MetaGPT

MetaGPT has no identity of its own: every tool runs with the full authority of the OS user who launched it. The persistent shell given to the Engineer receives a copy of the entire process environment (including any LLM, cloud or Git tokens), and the pull-request tool reads the user's ~/.git-credentials file directly. There is no authorization layer between a model-chosen command and these credentials, so a hijacked agent holds everything the user holds.

There is no approval step anywhere in the default flow. The RoleZero dispatcher executes whatever command name the model emits if it appears in the tool map, including raw shell commands, notebook code execution, file writes anywhere on disk, and opening pull requests. An ask_human tool exists, but only the model decides to call it, so it is not a gate. A plan-review prompt exists for the older DataInterpreter, but RoleZero roles force it off.

The default Engineer gets a raw bash shell, a notebook code executor via the DataAnalyst, an editor that writes any absolute path, a browser that opens any URL, and a pull-request tool. Arguments are passed through unvalidated: the editor only joins relative paths onto its working directory with no containment check, and the only shell filter blocks the strings 'run dev' and 'serve ' to steer the model towards the deployer, not for safety. Every tool is enabled by default for its role.

Model-written code runs directly on the host. The Engineer's shell is a same-user bash subprocess started with a full copy of the environment, and the DataAnalyst's notebook executor starts a local Jupyter kernel in the same user account. The package contains no container, sandbox, or seccomp backend on these paths. The shipped Dockerfile only packages MetaGPT itself and is not used as a per-execution sandbox.

Agents browse arbitrary URLs and read files, and every tool result is appended to memory as a user-role message, the same standing as the human's request. Nothing marks content as untrusted or restricts later actions after untrusted content is read. A hijacked Engineer can then read secrets from its environment, send them anywhere through the shell or browser, and take irreversible actions, all without a human in the loop.

Default memory is in-process and session-scoped, and long-term memory and the experience pool are off by default. However, when MetaGPT is installed from PyPI its project root falls back to the current working directory, and it merges config/config2.yaml from that directory into its settings without asking. A file in the directory where the user runs MetaGPT (or one the agent itself writes there via its unrestricted shell) can enable extra tools such as search, switch on persistent long-term memory or the experience pool, or move the workspace, and that persists across sessions.

MetaGPT has no plugin or MCP system, but its code-writing prompt tells the DataAnalyst to install any missing package through the Terminal tool, so the model chooses and installs packages from PyPI on its own. Those installs run package install scripts on the host, unpinned and unverified, with the user's full environment and credentials. No consent is asked.

API keys live in plaintext YAML or environment variables with no masking type or redaction anywhere in the package. The default log file captures DEBUG output, which includes every full message sent to the LLM, and those prompts carry whatever tool output the agent saw (for example an 'env' command). Every shell command receives the whole environment, so long-lived keys are one 'printenv' away from the model and its provider. No third-party telemetry was found.

MetaGPT writes a loguru log to stderr and to a logs/ directory under the project root. Each RoleZero step logs the parsed command list and its outputs at INFO level, and full LLM prompts at DEBUG, which gives a rough reconstruction of what each role did. The record is free text, carries no notion of who approved what (there are no approvals), and sits next to the workspace where the agent's own shell can edit or delete it.

There are a few limits: each RoleZero role stops after 40-50 actions, the team runs at most 5 rounds by default, the $3 'investment' budget is checked between rounds, and notebook cells time out after 600 seconds. These are coarse: the budget is only checked between rounds and ignores models missing from the price table, a role that hits its action limit asks the human whether to reset it, and the Terminal tool has no timeout at all. Background ('daemon') shell commands keep running after the agent stops.