentelemetry/exporter-trace-otlp-proto": "0.52.1",
|
|
69
|
+
"@opentelemetry/otlp-exporter-base": "0.52.1",
|
|
70
|
+
"@opentelemetry/otlp-grpc-exporter-base": "0.52.1",
|
|
71
|
+
"@opentelemetry/otlp-transformer": "0.52.1"
|
|
59
72
|
},
|
|
60
73
|
"engines": {
|
|
61
74
|
"node": ">=20.0.0"
|
package/src/mcp-bridge/index.js
CHANGED
|
@@ -256,7 +256,7 @@ const BACKEND_DEFS = [
|
|
|
256
256
|
{ name: "agentic-flow", command: "npx", args: ["-y", "agentic-flow@alpha", "mcp", "start"], groups: ["agentic-flow"] },
|
|
257
257
|
{ name: "claude", command: "claude", args: ["mcp", "serve"], groups: ["claude-code"] },
|
|
258
258
|
{ name: "gemini-mcp", command: "npx", args: ["-y", "gemini-mcp-server"], groups: ["gemini"] },
|
|
259
|
-
{ name: "codex", command: "npx", args: ["-y", "@openai/codex", "mcp"
|
|
259
|
+
{ name: "codex", command: "npx", args: ["-y", "@openai/codex", "mcp-server"], groups: ["codex"] },
|
|
260
260
|
];
|
|
261
261
|
|
|
262
262
|
const mcpBackends = new Map();
|
|
@@ -639,11 +639,35 @@ Requires: OPENAI_API_KEY environment variable (already set for OpenAI models).
|
|
|
639
639
|
return { guidance: `Unknown topic '${topic}'. Use 'overview', 'groups', or a specific group name.`, topic };
|
|
640
640
|
}
|
|
641
641
|
|
|
642
|
+
// =============================================================================
|
|
643
|
+
// SSRF GUARD — Reject requests to private/loopback ranges (CWE-918)
|
|
644
|
+
// =============================================================================
|
|
645
|
+
|
|
646
|
+
const PRIVATE_IP_RE = /^(?:10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.|127\.|0\.|::1|fc|fd)/i;
|
|
647
|
+
|
|
648
|
+
function assertSafeUrl(rawUrl) {
|
|
649
|
+
let parsed;
|
|
650
|
+
try {
|
|
651
|
+
parsed = new URL(rawUrl);
|
|
652
|
+
} catch {
|
|
653
|
+
throw new Error(`SSRF guard: invalid URL — ${rawUrl}`);
|
|
654
|
+
}
|
|
655
|
+
if (parsed.protocol !== "https:") {
|
|
656
|
+
throw new Error(`SSRF guard: only HTTPS URLs are permitted, got ${parsed.protocol}`);
|
|
657
|
+
}
|
|
658
|
+
const host = parsed.hostname;
|
|
659
|
+
if (PRIVATE_IP_RE.test(host) || host === "localhost" || host.endsWith(".local")) {
|
|
660
|
+
throw new Error(`SSRF guard: private/loopback host rejected — ${host}`);
|
|
661
|
+
}
|
|
662
|
+
}
|
|
663
|
+
|
|
642
664
|
// =============================================================================
|
|
643
665
|
// HELPER — Call a backend Cloud Function / API
|
|
644
666
|
// =============================================================================
|
|
645
667
|
|
|
646
668
|
async function callCloudFunction(url, payload, timeoutMs = 25000) {
|
|
669
|
+
// Validate the URL before making any network request.
|
|
670
|
+
assertSafeUrl(url);
|
|
647
671
|
const controller = new AbortController();
|
|
648
672
|
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
649
673
|
try {
|
|
@@ -301,5 +301,5 @@ INSERT OR REPLACE INTO metadata (key, value) VALUES
|
|
|
301
301
|
|
|
302
302
|
-- Create default vector index configuration
|
|
303
303
|
INSERT OR IGNORE INTO vector_indexes (id, name, dimensions) VALUES
|
|
304
|
-
('default', 'default',
|
|
305
|
-
('patterns', 'patterns',
|
|
304
|
+
('default', 'default', 384),
|
|
305
|
+
('patterns', 'patterns', 384);
|
|
@@ -261,7 +261,7 @@ const BACKEND_DEFS = [
|
|
|
261
261
|
{ name: "agentic-flow", command: "npx", args: ["-y", "agentic-flow@alpha", "mcp", "start"], groups: ["agentic-flow"] },
|
|
262
262
|
{ name: "claude", command: "claude", args: ["mcp", "serve"], groups: ["claude-code"] },
|
|
263
263
|
{ name: "gemini-mcp", command: "npx", args: ["-y", "gemini-mcp-server"], groups: ["gemini"] },
|
|
264
|
-
{ name: "codex", command: "npx", args: ["-y", "@openai/codex", "mcp"
|
|
264
|
+
{ name: "codex", command: "npx", args: ["-y", "@openai/codex", "mcp-server"], groups: ["codex"] },
|
|
265
265
|
];
|
|
266
266
|
|
|
267
267
|
const mcpBackends = new Map();
|
|
@@ -728,11 +728,35 @@ async function geminiGroundedSearch(query, mode = "search") {
|
|
|
728
728
|
}
|
|
729
729
|
}
|
|
730
730
|
|
|
731
|
+
// =============================================================================
|
|
732
|
+
// SSRF GUARD — Reject requests to private/loopback ranges (CWE-918)
|
|
733
|
+
// =============================================================================
|
|
734
|
+
|
|
735
|
+
const PRIVATE_IP_RE = /^(?:10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.|127\.|0\.|::1|fc|fd)/i;
|
|
736
|
+
|
|
737
|
+
function assertSafeUrl(rawUrl) {
|
|
738
|
+
let parsed;
|
|
739
|
+
try {
|
|
740
|
+
parsed = new URL(rawUrl);
|
|
741
|
+
} catch {
|
|
742
|
+
throw new Error(`SSRF guard: invalid URL — ${rawUrl}`);
|
|
743
|
+
}
|
|
744
|
+
if (parsed.protocol !== "https:") {
|
|
745
|
+
throw new Error(`SSRF guard: only HTTPS URLs are permitted, got ${parsed.protocol}`);
|
|
746
|
+
}
|
|
747
|
+
const host = parsed.hostname;
|
|
748
|
+
if (PRIVATE_IP_RE.test(host) || host === "localhost" || host.endsWith(".local")) {
|
|
749
|
+
throw new Error(`SSRF guard: private/loopback host rejected — ${host}`);
|
|
750
|
+
}
|
|
751
|
+
}
|
|
752
|
+
|
|
731
753
|
// =============================================================================
|
|
732
754
|
// HELPER — Call a backend Cloud Function / API
|
|
733
755
|
// =============================================================================
|
|
734
756
|
|
|
735
757
|
async function callCloudFunction(url, payload, timeoutMs = 25000) {
|
|
758
|
+
// Validate the URL before making any network request.
|
|
759
|
+
assertSafeUrl(url);
|
|
736
760
|
const controller = new AbortController();
|
|
737
761
|
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
738
762
|
try {
|