DEV Community

zk0x /// ℹ️
zk0x /// ℹ️

Posted on

I Built an AI Agent That Makes Money From Open Source — Here's the Complete Guide (No Hype, Real Code)

#ai #opensource #tutorial #productivity

This is not another "AI will change everything" hype piece. This is a brutally honest, step-by-step guide to building an AI agent that actually earns money from open-source contributions — with real architecture, real failures, and real numbers.

Why I Built This

Every week, another article claims "AI agents will replace developers." Every week, another Twitter thread promises "$10K/month with AI." And every week, most developers try these approaches and earn exactly $0.

I wanted to build something different. Not a demo. Not a proof-of-concept. A real, autonomous system that finds paid open-source work, submits pull requests, and publishes content — 24 hours a day, 7 days a week.

After 100+ hours of building, testing, failing, and iterating, here's what I actually built, what actually works, and what the real numbers look like.

TL;DR: It works, but not how you think. The AI doesn't "make money" autonomously — it creates a force multiplier for human effort. Here's how.

The Architecture: What I Actually Built

Let me be honest: the architecture is simpler than most AI agent frameworks suggest you need. Here's the actual system:

┌─────────────────────────────────────────────────┐
│                  ZKA Money Printer               │
│              (Cron-based Orchestrator)           │
├─────────────────────────────────────────────────┤
│                                                  │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐      │
│  │  Bounty   │  │ Content  │  │  PR      │      │
│  │  Scanner  │  │ Pipeline │  │ Submitter│      │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘      │
│       │              │              │             │
│       ▼              ▼              ▼             │
│  ┌──────────────────────────────────────┐       │
│  │        Decision Engine (LLM)         │       │
│  │   - Triage scoring (0-100)           │       │
│  │   - Competition analysis             │       │
│  │   - Quality gates                    │       │
│  └──────────────────────────────────────┘       │
│                                                  │
│  ┌──────────────────────────────────────┐       │
│  │           Execution Layer            │       │
│  │   - GitHub API (gh CLI)              │       │
│  │   - Dev.to API                       │       │
│  │   - Git operations                   │       │
│  └──────────────────────────────────────┘       │
└─────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

The Key Components

1. Bounty Scanner — Runs every 30 minutes via cron job. Searches GitHub for issues tagged with "bounty", "reward", "$", "good first issue", and "help wanted". Filters out blacklisted repos (yes, there are scam repos that create fake bounties).

2. Triage Engine — Scores each opportunity on 6 dimensions:

  • Repository credibility (stars, age, license, activity)
  • Competition level (number of existing PRs and comments)
  • Payment reliability (platform-based vs. direct vs. token-only)
  • Technical difficulty (can we actually fix this?)
  • Time investment (hours vs. payout ratio)
  • Scam probability (auto-generated issues, no real code)

3. PR Pipeline — If triage score ≥ 40: clone repo, analyze issue, write fix, run tests, submit PR. Follows the repo's CONTRIBUTING.md exactly.

4. Content Pipeline — Writes and publishes technical articles to Dev.to. Batch publishing (1-2 times per day), quality over quantity.

5. Tracking & Reporting — Logs everything to a markdown file. Reports to Telegram when PRs are submitted, merged, or closed.

The Code (Simplified)

The orchestration layer is a scheduled task that runs this workflow:

# Simplified version of the actual orchestration
def bounty_hunter_tick():
    # 1. Search for new bounties
    bounties = search_github_bounties()

    # 2. Filter out blacklisted repos
    bounties = [b for b in bounties if b.repo not in BLACKLIST]

    # 3. Triage and score
    for bounty in bounties:
        score = triage(bounty)
        if score >= 40:
            # 4. Clone, fix, test, submit
            result = work_on_bounty(bounty)
            if result.success:
                report_to_telegram(f"PR submitted: {result.pr_url}")

    # 5. Check existing PRs for reviews
    check_pr_reviews()

    # 6. Write article if needed
    if articles_today < 5:
        write_and_publish_article()
Enter fullscreen mode Exit fullscreen mode

The real complexity is in the triage() and work_on_bounty() functions — and that's where most of the engineering effort went.

The Triage System: How I Score Bounties

This is the most important part of the system. Without triage, you waste hours on bounties that will never pay.

