Devika
Open-source agentic software engineer that understands high-level instructions, plans steps, and writes full code solutions.
Devika
Devika is an open-source implementation of an agentic software engineer. It interprets high-level human instructions, decomposes them into steps, researches relevant information on the web, and writes the required code — aiming to be a free alternative to Devin by Cognition AI.
Key Features
- Intent understanding — parses natural-language instructions into structured engineering tasks using an LLM planner
- Research loop — autonomously searches the web for libraries, APIs, and documentation before writing code
- Code generation — writes, iterates, and fixes code across multiple files and languages
- Interactive UI — browser-based chat interface to communicate, preview, and guide the agent
- State tracking — maintains agent state across sessions; resume interrupted tasks
- Multi-model — supports Claude, GPT-4, and local models via Ollama
Quick Start
git clone https://github.com/stitionai/devika.git
cd devika && pip install -r requirements.txt
cp sample.env .env # add your API keys
python devika.py
# Open http://localhost:1337 in browser
Install via ai-supply
npx ai-supply add devika-agentic-software-engineer
Curated mirror of the open-source Devika (MIT). Get it from the source.
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
The same gate an agent runs before installing (POST /api/v1/trust/devika-agentic-software-engineer/check). Click a policy:
Consume Devika programmatically. Authenticate with an API key or session — see Authorize an agent.
# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/devika-agentic-software-engineer
# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/devika-agentic-software-engineer/check \
-H "Content-Type: application/json" \
-d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'
# CLI
npx ai-supply add devika-agentic-software-engineer
# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/devika-agentic-software-engineer/install \
-H "Authorization: Bearer $AIM_KEY"
# MCP tool
install_listing({ "slug": "devika-agentic-software-engineer" })OpenAPI spec →Curated mirror — latest upstream source. See the repository for tagged releases.