A Simple and Universal Swarm Intelligence Engine, Predicting Anything. 简洁通用的群体智能引擎,预测万物
Go to file
Yo-LRK ed840c7a00 security: H5 traceback gate + MED tier (upload sniff, path validation, CSP)
H5 (traceback leak, completing the prior log-level fix): new app/utils/security.py
safe_traceback() logs the full stack server-side and returns it to clients only when
FLASK_DEBUG; all 53 traceback.format_exc() in api/{graph,report,simulation}.py now call
it (import traceback removed).

Upload content sniff: upload_content_ok() magic-byte check — pdf must start %PDF-,
txt/md/markdown rejected if they contain NUL bytes (BOM-prefixed UTF-16/32/8 text
allowed). Wired into the graph.py upload loop so a renamed binary can't pass the
extension whitelist.

Path validation: validate_id() (^[A-Za-z0-9_-]{1,64}$) blocks traversal before every
id->filesystem sink — ProjectManager._get_project_dir, SimulationManager._get_simulation_dir,
ReportManager._get_report_folder + the two Report*Logger __init__, and a new
SimulationRunner._run_dir() that all RUN_STATE_DIR joins route through.

CSP / security headers: CSP <meta> in index.html, vite preview.headers
(X-Frame-Options/nosniff/Referrer-Policy + CSP frame-ancestors), and a Flask
after_request that sets the same headers on API responses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 18:00:28 +07:00
.github/workflows feat(docker): add Docker support with Dockerfile, docker-compose.yml, and .dockerignore; update README for Docker deployment instructions 2026-01-22 14:35:41 +08:00
backend security: H5 traceback gate + MED tier (upload sniff, path validation, CSP) 2026-06-13 18:00:28 +07:00
frontend security: H5 traceback gate + MED tier (upload sniff, path validation, CSP) 2026-06-13 18:00:28 +07:00
locales fix(i18n): further shorten English metrics and improve workflow layout 2026-04-01 19:07:19 +08:00
static/image feat(README): add demo video sections for Wuhan University Public Opinion and Dream of the Red Chamber simulations; include new image asset 2026-01-20 11:17:11 +08:00
.dockerignore feat(docker): add Docker support with Dockerfile, docker-compose.yml, and .dockerignore; update README for Docker deployment instructions 2026-01-22 14:35:41 +08:00
.env.example security: address HIGH findings (stored XSS, wildcard CORS, prod log leak) 2026-06-13 17:32:36 +07:00
.gitignore fix(report_agent): refine tool call handling and response validation; enforce strict separation between tool calls and final answers 2026-02-24 17:47:44 +08:00
Dockerfile security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline) 2026-06-13 17:19:05 +07:00
LICENSE Add GNU AGPL v3 License 2025-12-19 15:24:16 +08:00
README-ZH.md docs(readme): fix typo in Shanda logo alt text 2026-05-23 16:30:55 +08:00
README.md security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline) 2026-06-13 17:19:05 +07:00
docker-compose.yml security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline) 2026-06-13 17:19:05 +07:00
package-lock.json Change project license from Apache-2.0 to AGPL-3.0 in package.json, package-lock.json, and backend/pyproject.toml. 2025-12-22 16:41:45 +08:00
package.json security: harden C1-C4 (debug-RCE, auth, denial-of-wallet, sim deadline) 2026-06-13 17:19:05 +07:00

README.md

MiroFish Logo

666ghj%2FMiroFish | Trendshift

简洁通用的群体智能引擎,预测万物
A Simple and Universal Swarm Intelligence Engine, Predicting Anything

666ghj%2FMiroFish | Shanda

GitHub Stars GitHub Watchers GitHub Forks Docker Ask DeepWiki

Discord X Instagram

English | 中文文档

Overview

MiroFish is a next-generation AI prediction engine powered by multi-agent technology. By extracting seed information from the real world (such as breaking news, policy drafts, or financial signals), it automatically constructs a high-fidelity parallel digital world. Within this space, thousands of intelligent agents with independent personalities, long-term memory, and behavioral logic freely interact and undergo social evolution. You can inject variables dynamically from a "God's-eye view" to precisely deduce future trajectories — rehearse the future in a digital sandbox, and win decisions after countless simulations.

You only need to: Upload seed materials (data analysis reports or interesting novel stories) and describe your prediction requirements in natural language
MiroFish will return: A detailed prediction report and a deeply interactive high-fidelity digital world

Our Vision

MiroFish is dedicated to creating a swarm intelligence mirror that maps reality. By capturing the collective emergence triggered by individual interactions, we break through the limitations of traditional prediction:

  • At the Macro Level: We are a rehearsal laboratory for decision-makers, allowing policies and public relations to be tested at zero risk
  • At the Micro Level: We are a creative sandbox for individual users — whether deducing novel endings or exploring imaginative scenarios, everything can be fun, playful, and accessible

From serious predictions to playful simulations, we let every "what if" see its outcome, making it possible to predict anything.

