A WordPress security platform's agent toolchain in Docker
Open-source production adoption · third-party project
temodar-agent is a third-party open-source project, built and maintained by Ali Sünbül (GitHub: xeloxa) on open-multi-agent. It is a WordPress plugin and theme security analysis platform packing OMA's built-in tools into a single Docker container, running everything from bulk scanning to source-level investigation locally.
Scenario
temodar-agent ships under Apache-2.0. Its README addresses security researchers, product security teams, auditors and defenders, and describes a three-stage flow: scan WordPress plugins and themes from public sources and rank them by install counts, update windows and metadata signals; run Semgrep on selected targets with the bundled OWASP Top 10, PHP security and security audit rulesets, plus custom rule creation, toggling and bulk scans; then open an AI investigation thread per plugin or theme that keeps conversation summary, analysis summary, findings summary, architecture notes and important file paths attached to that target.
The README states the problem plainly: cut the noise before manual review, and bridge Semgrep findings to human investigation. Both need an AI layer that reads files, runs commands and splits work across roles — which is where open-multi-agent sits.
How it works
| Roles | Task DAG | Tools | Model | Deployment |
|---|---|---|---|---|
| Single agent (agent): source_agent | No dependency graph; one multi-turn loop, optional human approval gate | Full set: read / file_read, write / file_write, edit / file_edit, grep, bash, run_semgrep | Default provider anthropic; model, base URL and API key supplied by the caller | Single container; the FastAPI backend spawns the Node runner as a subprocess |
| Team (team): architect / developer / reviewer | runTeam driven by one prompt, shared memory on, concurrency capped at 3 | reviewer gets a read-only set (bash, read / file_read, grep, run_semgrep) | Per-agent provider, model, sampling and timeout overrides | Same |
| Task pipeline (tasks): researcher / reviewer, or caller-defined | runTasks; tasks carry assignee, dependsOn, maxRetries, retryDelayMs, retryBackoff; default two-step chain Inspect workspace → Summarize findings | Same as team mode | Same | Same |
| Fan-out (fanout): optimist / skeptic / pragmatist + synthesizer | Analysts run in parallel, a synthesizer converges the results; concurrency raised to the analyst count | Same as team mode | Analysts and synthesizer can use different models | Same |
The dependency in ai/node_runner/package.json is @jackchen_me/open-multi-agent, constraint ^1.0.1 — open-multi-agent's earlier npm name, whose registry repository field points at open-multi-agent/open-multi-agent; the current name is @open-multi-agent/core. It has been there since the directory's first commit on 2026-04-02.
src/tools.ts imports bashTool, fileReadTool, fileWriteTool, fileEditTool, grepTool, defineTool and the ToolDefinition type from that package, normalises incoming paths to the workspace root and re-registers them under aliases such as read / file_read; run_semgrep is defined with defineTool and runs semgrep --config <config> --json . with a 120-second timeout. src/types.ts imports AgentRunResult, ToolCallRecord, ToolResult, TokenUsage and TraceEvent; src/index.ts imports Agent, AgentPool, OpenMultiAgent, ToolExecutor, ToolRegistry and types including AgentConfig, OrchestratorEvent, Task and TeamRunResult.
The README lists five providers — Anthropic, OpenAI, Copilot, Gemini, Grok — with saved profiles, profile switching, per-profile model lists, connection testing and custom base URLs; the runner's input schema carries the same five values. One image ships everything: a python:3.12-slim base that installs Node and runs npm ci + tsc at build time, then pipes a JSON payload into node dist/index.js over stdin and reads NDJSON events (agent_started, task_started, approval_requested, trace) back from stdout. The container runs as a non-root user, exposes 8080 and stores data in one named volume.
Result
Everything below is already published by the project or a public list:
The open-multi-agent README lists temodar-agent under "Built with OMA" as a WordPress security analysis platform running OMA's built-in tools (bash, file_*, grep) inside a Docker runtime, marked "Confirmed production use".
The project README describes a local-first Docker application combining AI agent workflows, multi-provider LLM orchestration, Semgrep static analysis and WordPress reconnaissance, distributed as the Docker Hub image xeloxa/temodar-agent.
The README states the project is listed in awesome-bugbounty-tools, and that list's README does carry a Temodar Agent entry: a WordPress plugin/theme security analysis platform with Semgrep analysis and agent-assisted investigation. That list is a public resource in the thousands-of-stars range.
Repository facts: Apache-2.0, stars in the tens, topics including ai-agent, sast and wordpress.
Verifiable
How this relates to YuanASI
Everything on this page comes from a third-party open-source project's public repository and pages. YuanASI authors the open-multi-agent framework it depends on.
If you want the same capabilities — built-in tools, roles, a task graph with dependencies and retries, approval gates, an observable event stream — in your own product or internal systems, the matching YuanASI service is Custom AI Agent Development →
Related services
Last updated
Want to know how a workflow like this would land on your side?