gpt-pilot Documentation

File: README.md Copy Chapter

[!CAUTION]
Malicious code was found in this repository and has been removed. A supply-chain worm (a credential stealer) was hidden in core/telemetry/ from August 2025 until 11 June 2026. If you cloned and ran GPT Pilot from source during that window, rotate your credentials and read the security notice below.

🔒 Security notice Copy Chapter

What happened. On 2025-08-24, a malicious commit (065ee8eb, message "Revert 'Implemented weekend discount'") was pushed to this repository, disguised as a routine revert. It was publicly reported on 2026-06-08 by an external security researcher, and the malicious files were removed on 2026-06-11.

What it did. The commit added a hidden loader (core/telemetry/_hooks.py) that started automatically whenever the program ran (wired in through core/telemetry/__init__.py). That loader silently downloaded the Bun JavaScript runtime and used it to execute an obfuscated payload (core/telemetry/_runtime.bin). The payload is a Shai-Hulud-class supply-chain worm: it harvests credentials and secrets from the machine (cloud/AWS keys, GitHub and npm tokens, SSH keys, and similar) and can use the stolen access to spread to other projects.

What this means for you. The code only executed if GPT Pilot was actually run — simply having a copy you never ran is not affected. If you cloned and ran GPT Pilot from source between August 2025 and 11 June 2026, assume the payload may have executed on that machine and:

1. Rotate every credential that was present on the machine — GitHub/npm tokens, cloud/AWS keys, SSH keys, and API keys.
2. Check for indicators of compromise: the files core/telemetry/_runtime.bin, core/telemetry/_hooks.py, or core/telemetry/.loader.lock; an unexpected bun binary; or temporary folders named rt-*.
3. Treat the machine as potentially compromised until you have verified it is clean.

This repository is no longer actively maintained, which is why the malicious commit went unnoticed for an extended period. This notice and the file removals are a security cleanup, not a resumption of development.

GPT Pilot is the core technology for the Pythagora VS Code extension that aims to provide the first real AI developer companion. Not just an autocomplete or a helper for PR messages but rather a real AI developer that can write full features, debug them, talk to you about issues, ask for review, etc.

📫 If you would like to get updates on future releases or just get in touch, join our Discord server or you can add your email here. 📬

• 🔌 Requirements
• 🚦How to start using gpt-pilot?
• 🔎 Examples
• 🐳 How to start gpt-pilot in docker?
• 🧑‍💻️ CLI arguments
• 🏗 How GPT Pilot works?
• 🕴How's GPT Pilot different from Smol developer and GPT engineer?
• 🍻 Contributing
• 🔗 Connect with us
• 🌟 Star history

GPT Pilot aims to research how much LLMs can be utilized to generate fully working, production-ready apps while the developer oversees the implementation.

The main idea is that AI can write most of the code for an app (maybe 95%), but for the rest, 5%, a developer is and will be needed until we get full AGI.

If you are interested in our learnings during this project, you can check our latest blog posts.

🔌 Requirements

• Python 3.9+

🚦How to start using gpt-pilot?

👉 If you are using VS Code as your IDE, the easiest way to start is by downloading GPT Pilot VS Code extension. 👈

Otherwise, you can use the CLI tool.

If you're new to GPT Pilot: Copy Section

After you have Python and (optionally) PostgreSQL installed, follow these steps:

1. git clone https://github.com/Pythagora-io/gpt-pilot.git (clone the repo)
2. cd gpt-pilot (go to the repo folder)
3. python3 -m venv venv (create a virtual environment)
4. source venv/bin/activate (or on Windows venv\Scripts\activate) (activate the virtual environment)
5. pip install -r requirements.txt (install the dependencies)
6. cp example-config.json config.json (create config.json file)
7. Set your key and other settings in config.json file:
   • LLM Provider (openai, anthropic or groq) key and endpoints (leave null for default) (note that Azure and OpenRouter are suppored via the openai setting)
   • Your API key (if null, will be read from the environment variables)
   • database settings: sqlite is used by default, PostgreSQL should also work
   • optionally update fs.ignore_paths and add files or folders which shouldn't be tracked by GPT Pilot in workspace, useful to ignore folders created by compilers
8. python main.py (start GPT Pilot)

All generated code will be stored in the folder workspace inside the folder named after the app name you enter upon starting the pilot.