🌐 Live Demo

Welcome to visit our online demo environment and experience a prediction simulation on trending public opinion events we've prepared for you: mirofish-live-demo

📸 Screenshots

Screenshot 1 Screenshot 2
Screenshot 3 Screenshot 4
Screenshot 5 Screenshot 6

🎬 Demo Videos

1. Wuhan University Public Opinion Simulation + MiroFish Project Introduction

MiroFish Demo Video

Click the image to watch the complete demo video for prediction using BettaFish-generated "Wuhan University Public Opinion Report"

2. Dream of the Red Chamber Lost Ending Simulation

MiroFish Demo Video

Click the image to watch MiroFish's deep prediction of the lost ending based on hundreds of thousands of words from the first 80 chapters of "Dream of the Red Chamber"

Financial Prediction, Political News Prediction and more examples coming soon...

🔄 Workflow

  1. Graph Building: Seed extraction & Individual/collective memory injection & GraphRAG construction
  2. Environment Setup: Entity relationship extraction & Persona generation & Agent configuration injection
  3. Simulation: Dual-platform parallel simulation & Auto-parse prediction requirements & Dynamic temporal memory updates
  4. Report Generation: ReportAgent with rich toolset for deep interaction with post-simulation environment
  5. Deep Interaction: Chat with any agent in the simulated world & Interact with ReportAgent

🚀 Quick Start

Prerequisites

Tool Version Description Check Installation
Node.js 18+ Frontend runtime, includes npm node -v
Python ≥3.11, ≤3.12 Backend runtime python --version
uv Latest Python package manager uv --version

1. Configure Environment Variables

# Copy the example configuration file
cp .env.example .env

# Edit the .env file and fill in the required API keys

Required Environment Variables:

# LLM API Configuration (supports any LLM API with OpenAI SDK format)
# Recommended: Alibaba Qwen-plus model via Bailian Platform: https://bailian.console.aliyun.com/
# High consumption, try simulations with fewer than 40 rounds first
LLM_API_KEY=your_api_key
LLM_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
LLM_MODEL_NAME=qwen-plus

# Zep Cloud Configuration
# Free monthly quota is sufficient for simple usage: https://app.getzep.com/
ZEP_API_KEY=your_zep_api_key

Security configuration (required for production)

The backend ships secure-by-default. When FLASK_DEBUG=false (the default) the app runs under gunicorn (no Werkzeug debugger) and refuses to start unless these are set:

# A random secret (required when FLASK_DEBUG=false):
#   python -c "import secrets;print(secrets.token_hex(32))"
SECRET_KEY=your_random_secret

# API-key auth is ON by default — every /api/* request must carry the key.
# Clients send  X-API-Key: <API_KEY>  (or  Authorization: Bearer <API_KEY> ).
AUTH_ENABLED=true
API_KEY=your_strong_api_key
  • The bundled web UI reads the key from the build-time var VITE_API_KEY (set it equal to API_KEY) and sends it automatically as X-API-Key. It must be present before the frontend is built:
    • Docker: put VITE_API_KEY in the root .env; docker compose up --build injects it as a build-arg (docker-compose.yml build.args → Dockerfile ARG VITE_API_KEYnpm run build). The pre-built ghcr.io image (used by a bare docker compose up without --build) bakes no custom key — rebuild, or use AUTH_ENABLED=false for that path.
    • Local frontend build: copy frontend/.env.examplefrontend/.env and set VITE_API_KEY, then npm run build. (The root .env is read by the backend only, not by Vite.)
    • ⚠️ A key baked into the client bundle is extractable by anyone who loads the page — for multi-tenant/public exposure replace this with session login or a gateway that injects per-user tokens. For local/internal/VPN or behind-a-gateway single-host use it is sufficient.
  • Local development / simplest single-host demo: set AUTH_ENABLED=false to disable the key requirement entirely (the API is then protected only by your network boundary).
  • Cost controls (denial-of-wallet): a run is bounded by OASIS_DEFAULT_MAX_ROUNDS (when the client omits max_rounds), the hard ceilings OASIS_MAX_ROUNDS_CAP / OASIS_MAX_AGENTS_CAP, and per-round / total timeouts OASIS_ROUND_TIMEOUT_SEC / OASIS_RUN_TIMEOUT_SEC. See .env.example for defaults.
  • Run the production server with a single worker (gunicorn -w 1 --threads N); simulation run-state is held in-process, so multiple workers break stop/status routing.

2. Install Dependencies

# One-click installation of all dependencies (root + frontend + backend)
npm run setup:all

Or install step by step:

# Install Node dependencies (root + frontend)
npm run setup

# Install Python dependencies (backend, auto-creates virtual environment)
npm run setup:backend

3. Start Services

# Start both frontend and backend (run from project root)
npm run dev

Service URLs:

  • Frontend: http://localhost:3000
  • Backend API: http://localhost:5001

Start Individually:

npm run backend   # Start backend only
npm run frontend  # Start frontend only

Option 2: Docker Deployment

# 1. Configure environment variables (same as source deployment)
cp .env.example .env

# 2. Pull image and start
docker compose up -d

Reads .env from root directory by default, maps ports 3000 (frontend) / 5001 (backend)

Mirror address for faster pulling is provided as comments in docker-compose.yml, replace if needed.

📬 Join the Conversation

QQ Group

 

The MiroFish team is recruiting full-time/internship positions. If you're interested in multi-agent simulation and LLM applications, feel free to send your resume to: mirofish@shanda.com

📄 Acknowledgments

MiroFish has received strategic support and incubation from Shanda Group!

MiroFish's simulation engine is powered by OASIS (Open Agent Social Interaction Simulations), We sincerely thank the CAMEL-AI team for their open-source contributions!

📈 Project Statistics

Star History Chart