DEV Community

Cover image for I built an AI agent that forges its own tools mid-task — and asks first (open source, 60-second demo)
Rameswaran Mohan
Rameswaran Mohan

Posted on

I built an AI agent that forges its own tools mid-task — and asks first (open source, 60-second demo)

#ai #python #showdev #opensource

I asked my agent to password-protect a PDF. No such tool existed. Here is what happened next, in 60 seconds, built only from the real, unedited screenshots of the run:

Watch the walkthrough (MP4, 60s)

22-second loop

What it is

Systemu is a local-first AI agent runtime. When a task needs a capability the agent doesn't have, it doesn't fail and it doesn't fake it. It requests the capability, and a Governor arbitrates by risk:

  1. One card lands in your Inbox, rated HIGH because the agent chose it. Safe default: Skip.
  2. You review the spec, then the generated code, before anything exists.
  3. Dependencies get their own approval (no silent pip install).
  4. Even the first run is gated as dangerous-until-proven.
  5. Deployed with provenance: AGENT-BUILT · dry-run PASSED, revocable in one click.

Approvals bind to a hash of the tool body plus its effect set, so a re-forge asks again. Anything that runs a shell, deletes, sends or writes to the network can never be bulk-approved.

Does the governance kill the capability?

I measured instead of asserting. On tasks that are impossible without acquiring a missing capability (23 tasks, 6 families, 5 models from 5 vendors, external-oracle graded):

  • Frozen toolkit: 6%
  • Governed self-provisioning: 61%
  • 179 trials, McNemar p = 2.8 × 10⁻¹⁰

Try it 

pip install "systemu[dashboard]"
systemu init && systemu start
Enter fullscreen mode Exit fullscreen mode

Works with a local Ollama or your own OpenAI / Anthropic / Google / OpenRouter key. MIT licensed.

Honest limits

  • Small / flash-tier models write noticeably worse tools.
  • First install is heavy (Playwright + Chromium for browser tools).
  • The benchmark is mine and n = 179. I'd genuinely like someone to break it; everything is in cgb_eval/.
  • Solo project from Chennai. Treat it as a serious beta.

Repo: https://github.com/rameswaran-mohan/project-systemu
Preprint: https://doi.org/10.5281/zenodo.20816383
Longer write-up on why (the three September papers on self-patching agents): https://dev.to/rameswaran_mohan_9c8b5d8f/your-ai-agent-will-patch-itself-the-question-is-who-approves-the-patch-gl

If your agent could grow its own toolkit under review, would you let it?

Top comments (0)