BitPull
# BitPull client
This is the source code of the BitPull client: the desktop app, the `bitpull` command line, the MCP server (`npx -y bitpull mcp`), the local dashboard and the worker that runs jobs when you lend your computer.
You can read exactly what runs on your computer: what lending does, how jobs are sandboxed, what the app sends to https://bitpull.cloud and what stays on your machine.
The server (website, API, network, billing) is not part of this repository.
- Website: https://bitpull.cloud
- Guide for AI assistants: https://bitpull.cloud/llms.txt
- Downloads and releases: https://github.com/SamuealPK/bitpull-releases
## What is here
| Folder | What it is |
|---|---|
| `apps/agent` | CLI, MCP server (`src/mcp.ts`), local dashboard (`ui/`, `src/control.ts`), worker and sandbox, setup and doctor |
| `apps/desktop` | Tauri 2 app that runs the agent as a sidecar: autostart, tray, watchdog, updater |
| `packages/core` | Shared code: manifests, access policy, release signature checks, job encryption, open-model catalogue, requirements per system |
## Build and test
Requires Node.js 20 or later.
```sh
npm install
npm run typecheck
npm test
npm run agent -- doctor
```
Tests that need the BitPull server are not included. The desktop app also needs Rust and the Tauri 2 prerequisites: `cd apps/desktop && npx tauri dev`.
Official builds are signed and published from https://github.com/SamuealPK/bitpull-releases. A build you make yourself updates itself only if you keep the updater settings, and it connects to https://bitpull.cloud unless you set `BITPULL_COORDINATOR`.
## Licence
[Functional Source License 1.1, Apache 2.0 future licence](LICENSE.md) (FSL-1.1-ALv2).
You can read, change, build and use this code for any purpose except offering a product or service that competes with BitPull. Two years after each version is published, that version becomes available under the Apache 2.0 licence.
The name BitPull and its logo are not covered by the licence.
## Security
Please report security problems privately through GitHub's "Report a vulnerability" on https://github.com/SamuealPK/bitpull-releases, not in public issues.
TDQS
Scored across 72 tools
Several clusters are genuinely hard to tell apart from names alone: ask_open_model vs ask_group_model vs use_open_model vs ask_ai_model, list_open_models vs list_ai_models vs list_group_models vs bitpull_chat_models, and bitpull_status vs bitpull_setup_status vs job_status vs bitpull_site_job. The long descriptions do resolve most of these once read, but an agent scanning names will misselect frequently in the model and status families.
All names are snake_case, but prefixing is inconsistent: some are bitpull_*, others are bare (search_repos, run_job, my_balance, publish_repo, preview_click). Verb styles also vary, with noun-only names like bitpull_site_job, bitpull_groups, bitpull_site_accounts mixed against verb-led names.
72 tools is far beyond a reasonable surface for one server; the domains span publishing, databases, scheduling, local compute lending, model access, preview/browser control, repos, and setup checks. Many tools are narrow one-shot variants that could be folded into a handful of parameterised tools.
Across its many sub-domains the core lifecycle is largely covered: create/authorise/remove folders, prepare/publish/remove repos, create/claim/disconnect accounts, schedule create/run/delete, and job run/status/save files. Gaps are minor (no explicit unpublish/delete-site or edit-manifest operation), and agents can work around them.