Version 0.1.2 builds a persistent evidence world
Biosecurity Agent begins with a target described in ordinary language. The target can be a person, animal, plant, product, facility, place, organization, supply chain, or connected group. The runtime collects source artifacts, extracts claims, links entities, and saves a world that returns after restart. The terminal remains the controller. A separate viewer displays maps, evidence, relationships, and simulations without editing the saved state.
The repository is compact enough to inspect. Our checkout at commit 13240f2 contained 77 files and about 11,924 source lines in 2.2 MB. It is a pnpm workspace with a CLI, Fastify server, React viewer, shared contracts, provider adapters, and a safety package. A Dockerfile and Compose file are included. The npm package declares version 0.1.2, while the README's title still says v0.1, a fair sign that the public interface is young.
Observed, inferred, and simulated claims stay separate in code
The product's most responsible design choice is its claim labeling. Evidence gathered from sources should remain distinct from model inference and from a projected future path. Structured schemas describe targets, artifacts, claims, world snapshots, and simulation plans. Agent prompts instruct models to use supplied evidence, avoid inventing observations, and return schema-bound JSON. That makes model output easier to inspect than a long conversational answer whose sources and confidence have been blended together.
The 83 passing Vitest cases cover unit, integration, and safety areas in the measured suite. Filenames show attention to provider adapters, public-source boundaries, live tracking, OSINT chains, notifications, server behavior, and guard rules. This is a better testing shape than a single happy-path demo. It still evaluates software behavior against fixtures. No test count can tell us whether a 14-day simulated path matches a later outbreak or whether a suggested protection reduces risk.
Network access starts disabled and source text is treated as hostile
The example environment sets BIOSECURITY_ALLOW_NETWORK=false, and Compose starts the application in offline mode. Remote URL validation blocks credentials in URLs and rejects private or local network addresses unless an operator permits them. HTML retrieval removes scripts, hidden elements, frames, and similar content. Text matching prompt-injection patterns is quarantined, then wrapped as untrusted source material before an agent sees it. These controls address common agent retrieval failures in specific code.
Limits are also concrete. The safety package caps source text at 5 MB, uploads at 20 MB, and redirects at 3. Accepted upload extensions cover documents, text, structured data, and common images. File names are sanitized before writing. Secrets are redacted from errors and nested values when their keys resemble tokens or passwords. Our build completed in 12 seconds, which confirms this code compiled in the measured environment; it does not prove every adversarial encoding or redirect chain is caught.
Biological misuse gets a separate filter. Requests matching pathogen optimization, increased virulence or transmissibility, stepwise synthesis, cultivation, weaponization, or certain gene-editing patterns are rejected. Output checks also block unsupported diagnosis and dosage language. These are useful safeguards with necessarily limited pattern coverage. A determined user can phrase dangerous intent many ways, so deployment policy, model-provider controls, logs, and trained human oversight still carry part of the safety burden.
What happened when we ran it
Our run at commit 13240f2 installed 576 packages in 67 seconds and used 686 MB on disk. The project built in 12 seconds. Vitest completed in 41 seconds with 83 passed and 0 failed. The fresh Node 22 container had 3 CPUs, 8 GB of RAM, no secrets, and no privileged access. Installation, compilation, and the supplied test suite all completed successfully.
The dependency footprint is substantial for a 2.2 MB checkout because it includes a server, browser viewer, Playwright, model SDKs, parsing libraries, SQLite bindings, and map components. The repository had no CI workflow files in our checkout, even though it had a tests directory and working tests. That means contributors can run a meaningful local suite, while GitHub itself showed no checked-in workflow automatically enforcing the same 83-test result on every change.
The one-command start still needs models and sources
npx @forsy/biosecurity-agent is an inviting entry point, and a deterministic mock adapter can exercise an offline fixture. Useful analysis needs more. Provider presets include Codex, Claude, OpenAI, Gemini, OpenRouter, Groq, Together, DeepSeek, xAI, Fireworks, Ollama, and generic endpoints. Hosted choices require server-side keys. Ollama requires a reachable local service and model. Network retrieval is a separate permission, with optional SearXNG available through Compose.
Every added source changes the trust and cost model. Public pages may contain hostile instructions. Private files may identify people or reveal sensitive operational details. Model calls can send structured evidence outside the local machine even though Forsy says data is not uploaded to its own service by default. The 686 MB installed footprint is easy to budget; permissions, lawful collection, retention, and review time are harder. Teams should begin with synthetic targets and the mock adapter before enabling live sources.
A fresh push and zero issues are too little history for autonomy
GitHub showed 514 stars, 0 open issues or pull requests, and a push on August 25, 2026. There was no GitHub release. A zero count in a new repository does not demonstrate defect-free operation, especially when the application touches safety-sensitive interpretation. Apache-2.0 is friendly to inspection and modification, and the seed dataset offers a starting point for experiments. Neither substitutes for external validation, documented evaluation sets, or incident-response guidance.
Biosecurity Agent is best judged as an early analyst tool. Its 83 passing tests, persisted state, structured claims, network defaults, and defensive filters make it credible software. The project has not supplied evidence that a simulation predicts a biological event, and the README explicitly rules out clinical diagnosis and pathogen engineering. Keep a qualified person between its output and any consequential alert, treatment, travel, animal-care, or facility decision.