🔎 [Examples](https://github.com/Pythagora-io/gpt-pilot/wiki/Apps-created-with-GPT-Pilot)

Click here to see all example apps created with GPT Pilot.

PostgreSQL support Copy Section

GPT Pilot uses built-in SQLite database by default. If you want to use the PostgreSQL database, you need to additional install asyncpg and psycopg2 packages:

pip install asyncpg psycopg2

Then, you need to update the config.json file to set db.url to postgresql+asyncpg://:@<db-host>/<db-name>.

🧑‍💻️ CLI arguments

List created projects (apps) Copy Section

python main.py --list

Note: for each project (app), this also lists "branches". Currently we only support having one branch (called "main"), and in the future we plan to add support for multiple project branches.

Load and continue from the latest step in a project (app) Copy Section

python main.py --project <app_id>

Load and continue from a specific step in a project (app) Copy Section

python main.py --project <app_id> --step <step>

Warning: this will delete all progress after the specified step!

Delete project (app) Copy Section

python main.py --delete <app_id>

Delete project with the specified app_id. Warning: this cannot be undone!

Other command-line options Copy Section

There are several other command-line options that mostly support calling GPT Pilot from our VSCode extension. To see all the available options, use the --help flag:

python main.py --help

🏗 How GPT Pilot works?

Here are the steps GPT Pilot takes to create an app:

1. You enter the app name and the description.
2. Product Owner agent like in real life, does nothing. :)
3. Specification Writer agent asks a couple of questions to understand the requirements better if project description is not good enough.
4. Architect agent writes up technologies that will be used for the app and checks if all technologies are installed on the machine and installs them if not.
5. Tech Lead agent writes up development tasks that the Developer must implement.
6. Developer agent takes each task and writes up what needs to be done to implement it. The description is in human-readable form.
7. Code Monkey agent takes the Developer's description and the existing file and implements the changes.
8. Reviewer agent reviews every step of the task and if something is done wrong Reviewer sends it back to Code Monkey.
9. Troubleshooter agent helps you to give good feedback to GPT Pilot when something is wrong.
10. Debugger agent hate to see him, but he is your best friend when things go south.
11. Technical Writer agent writes documentation for the project.

🕴How's GPT Pilot different from _Smol developer_ and _GPT engineer_?

• GPT Pilot works with the developer to create a fully working production-ready app - I don't think AI can (at least in the near future) create apps without a developer being involved. So, GPT Pilot codes the app step by step just like a developer would in real life. This way, it can debug issues as they arise throughout the development process. If it gets stuck, you, the developer in charge, can review the code and fix the issue. Other similar tools give you the entire codebase at once - this way, bugs are much harder to fix for AI and for you as a developer.

• Works at scale - GPT Pilot isn't meant to create simple apps but rather so it can work at any scale. It has mechanisms that filter out the code, so in each LLM conversation, it doesn't need to store the entire codebase in context, but it shows the LLM only the relevant code for the current task it's working on. Once an app is finished, you can continue working on it by writing instructions on what feature you want to add.

🍻 Contributing

If you are interested in contributing to GPT Pilot, join our Discord server, check out open GitHub issues, and see if anything interests you. We would be happy to get help in resolving any of those. The best place to start is by reviewing blog posts mentioned above to understand how the architecture works before diving into the codebase.

🖥 Development Copy Chapter

Other than the research, GPT Pilot needs to be debugged to work in different scenarios. For example, we realized that the quality of the code generated is very sensitive to the size of the development task. When the task is too broad, the code has too many bugs that are hard to fix, but when the development task is too narrow, GPT also seems to struggle in getting the task implemented into the existing code.

📊 Telemetry Copy Chapter

To improve GPT Pilot, we are tracking some events from which you can opt out at any time. You can read more about it here.

🔗 Connect with us

🌟 As an open-source tool, it would mean the world to us if you starred the GPT-pilot repo 🌟

💬 Join the Discord server to get in touch.

File: core/templates/tree/react_express/README.md Copy Chapter

{{ project_name }}

{{ project_description }}

Quickstart Copy Chapter

1. Install required packages:

   text Copy

   npm install

2. Update .env with your settings.

{% if options.db_type == 'sql' %}
3. Create initial database migration:

npx prisma migrate dev --name initial

When run the first time, it will also install
`@prisma/client` and generate client code.

4. Run the tests:
   {% else %}

5. Run the tests:
   {% endif %}

   text Copy

   npm run test

Development Copy Chapter

To run the server in development mode, with log pretty-printing and hot-reload:

npm run dev

To run the tests, run the test script (npm run test). ESLint is used for linting and its configuration is specified in .eslintrc.json.

Code style is automatically formatted using prettier. To manually run prettier, use npm run prettier. Better yet, integrate your editor to run it on save.

Production Copy Chapter

To run the app in production, run:

npm start

Logs will be sent to the standard output in JSON format.
{% if options.bg_tasks %}

Background tasks with Bull Copy Chapter

A simple task queue is built using bull and backed by Redis. Tasks are defined and exported in src/tasks.js. Call proxies are created automatically and tasks can be queued with:

import { tasks } from "./src/utils/queue.js";
const result = await tasks.someFunction(...);

To run the worker(s) that will execute the queued tasks, run:

npm run worker

{% endif %}

Using Docker Copy Chapter

Build the docker image with:

docker build -t {{ project_folder }} .

The default command is to start the web server (gunicorn). Run the image with -P docker option to expose the internal port (3000) and check the exposed port with docker ps:

docker run --env-file .env --P {{ project_folder }}
    docker ps

Make sure you provide the correct path to the env file (this example assumes it's located in the local directory).

To run a custom command using the image (for example, starting the Node
shell):

docker run --env-file .env {{ project_folder }} npm run shell

For more information on the docker build process, see the included
Dockerfile.

File: docs/TELEMETRY.md Copy Chapter

Telemetry in Pythagora Copy Chapter

At Pythagora, we are dedicated to improving your experience and the overall quality of our software. To achieve this, we gather anonymous telemetry data which helps us understand how the tool is being used and identify areas for improvement.

What We Collect Copy Section

The telemetry data we collect includes:

• Total Runtime: The total time Pythagora was active and running.
• Command Runs: How many commands were executed during a session.
• Development Steps: The number of development steps that were performed.
• LLM Requests: The number of LLM requests made.
• User Inputs: The number of times you provide input to the tool.
• Operating System: The operating system you are using (and Linux distro if applicable).
• Python Version: The version of Python you are using.
• GPT Pilot Version: The version of Pythagora you are using.
• LLM Model: LLM model(s) used for the session.
• Time: How long it took to generate a project.
• Initial prompt: App description used to create app (after Specification Writer Agent).
• Architecture: Architecture designed by Pythagora for the app.
• Documentation: Pythagora documentation that was used while creating the app.
• User Email: User email (if using Pythagora VSCode Extgension, or if explicitly provided when running Pythagora from the command line).
• Pythagora Tasks/Steps: Information about the development tasks and steps Pythagora does while coding the app.

All the data points are listed in core.telemetry:Telemetry.clear_data().

How We Use This Data Copy Section

We use this data to:

• Monitor the performance and reliability of Pythagora.
• Understand usage patterns to guide our development and feature prioritization.
• Identify common workflows and improve the user experience.
• Ensure the scalability and efficiency of our language model interactions.

Your Privacy Copy Section

Your privacy is important to us. The data collected is purely for internal analysis and will not be shared with third parties. No personal information is collected, and telemetry data is completely anonymized. We adhere to best practices in data security to protect this information.

Opting Out Copy Section

We believe in transparency and control. If you prefer not to send telemetry data, you can opt-out at any time by setting telemetry.enabled to false in your ~/.gpt-pilot/config.json configuration file.

After you update this setting, Pythagora will no longer collect telemetry data from your machine.

Questions and Feedback Copy Section

If you have questions about our telemetry practices or would like to provide feedback, please open an issue in our repository, and we will be happy to engage with you.

Thank you for supporting Pythagora and helping us make it better for everyone.