evo
turns your codebase into an autoresearch loop — discovers what to measure, instruments the benchmark, then runs tree search with parallel subagents.
No outside reports on file
Evo runs code directly on your machine and instruments it, so misconfiguration or malicious repo content could lead to secret leaks, resource abuse, or unintended code execution.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (evo-hq/evo)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/evo-hq/evo ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-22.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Evo
Evo automatically analyzes your code to figure out what metrics matter, sets up measurements (instrumentation), and then runs a tree search using parallel sub-agents to explore improvements. It's designed to turn code exploration into a self-directed research loop.
Who it’s for
Developers and researchers who want AI to autonomously investigate their codebases and suggest optimizations. Teams looking to automate the process of finding and testing performance improvements.
Alternatives
- Plandex: AI coding agent that plans and iterates; less automated search than Evo.
- Cursor: AI-powered code editor with refactoring and optimization suggestions.
- GitHub Copilot with custom workflows: Manual setup of benchmarking and search loops using LLM guidance.
- MetaPrompt or AutoGPT variants: General-purpose AI agents adapted for code analysis without built-in instrumentation.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/evo-hq/evo (opens external site) for installation and configuration details specific to your environment.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.5k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Code execution risk: The tool runs code and instruments your codebase, which means it executes arbitrary scripts on your machine or CI/CD system.
- Credential exposure: If your code or environment contains API keys, tokens, or secrets, the instrumentation and search process could discover and leak them.
- Misleading output files: Attacker-controlled files in your repo (comments, config files, data) could trick the AI into running unintended commands or tests.
- Resource exhaustion: Parallel sub-agents running tree search could consume unexpected CPU, memory, or cloud costs if not carefully constrained.
- Data collection by sub-agents: The tool may send code snippets or metrics to external services depending on configuration; this could leak proprietary logic.
How to lower the risk
Least-privilege permissions
- Run Evo in a sandbox or container with read-only access to non-sensitive code only.
- Restrict which directories it can instrument and which commands it can run.
Network isolation
- Disable external API calls unless absolutely necessary; configure only trusted endpoints.
- Run in an air-gapped environment if handling secrets or proprietary logic.
Monitoring
- Log all code executed and all metrics collected by Evo and its sub-agents.
- Set resource limits (CPU, memory, runtime) before starting any search loop.
Red flags to watch for
- Sudden file modifications or new processes spawned outside expected scope.
- Unexpected network requests or attempts to read sensitive files like
.envorsecrets/. - Long-running processes or repeated retries that suggest the tool is stuck or malicious.
Questions
How do I install Evo?
Evo does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/evo-hq/evo.
Are there security reports about Evo?
No reports found for this package in our research (last checked 2026-10-30). Evo currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include code execution risk, credential exposure, misleading output files.
Is Evo actively maintained?
Evo has 1.5k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/evo-hq/evo before pinning it in production.
What are alternatives to Evo?
Notable alternatives to Evo include Plandex (AI coding agent that plans and iterates), Cursor (AI-powered code editor with refactoring and optimization suggestions), GitHub Copilot with custom workflows (Manual setup of benchmarking and search loops using LLM guidance), MetaPrompt or AutoGPT variants (General-purpose AI agents adapted for code analysis without built-in instrumentation). You can also compare Evo side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use Evo? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/evo-hq-evo)HTML embed:
<a href="https://agentarmorhq.com/skills/evo-hq-evo"><img src="https://agentarmorhq.com/api/badge/evo-hq-evo" alt="AgentArmorHQ Risk Grade for Evo" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "evo-hq-evo"Share with your security lead
Need sign-off to use evo? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: evo
- **Listing URL:** https://agentarmorhq.com/skills/evo-hq-evo
- **Type:** AI agent skill
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.5k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (evo-hq/evo)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/evo-hq/evo
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- evo-hq
- Source code
- github.com/evo-hq/evo
- Est. context load
- ~62 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 1.5k GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-22
Community
Discussions for Evo
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude