ai-relay

v0.4.30 suspicious
7.0
High Risk

WebSocket relay that bridges AI coding agent CLIs (Claude Code, Codex, Gemini CLI, Snowflake Cortex) to any web interface — stream reasoning, tool calls, and file changes in real time.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits significant shell manipulation capabilities and incomplete metadata, raising concerns about its true intentions. While it may serve legitimate purposes, the risks cannot be fully discounted without further investigation.

  • High shell risk due to use of pty.openpty()
  • Incomplete author metadata
Per-check LLM notes
  • Network: The network calls appear to be making requests to URLs and handling responses, which could be legitimate if the package is designed for AI model interaction or OAuth token retrieval.
  • Shell: The presence of pty.openpty() and related shell manipulation functions suggests potential for executing commands on the host system, indicating a higher risk of unauthorized access or control.
  • Metadata: The author information is incomplete, which raises some suspicion but does not necessarily indicate malicious intent.

📦 Package Quality Overall: Low (3.6/10)

○ Low Test Suite 1.0

No test suite detected

  • No test files or test-runner configuration detected
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (7335 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 122 type-annotated function signatures detected in source
◈ Medium Multiple Contributors 5.0

Limited contributor diversity

  • 1 unique contributor(s) across 52 commits in jw-open/ai-relay
  • Single author but highly active (52 commits)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

  • ("model", "?")) req = urllib.request.Request( url, data=data,
  • try: with urllib.request.urlopen(req, timeout=float(self._setting("timeout", 300))) a
  • S, }).encode() req = urllib.request.Request( OAUTH_TOKEN_URL, data=payload,
  • , ) try: with urllib.request.urlopen(req, timeout=15) as resp: return json.lo
  • t, }).encode() req = urllib.request.Request( OAUTH_TOKEN_URL, data=payload,
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 2.0

Found 1 shell execution pattern(s)

  • master_fd, slave_fd = pty.openpty() os.set_blocking(master_fd, False) self._ma
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: ohwise.ai>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository jw-open/ai-relay appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with ai-relay 
Create a real-time collaborative coding environment using the 'ai-relay' package. This application will enable multiple users to work on the same codebase simultaneously, with real-time updates reflecting each user's contributions. The application should include the following core functionalities:

1. **User Authentication**: Implement a simple user authentication system to allow users to log in and access their sessions.
2. **Real-Time Collaboration**: Use the WebSocket relay provided by 'ai-relay' to synchronize code changes across all connected clients in real-time.
3. **Code Suggestions**: Integrate an AI coding assistant (e.g., Claude Code, Codex) through 'ai-relay' to provide real-time code suggestions and improve coding efficiency.
4. **File Management**: Allow users to create, edit, and delete files within the shared workspace. Ensure that these actions are reflected in real-time across all clients.
5. **Version Control**: Implement a basic version control feature that allows users to save different versions of their code and revert to previous states if needed.
6. **Interactive Debugging**: Utilize 'ai-relay' to stream debugging information from the AI coding assistant to the web interface, enabling interactive debugging sessions.
7. **Customizable Interface**: Provide users with options to customize their coding environment, such as choosing themes, font sizes, etc.
8. **Notifications**: Send notifications to users about important events, such as when another user joins the session or makes significant changes.

The 'ai-relay' package will be used extensively throughout the application. It will serve as the backbone for real-time communication between the AI coding assistant and the web interface, ensuring seamless integration and synchronization of data. By leveraging 'ai-relay', you can focus more on building a rich user experience rather than worrying about the underlying communication infrastructure.