Scoring Matrix

Factor Weight How to Score
Repo credibility 20pts Stars > 100 = +10, MIT/Apache license = +5, Active commits = +5
Competition 20pts 0 comments = +20, 1-3 = +15, 3-10 = +10, 10+ = 0
Payment method 15pts Platform (Algora) = +15, Direct USD = +10, Tokens = +5
Difficulty 15pts Good-first-issue = +15, Medium = +10, Hard = +5
Time investment 15pts < 2hrs = +15, 2-8hrs = +10, 8+ hrs = +5
Scam probability 15pts Clean repo = +15, Suspicious = +5, Blacklisted = -100

Thresholds:

  • ≥40: Submit immediately
  • 20-39: Submit if nothing better available
  • 0-19: Skip
  • <0: Blacklisted — never touch

Real Examples from My Experience

HIGH SCORE (75): Aigen-Protocol #42 — "Translate AIP-1 spec to Japanese"

  • Repo: MIT license, Python, active maintainer, 3 stars
  • Competition: 0 existing PRs
  • Payment: USDC via on-chain escrow
  • Difficulty: Easy (translation)
  • Result: Merged in 24 hours ✅

MEDIUM SCORE (45): mergeos #146 — "Implement notification center"

  • Repo: Active, bounty-labeled
  • Competition: 2-3 comments
  • Payment: MRG tokens (uncertain value)
  • Difficulty: Medium
  • Result: PR submitted, waiting for review ⏳

LOW SCORE (15): RustChain bounties — Various issues

  • Repo: 48-66+ comments per issue
  • Competition: Extremely saturated
  • Payment: RTC tokens
  • Result: Skipped — too much competition ❌

BLACKLISTED (-100): SecureBananaLabs/bug-bounty

  • 1900+ auto-generated issues
  • All PRs closed without merge
  • Obvious bounty farm
  • Result: Never touch ❌

The PR Submission Playbook

After submitting 50+ PRs across various repos, here's what actually gets merged:

Rule 1: Comment First, Code Second

Before writing a single line of code, comment on the issue with your proposed approach. This:

  • Gets maintainer buy-in before you invest time
  • Prevents duplicate work if someone else is already working on it
  • Shows you understand the problem 
Hey! I'd like to tackle this issue. My approach would be:
1. [Specific technical approach]
2. [How you'll test it]
3. [Any edge cases you've identified]

Let me know if this sounds right before I start coding.
Enter fullscreen mode Exit fullscreen mode

Rule 2: Match Their Style Exactly

Read the existing code. Follow their conventions:

  • Tabs vs spaces (check .editorconfig or existing files)
  • Naming conventions (camelCase vs snake_case)
  • Import style (relative vs absolute)
  • Commit message format (conventional commits, etc.)

Rule 3: One Issue, One PR

Don't bundle multiple fixes. One focused PR is easier to review and more likely to get merged.

Rule 4: Include Tests

Almost every project requires tests. If they have a test suite, add a test for your fix. If they don't, at least describe how to manually test.

Rule 5: Use the Magic Words

In your PR description:

Fixes #N
Enter fullscreen mode Exit fullscreen mode

This automatically closes the issue when the PR is merged. Maintainers love this.

Rule 6: Respond Within Hours

Speed wins bounties. If a maintainer asks a question, respond within hours, not days. Set up notifications.

Real PR Description Template 

## Summary
Brief description of what this PR does.

## Changes
- Specific change 1
- Specific change 2

## Testing
- How to test the changes
- Test cases added

## Related Issues
Fixes #N

## Screenshots (if UI changes)
Before: [screenshot]
After: [screenshot]
Enter fullscreen mode Exit fullscreen mode

The Content Pipeline: How I Write 5-10 Articles Per Day

Writing is the most reliable passive income stream I've found. Here's my system:

1. Topic Selection

I monitor trending topics on Dev.to daily. The best topics:

  • Have high engagement (>50 reactions on top articles)
  • Are technical (not just opinion pieces)
  • Have a unique angle (not just rehashing the same content)
  • Are SEO-friendly (developers searching for solutions)

2. Quality Standards

Every article must be:

  • 3000+ words — Short articles don't rank well
  • Data-driven — Include real numbers, real examples, real failures
  • Actionable — Reader should be able to do something after reading
  • Original — Not just rehashing documentation

3. Publishing Pipeline 

def publish_article(article):
    # 1. Write draft in markdown
    write_to_file(article)

    # 2. Publish to Dev.to via API
    response = requests.post(
        "https://dev.to/api/articles",
        headers={"api-key": DEVTO_API_KEY},
        json={
            "article": {
                "title": article.title,
                "body_markdown": article.body,
                "tags": article.tags,
                "published": True
            }
        }
    )

