openpets
Local first, desktop companion platform with animated pets, plugin SDK and coding-agent integrations.
No outside reports on file
OpenPets is a young project with moderate adoption; the main risk is running untrusted plugins that could access your files or intercept commands, so only install plugins from sources you trust.
Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (OpenPetsHQ/openpets)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/OpenPetsHQ/openpets ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-24.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Openpets
OpenPets is a desktop platform that runs local AI companion apps with animated pet characters. It includes a plugin system and tools to connect coding agents, letting developers build interactive pet experiences that can integrate with other systems.
Who it’s for
Developers interested in building or experimenting with AI companion applications, plugin ecosystems, or agents that need a desktop-based interface with animated visual feedback.
Alternatives
- Tamagotchi-style web apps: Simple browser-based virtual pets with no code execution risk.
- Discord bots: Text-based AI companions that integrate with Discord and have built-in permission controls.
- Hugging Face Spaces: Web-hosted AI demo applications with sandboxed execution.
- LocalAI or Ollama: Local LLM runners focused on offline AI without a pet interface layer.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation instructions. The GitHub repository at https://github.com/OpenPetsHQ/openpets (opens external site) contains setup details and documentation.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.4k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Local file access: The platform runs on your desktop and may read or modify files depending on what plugins you install or enable.
- Plugin code execution: Third-party plugins could contain malicious code since they run with the app's permissions; always review plugin sources.
- Agent integrations: If connected to coding agents or APIs, those integrations could be tricked into running unintended commands or leaking data.
- Persistence and startup: Desktop companions often run on login; a compromised plugin could stay active without your notice.
- Data in prompts: Any data you feed to the pet companion or coding agent could be logged, cached, or sent to external services depending on configuration.
How to lower the risk
Least-privilege permissions
- Only install official or heavily-reviewed plugins from trusted developers.
- Disable unnecessary plugin capabilities or integrations you don't actively use.
Network isolation
- Review what external APIs or services any plugin or agent tries to connect to.
- Consider running it on a machine without sensitive credentials or data if possible.
Monitoring
- Check your system's task manager or logs to see what OpenPets and its plugins are doing.
- Review file access or network requests if the platform has logging features.
Red flags to watch for
- Plugins requesting unusually broad file or system permissions during installation.
- Unexpected network traffic or API calls to unknown domains.
- Slowdowns or crashes that could indicate resource misuse or malicious activity.
Questions
How do I install Openpets?
Openpets does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/OpenPetsHQ/openpets.
Are there security reports about Openpets?
No reports found for this package in our research (last checked 2026-10-30). Openpets currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include local file access, plugin code execution, agent integrations.
Is Openpets actively maintained?
Openpets has 1.4k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/OpenPetsHQ/openpets before pinning it in production.
What are alternatives to Openpets?
Notable alternatives to Openpets include Tamagotchi-style web apps (Simple browser-based virtual pets with no code execution risk), Discord bots (Text-based AI companions that integrate with Discord and have built-in permission controls), Hugging Face Spaces (Web-hosted AI demo applications with sandboxed execution), LocalAI or Ollama (Local LLM runners focused on offline AI without a pet interface layer). You can also compare Openpets side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Openpets? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/openpetshq-openpets)HTML embed:
<a href="https://agentarmorhq.com/skills/openpetshq-openpets"><img src="https://agentarmorhq.com/api/badge/openpetshq-openpets" alt="AgentArmorHQ Risk Grade for Openpets" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "openpetshq-openpets"Share with your security lead
Need sign-off to use openpets? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: openpets
- **Listing URL:** https://agentarmorhq.com/skills/openpetshq-openpets
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.4k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (OpenPetsHQ/openpets)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/OpenPetsHQ/openpets
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- OpenPetsHQ
- Source code
- github.com/OpenPetsHQ/openpets
- Est. context load
- ~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
- Popularity
- 1.4k GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-24
Community
Discussions for Openpets
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude