AgenticSeek's local-model option answers where model inference can run. Deciding whether to let it act on your files requires a separate assessment of installation, execution permissions and task reliability.
This review combines our recorded September 24, 2026 run at commit 6c87df62658a01707f2a5a33bbcfe50730e75d62 with the supplied current README and issue extracts. The current documentation is not evidence that the measured commit had every protection it now describes. We performed no new execution for this correction.
What our recorded run establishes
The stored configuration lists 3 CPUs, 8 GB of memory and image ghcr.io/astral-sh/uv:python3.12-bookworm. That image name does not establish the runtime: the install tail says Using Python 3.10.21 environment at: /work/home/venv, and the test paths use Python 3.10.
The harness marked the install step successful, with exit 0 after 76 seconds. Its raw tail nevertheless contains repeated failures to build pyaudio==0.2.14 because portaudio.h was missing. The dependency error identifies agenticseek version 0.1.0 as depending on that package. A successful outer step cannot resolve this contradiction or prove the application was fully installed.
The record reports 205 dependencies and 6,216 MB of environment storage. It also records a checkout of 156 files, approximately 10,749 lines of source and 12.3 MB. These figures do not establish a complete deployment footprint including model weights and Docker images.
The build step returned exit 0 after 529 milliseconds, rounded to 1 second in the summary. Its stored output is empty and its command is not supplied. We cannot treat it as verification of a Docker build, an installed CLI or a running backend.
The pytest step exited 1 after about 53 seconds. The output reports 143 passed, 8 failed, 2 errors, 14 passing subtests and 1 warning, with pytest's own elapsed time of 50.60 seconds. The parser records a total of 153, but no complete-log reconciliation established exhaustive unique coverage. We therefore do not calculate a pass rate.
Seven listed failures in the LiteLLM provider tests end with ModuleNotFoundError: No module named 'openai._models'; 'openai' is not a package. The eighth expected a message saying LiteLLM was unavailable for local use and instead received a message saying it was not installed. Both listed errors identify OSError: PortAudio library not found, in tests/test_agent_regressions.py and tests/test_planner_agent_parsing.py. These results identify setup and test problems in this environment; they do not establish that browsing, planning or every provider is broken.
Pip-audit recorded 13 advisories across 2 packages. The number of packages actually scanned is not supplied, so audit coverage is unknown. This historical result does not establish the dependency status of the current checkout or demonstrate an exploitable application vulnerability.
The detector recorded a Compose file and tests directory, zero CI workflows and no Dockerfile. Those are detector outputs for this checkout, not proof that the project lacks all automation or Docker build definitions. Our run did not measure model quality, browser task completion, search reliability, installed-binary behavior or execution isolation.
What setup requires
The README strongly recommends Python 3.10.x and warns that other versions can cause dependency errors. The raw run used that Python series, so blaming its failures on the container's Python 3.12 label would be inaccurate.
The documented default web path starts SearXNG, Redis, the frontend and backend through Docker Compose. It requires a configured working directory and a model provider. The README warns that downloading Docker images can take up to 30 minutes and that first backend startup can take 5 minutes. Those are project estimates, not timings from our run. The web interface is documented at port 3000 after the backend becomes healthy; the current README also instructs users to supply an API token on first open.
For local inference, the README specifies a GPU capable of running a 14B model such as Magistral, Qwen or DeepSeek. It lists Ollama, LM Studio and local OpenAI-compatible servers. Its FAQ describes 14B models as usable for simple tasks while potentially struggling with browsing and planning. These are project recommendations, not our hardware or performance findings.
Cloud providers are optional and require provider credentials. The README explicitly describes that configuration as using external cloud-based models. Its broad privacy language should therefore be read alongside the selected provider and the actions enabled: browsing still contacts websites, and cloud model use sends content outside the machine.
SearXNG configuration depends on where the backend runs. Docker uses searxng:8080; the host-run CLI uses localhost with the published port. The README says the Docker hostname will not resolve for the host-run CLI. Chrome and ChromeDriver compatibility is another documented setup requirement. Issue 381 contains a historical Windows report of a mismatch; it does not prove that every current Windows installation fails.
Current execution guidance differs from older reports
Issues 483 and 494 describe generated Python execution without sandboxing and a shell path whose safety checks were disabled by default. These are reporter findings from April 2026, not security tests we performed. The supplied issue pages still display Open, but that status alone does not establish current implementation behavior.
The current README describes a token-protected backend API, localhost host restrictions by default, and Docker execution as an unprivileged user with API keys, tokens and secrets removed from the generated code's environment. It now describes safe_mode as enabled by default and explicitly calls it a best-effort command filter rather than a sandbox. We have not independently verified those protections or established when each change landed.
The remaining boundary is concrete: the README says generated code can still read and write everything in WORK_DIR and use the network. It also says the backend needs NET_ADMIN to block agent code from loopback; without that capability, the entrypoint warns that code could reach ChromeDriver or Chrome DevTools. Mount only disposable or deliberately exposed files during an evaluation.
The current README also documents optional browser-session import, disabled by default. It says the copy includes saved passwords, autofill data and cookies, and warns that the agent can act as you on those sites. With cloud model use, page content it reads also goes to the provider. Keep that feature disabled during an initial evaluation.
Reliability remains unmeasured here
The README calls AgenticSeek an early prototype, warns that routing may select the wrong agent and labels form filling experimental. Issue 410 reports CAPTCHA responses from DuckDuckGo and Qwant and a malformed Wikipedia request in a specific SearXNG setup. That report is useful troubleshooting context, not a measured failure rate for the current project.
Our evidence supports an evaluation plan rather than a blanket rejection or approval: resolve the PortAudio prerequisites for your chosen setup, confirm that the backend and provider actually respond, then try a bounded task using disposable files. Verify permissions and network access separately from task success. None of those follow-up checks was completed in our recorded run.
How to read the scores
Scores are editorial judgments on a five-point evidence rubric: 1 means a blocking problem was observed in the assessed scope; 2 means substantial friction or limited supporting evidence; 3 means documented capability with material verification gaps; 4 requires strong evidence for the assessed dimension; 5 requires broad corroboration. They are not benchmark results. Limited evidence of community support is not evidence of poor adoption, and these scores do not establish current production readiness.
AgenticSeek is a reasonable candidate for a developer-led experiment. A complete installation, useful task performance and an acceptable execution boundary still need to be demonstrated for the exact checkout you intend to run.