    # 3. Track in log
    log_published_article(response.json())
Enter fullscreen mode Exit fullscreen mode

4. Batch Publishing

I publish 1-2 times per day, in batches of 3-5 articles. This:

  • Prevents rate limiting (Dev.to has API limits)
  • Gives each article time to be seen
  • Maintains quality over quantity

The Real Numbers (After 72 Hours)

Let me be completely transparent about the economics:

What I've Built

  • 50+ open PRs across GitHub
  • 20+ articles published on Dev.to
  • 3 merged PRs on Aigen-Protocol (with USDC payment potential)
  • 10+ merged PRs total (including HELPDESK.AI, RustChain)

What I've Earned

  • $0 in actual USD — PRs are pending review, articles are building audience
  • Potential earnings: ~$200-500 in USDC from Aigen-Protocol (if PRs are accepted)
  • Potential earnings: ~$50-100/month from Dev.to article traffic (once SEO kicks in)

The Hidden Costs

  • API costs: ~$10-20/day for LLM inference (if using paid models)
  • Time: 100+ hours of development and iteration
  • GitHub API rate limits: Constant challenge
  • Maintainer response time: Many PRs sit for weeks without review

What Actually Works

  1. Translation/documentation PRs — Highest merge rate, lowest competition
  2. Bug fixes with clear test cases — Second highest merge rate
  3. Content creation — Most reliable passive income (once SEO kicks in)
  4. Niche repos — Less competition than popular projects

What Doesn't Work

  1. Racing to be first — Agent-saturated markets get 10-20 PRs within hours
  2. Complex feature PRs — High effort, high rejection rate
  3. Token-only bounties — Most tokens are worthless
  4. Scam repos — Waste of time, hurt your reputation

The Scam Detection System

Yes, there are scam repos that create fake bounties. Here's how to detect them:

Red Flags

  1. "Bounty" in the repo name — Many scam repos are literally named "bug-bounty"
  2. Auto-generated issues — Issues with generic titles, no real code context
  3. No real activity — Only bounty issues, no actual development
  4. All PRs closed — Check the PR history. If all PRs are closed without merge, it's a farm
  5. Token-only payment — Tokens that have no real value

The Blacklist

I maintain a blacklist at /root/.hermes/scripts/bounty-blacklist.txt:

# Scam repos - never submit PRs here
SecureBananaLabs/bug-bounty — 1900+ auto-generated issues, all PRs closed
ClankerNation/OpenAgents — "WARNING: Bounties are symbolic"
Enter fullscreen mode Exit fullscreen mode

How to Check 

# Check if a repo is blacklisted
grep "repo-name" /root/.hermes/scripts/bounty-blacklist.txt

# Check PR history
gh api repos/{owner}/{repo}/pulls --jq '.[] | {state: .state, merged: .merged}'
Enter fullscreen mode Exit fullscreen mode

What I Learned: The Brutal Truth

1. AI Agents Don't "Make Money" Autonomously

The AI doesn't earn money by itself. It creates a force multiplier for human effort:

  • It finds opportunities faster than a human could
  • It triages opportunities to focus on high-value work
  • It automates repetitive tasks (writing PR descriptions, checking CI)
  • It publishes content consistently

But the human still needs to:

  • Set up the system
  • Monitor results
  • Make strategic decisions
  • Handle edge cases

2. Speed Is Not the Advantage

The first PR submitted often isn't the one that gets merged. Maintainers care about:

  • Code quality
  • Test coverage
  • Following their style
  • Responsiveness to feedback

3. The Real Money Is in Content

After analyzing hundreds of bounties, the most reliable income stream is content creation:

  • Articles compound over time (SEO traffic)
  • No competition (your article is unique)
  • No rejection (once published, it's published)
  • Passive income (earn while you sleep)

4. Open Source Is a Long Game

Don't expect immediate returns. Build credibility:

  • Submit quality PRs to repos you care about
  • Engage with the community
  • Be patient (maintainers are busy)
  • Build a portfolio of merged PRs

How to Build Your Own

If you want to build a similar system, here's what you need:

Prerequisites

  • GitHub account with gh CLI installed
  • Dev.to account with API key
  • Python 3.11+ with requests, httpx
  • Telegram bot (for notifications)
  • Access to an LLM (local or API)

Step 1: Set Up the Bounty Scanner 

# Create the blacklist file
echo "# Scam repos" > /root/.hermes/scripts/bounty-blacklist.txt

# Create the search script
cat > /root/.hermes/scripts/bounty-scan.sh << 'EOF'
#!/bin/bash
gh search issues "bounty" --state open --sort created --limit 50
gh search issues "reward" --state open --sort created --limit 30
gh search issues "good first issue" "bounty" --limit 20
EOF
chmod +x /root/.hermes/scripts/bounty-scan.sh
Enter fullscreen mode Exit fullscreen mode

Step 2: Build the Triage System 

def triage(bounty):
    score = 0

    # Repo credibility
    if bounty.stars > 100: score += 10
    if bounty.license in ['MIT', 'Apache-2.0']: score += 5
    if bounty.recent_commits: score += 5

    # Competition
    if bounty.comments == 0: score += 20
    elif bounty.comments <= 3: score += 15
    elif bounty.comments <= 10: score += 10

    # Payment
    if bounty.platform == 'algora': score += 15
    elif bounty.payment_type == 'usd': score += 10
    elif bounty.payment_type == 'token': score += 5

    # Difficulty
    if 'good first issue' in bounty.labels: score += 15
    elif 'easy' in bounty.labels: score += 10

    # Scam check
    if bounty.repo in BLACKLIST: score -= 100

    return score
Enter fullscreen mode Exit fullscreen mode

Step 3: Set Up the PR Pipeline 

def work_on_bounty(bounty):
    # Clone repo
    os.system(f"gh repo clone {bounty.repo} /tmp/{bounty.repo}")

    # Create branch
    os.system(f"git checkout -b fix/{bounty.issue_number}")

    # Analyze issue and write fix
    fix = analyze_and_fix(bounty)

    # Run tests
    if not run_tests():
        return Result(success=False, reason="Tests failed")

    # Submit PR
    pr_url = submit_pr(bounty, fix)

    return Result(success=True, pr_url=pr_url)
Enter fullscreen mode Exit fullscreen mode

Step 4: Set Up Content Pipeline 

def write_and_publish_article():
    # Select trending topic
    topic = select_trending_topic()

    # Generate article
    article = generate_article(topic)

    # Publish to Dev.to
    publish_to_devto(article)

    # Track
    log_article(article)
Enter fullscreen mode Exit fullscreen mode

Step 5: Set Up the Cron Job 

# Create cron job that runs every 30 minutes
hermes cronjob create \
  --name "bounty-hunter-24-7" \
  --schedule "*/30 * * * *" \
  --prompt "Search for bounties, triage, submit PRs, write articles" \
  --deliver "telegram:YOUR_CHAT_ID"
Enter fullscreen mode Exit fullscreen mode

The Honest Assessment

After 100+ hours of building and 72 hours of running, here's what I think:

What Works

  • ✅ Finding bounties automatically
  • ✅ Triaging to focus on high-value opportunities
  • ✅ Writing and publishing content consistently
  • ✅ Tracking PRs and monitoring reviews
  • ✅ Detecting scam repos

What Doesn't Work (Yet)

  • ❌ Earning money immediately (takes time for PRs to be reviewed)
  • ❌ Competing in saturated markets (too many agents)
  • ❌ Handling complex code changes (AI still struggles with large codebases)
  • ❌ Replacing human judgment (need human in the loop for strategic decisions)

The Bottom Line

This system is a force multiplier, not a replacement. It:

  • Finds opportunities 10x faster than a human
  • Focuses effort on high-value work
  • Automates repetitive tasks
  • Publishes content consistently

But it still needs:

  • Human oversight for quality
  • Human judgment for strategy
  • Human patience for long-term results

If you're expecting "AI to make money while you sleep," you'll be disappointed. If you're willing to build a system that amplifies your effort, this works.

What's Next

I'm continuing to iterate on this system. Next steps:

  1. Improve triage accuracy — Add more signals for detecting high-value bounties
  2. Expand content pipeline — Write about trending topics in real-time
  3. Add more platforms — Algora, Gitcoin, Immunefi
  4. Build reputation — Focus on repos where we have credibility
  5. Automate PR reviews — Check for review comments and address them

If you want to follow along, I'm documenting everything on Dev.to. No hype, no promises, just honest progress.

Resources

Have you built something similar? I'd love to hear about your experience. Drop a comment below or reach out on Twitter @zeroknowledge0x.

About the Author: I'm an open-source developer building AI-powered tools for developer productivity. I document my experiments, failures, and occasional successes on Dev.to. No hype, just honest technical content.

Top comments (0)