混合智能代理

Quickstart

You need Python 3.11–3.13 (python.org — check yours with python --version) and, for a from-source checkout, uv (a fast Python installer).

1. Install — from PyPI:

pip install chimera-agent

git clone https://github.com/brcampidelli/chimera-agent.git
cd chimera-agent
uv sync --extra dev

2. Add one AI provider key. The easiest is an OpenRouter key — one key unlocks 100+ models. ```bash cp .env.example .env

open .env and set, for example: CHIMERA_OPENROUTER_KEYS=sk-or-...

**3. Check everything is ready**

**4. Try it**

**Run it on a server (so it works 24/7):**

Full guide (Docker or systemd, scheduling, backups, security): **[docs/deploy.md](docs/deploy.md)**.

**5. Do something real in 5 minutes: email triage.** Point Chimera at your inbox and get a
ten-second digest — read-only, classify URGENT / PERSONAL / NEWSLETTER / COLD-SALES, and
optionally schedule it every morning:

How Chimera compares

Chimera doesn't try to out-channel the giant agent projects. It bets on the three things a real reverse-engineering study of five leaders (OpenClaw, Hermes, nanobot, CrewAI, LangGraph) found they all leave open — and makes them its core:

• 🧬 Self-evolution with a fitness signal. The others "learn" by appending whatever happened, or by human pull requests — nothing measures whether a learned change actually helped. Chimera keeps a change only when a verified result proves it did: the evolution step is gated on the real working-tree diff and an honest A/B, never the model's say-so. Independent evidence this matters: EvoAgentBench (arXiv 2607.05202) measured that automatic, ungated experience-encoding methods routinely produce negative transfer — one popular method regressed −12.3 points on tasks it wasn't tuned on. Chimera's gate now also runs a transfer holdout: a learned change must not regress a disjoint, same-capability slice before it's promoted, so it can't just memorize its own eval.
• 🛡️ Security by architecture. Prompt injection is now widely considered unpatchable; the popular agents mitigate at the app layer or declare it out of scope (one shipped 135k publicly-exposed instances and a marketplace ~12% full of malicious skills). Chimera ships a real defence layer — opt-in with --taint, off by default: it tracks taint provenance heuristically (verbatim reference/content flow, not true dataflow — a model that paraphrases tainted text launders it), strips control tokens from untrusted content, narrows dangerous-tool access for the rest of a tainted run, and guards side-effecting retries; untrusted code runs in an opt-in locked-down container. On the built-in 7-attack corpus, 6 of 7 harmful calls are blocked (~14% still get through) — measured on an agent that is already injected and attempting the attacker's tool call, with no model in the loop. That block rate is never published alone: the same report carries how much legitimate work the narrowing refuses, measured on a benign corpus that trips the identical surface, and the gate will not read one half without the other (chimera redteam prints both — a defence scored on attacks alone has a trivial maximum: refuse everything). The undefended arm is 100% by construction, not by measurement: an unwrapped tool always runs, so treat it as the definitional floor this layer is compared against, not as a baseline system. This says nothing about how easily a model is injected in the first place — the harder, open half (chimera/eval/injection.py). SECURITY.md states plainly what still gets through (sub-agent hand-offs, fusion/summarisation, non-CLI entry points) — the containment boundary is the sandbox, this layer is defence-in-depth on top of it.
• 📊 Honest, published benchmarks. ~20% of a popular leaderboard's "solved" cases are actually wrong. Chimera reports every number with a confidence interval — including the runs where it didn't win — never re-rolls for significance, and retracts its own claims when a replication kills them. The numbers, the nulls and the retractions are all in Benchmarks.

In one line: the governed, self-evolving agent — proved and governed. It's alpha, and it says so.