temodar-agent

Multi-Provider AI System

Temodar Agent includes a multi-provider AI configuration system with stored profiles, active profile switching, and connection testing.

Supported providers currently present in the application:

• Anthropic
• OpenAI
• Copilot
• Gemini
• Grok

Provider system features already implemented:

• multiple saved provider profiles
• active provider switching
• model selection per profile
• model list storage per profile
• provider connection testing
• optional custom base URL support
• masked API key handling in the UI layer

Semgrep Security Analysis

Temodar Agent includes a production-oriented Semgrep analysis workflow for WordPress source code review.

Built-in Semgrep coverage

The current application ships with support for these default Semgrep rulesets:

• OWASP Top 10
• PHP security
• security audit

Custom rule and ruleset management

The current Semgrep system also supports:

• custom Semgrep rule creation
• custom rule deletion
• rule enable / disable toggling
• bulk enable / disable operations
• ruleset add / remove / toggle actions
• validation of custom rule documents
• bulk Semgrep scanning across a scan session
• persistent local storage for Semgrep outputs

This makes Temodar Agent useful not only as an AI security research tool, but also as a Semgrep operations layer for teams that maintain their own detection logic.

WordPress Security Triage and Prioritization

Temodar Agent helps security teams reduce noise before manual review starts.

The scanning system can:

• scan WordPress plugins or themes from public sources
• filter by install counts and update windows
• identify abandoned or user-facing targets
• prioritize packages using metadata, tags, and security-related signals
• assign relative risk labels for faster triage
• stream progress to the dashboard in real time
• store scan sessions for later comparison and follow-up

Why Teams Use Temodar Agent

Temodar Agent is designed for organizations that want:

• a faster way to review large WordPress plugin ecosystems
• an AI agent layer on top of source code analysis
• a bridge between Semgrep findings and human investigation
• reusable investigation memory per target
• a local-first workflow for security research and internal review

Requirements

Temodar Agent is designed to run with Docker.

You need:

• Docker installed and running
• permission to run Docker commands on your machine

Useful links:

• Download Docker Desktop
• Docker Engine installation guide
• Docker documentation

Installation

1. Pull the latest image

docker pull xeloxa/temodar-agent:latest

2. Start Temodar Agent

docker run -d --name temodar-agent -p 8080:8080 \
  -v temodar-agent-data:/home/appuser/.temodar-agent \
  xeloxa/temodar-agent:latest

latest is recommended if you want the newest published image, but starting an existing container with docker start temodar-agent does not pull new images. To move to a newer latest, pull the image again and recreate the container.

Run a specific version

If you want a pinned release instead of latest, use a version tag:

docker pull xeloxa/temodar-agent:v0.1.3
docker run -d --name temodar-agent -p 8080:8080 \
  -v temodar-agent-data:/home/appuser/.temodar-agent \
  xeloxa/temodar-agent:v0.1.3

Open the dashboard at:

• http://127.0.0.1:8080

Data Persistence

Temodar Agent stores persistent application data in one named Docker volume: temodar-agent-data, mounted at /home/appuser/.temodar-agent.

This is a hard cutover to the canonical runtime root. Existing three-volume installs are no longer the supported Docker contract. Recreate the container with the official one-volume command instead of keeping temodar-agent-plugins or temodar-agent-semgrep mounted.

Typical Workflow

1. Start Temodar Agent with the official docker run command
2. Open the local dashboard
3. Launch a WordPress plugin or theme scan
4. Review risk labels and prioritized targets
5. Run Semgrep on a selected target or across a session
6. Open an AI thread for source-aware follow-up analysis
7. Continue investigation with stored context, thread memory, and runtime events

Updating

Temodar Agent no longer runs host-side update scripts or local rebuild flows.

To update manually:

docker pull xeloxa/temodar-agent:latest
docker rm -f temodar-agent >/dev/null 2>&1 || true
docker run -d --name temodar-agent -p 8080:8080 \
  -v temodar-agent-data:/home/appuser/.temodar-agent \
  xeloxa/temodar-agent:latest

The in-app update UI only notifies you about new releases and can copy this manual Docker update command. If you installed a pinned tag such as v0.1.3, update by pulling and rerunning the newer pinned tag you want rather than assuming docker start will move you forward.

If you are upgrading from an older three-volume install, stop using the old plugin and Semgrep volumes and recreate the container with only temodar-agent-data mounted at /home/appuser/.temodar-agent.

Star History

Legal Disclaimer

This project is intended for authorized security research, defensive analysis, and educational use only. It is designed to help researchers and developers assess WordPress plugin and theme attack surfaces, prioritize risky targets, and review code more efficiently.

Do not use this software against systems, plugins, themes, or environments you do not own or do not have explicit permission to test. The author and contributors are not responsible for misuse, damage, service disruption, data loss, or any legal consequences resulting from improper use.

Always ensure your testing is authorized and compliant with applicable laws, regulations, and disclosure policies.