ruvnet/ruflo
What It Calls
Without a key: Text generation (gemini, openai, openrouter): has a branch that stops with an error without a key. External API (api.pinata.cloud): has a branch that stops with an error without a key. Text generation · Image generation · Embeddings (Google Gemini API): skips this call without a key. The other rows are in the table below.
| Feature | Provider | Use | Default | Alternative |
|---|---|---|---|---|
| Text generation | gemini, openai, openrouter | Key needed | generativelanguage.googleapis.com, api.openai.com +1 more |
None |
| External API (api.pinata.cloud) | api.pinata.cloud | Default call | api.pinata.cloud |
None |
| @ruflo/x-gateway — External API (relay.ruv.io)Separate unit: @ruflo/x-gateway | relay.ruv.io | Undetermined | relay.ruv.io |
None |
| @ruflo/ai-team-service — External API (team.ruv.io)Separate unit: @ruflo/ai-team-service | team.ruv.io | Undetermined | team.ruv.io |
None |
| Text generation · Image generation · Embeddings | Google Gemini API | Optional | generativelanguage.googleapis.com |
Skipped without a key (GOOGLE_API_KEY), Other providers |
| Text generation · Image generation · Speech-to-text · Text-to-speech · Embeddings | OpenAI | Optional | api.openai.com |
Skipped without a key (GOOGLE_API_KEY), Other providers |
| Text generation | OpenRouter | Optional | openrouter.ai |
Skipped without a key (GOOGLE_API_KEY), Other providers |
| @ruflo/x-gateway — External API (x.ruv.io)Separate unit: @ruflo/x-gateway | x.ruv.io | Optional | x.ruv.io |
Skipped without a key (OPENAI_APPS_CHALLENGE) |
| API | Credential | Code evidence | Pricing | Pricing page | Checked |
|---|---|---|---|---|---|
| api.pinata.cloud | Credential unclear | v3/@claude-flow/cli/cloud-functions/publish-registry/index.js:66The code calls the api.pinata.cloud external API and includes an API key in the request header. |
No pricing info | - | - |
| relay.ruv.io | Credential unclear | plugins/ruflo-x-gateway/src/server.mjs:197An unresolved import in the calling file |
No pricing info | - | - |
| team.ruv.io | Credential unclear | plugins/ruflo-ai-team/src/server.mjs:133An unresolved import in the calling file |
No pricing info | - | - |
| Google Gemini API | Your API key | ruflo/src/mcp-bridge/index.js:1061Google Gemini API is the default; if no key is present, the call is skipped. Other providers can be selected instead. |
Free tier | Pricing | 2026-10-05 |
| OpenAI | Your API key | ruflo/src/mcp-bridge/index.js:1060OpenAI is the default; if no key is present, the call is skipped. Other providers can be selected instead. |
Paid | Pricing | 2026-10-05 |
| OpenRouter | Your API key | ruflo/src/mcp-bridge/index.js:1062OpenRouter is the default; if no key is present, the call is skipped. Other providers can be selected instead. |
Free tier | Pricing | 2026-10-05 |
| x.ruv.io | Credential unclear | plugins/ruflo-x-gateway/src/server.mjs:386The default is x.ruv.io; the call is skipped if the OPENAI_APPS_CHALLENGE setting is missing. |
No pricing info | - | - |
Data sent out: prompt text · 4 provider(s) unconfirmed
Fetched over the network: Package registries (npm registry)
Checked scope: Partial check — 400/7,328 files · tree not truncated · no submodules · 992 unresolved import path(s)
Next
Badge preview
[](https://whatitcalls.reactiveworks.dev/en/ruvnet/ruflo)
Shows as “external API · used” in a README.
Was this analysis helpful?
Freshness details
- Checked commit
9fa701a466159242dfec06379ce1278c849a3e34- Committed
- 2026-10-07 08:05 UTC
- Checked
- 2026-10-07 12:06 UTC
- HEAD last seen
- 2026-10-07 12:05 UTC ·
9fa701a(same as the checked commit) - Read depth
- Basic (up to 400 files · 8 MB)
- Scanner · rules
scan-5+verdict-4- Pricing catalog
- version 2
- Correction revision
- 0
- Summary
- Model ollama-cloud/gemma4:31b-cloud · some rule sentences
What is sent out
- Confirmed Prompt text is sent to Google Gemini API, relay.ruv.io, OpenAI, and OpenRouter.
plugins/ruflo-x-gateway/src/server.mjs:197plugins/ruflo-x-gateway/src/server.mjs:263plugins/ruflo-x-gateway/src/server.mjs:338 - Estimated Prompt text may be sent externally.
plugins/ruflo-chatgpt-federation/src/server.mjs:123plugins/ruflo-chatgpt-federation/src/server.mjs:131 - Unconfirmed Providers whose payload was not found in the code: gemini, openai, openrouter, api.pinata.cloud, team.ruv.io, x.ruv.io
README claims ↔ code2
no API key
🔒 Zero-trust federation Remote agents start untrusted. Identity proven via mTLS + ed25519 challenge-response. No API keys, no shared secrets.README.md:353
The README states no API key is needed, but the code requires keys for Gemini, OpenAI, OpenRouter, or Pinata for text generation and external API calls. ruflo/src/ruvocal/mcp-bridge/index.js:667 ruflo/src/mcp-bridge/index.js:1060
local
verify.mjs loads @noble/ed25519 via createRequire . With pnpm's default isolated node-linker, transitive deps don't hoist to the workspace root unless a workspadocs/validation/README.md:224
The README states it runs locally, but the code requires calls to Gemini, OpenAI, OpenRouter, or Pinata for text generation and external API usage. ruflo/src/ruvocal/mcp-bridge/index.js:667 ruflo/src/mcp-bridge/index.js:1060
Code quotes
Source files are not stored. Code is linked at the checked commit on GitHub; stored quotes are at most 3 lines per evidence and 6 per file.
Source: ruvnet/ruflo · commit 9fa701a · ruflo/src/ruvocal/mcp-bridge/index.js
Source: ruvnet/ruflo · commit 9fa701a · ruflo/src/mcp-bridge/index.js
Source: ruvnet/ruflo · commit 9fa701a · v3/@claude-flow/cli/cloud-functions/publish-registry/index.js
Checked scope details
Files
- In the repository
- 7,328
- Checked
- 400 (5%)
Manifests
113 priority file(s) not read
v3/@claude-flow/codex/src/templates/index.tsv3/@claude-flow/codex/src/validators/index.tsv3/@claude-flow/codex/src/worktrees/index.tsv3/@claude-flow/hooks/src/daemons/index.tsv3/@claude-flow/hooks/src/executor/index.ts
+108 more
package.jsonruflo/package.jsonplugins/ruflo-ai-team/package.jsonplugins/ruflo-arena/package.jsonplugins/ruflo-chatgpt-federation/package.jsonplugins/ruflo-graph-intelligence/package.json
+24 more
Unresolved import paths (992)
pathToFileURL(cliPath).hrefbin/cli.js:11toImportURL(join(cliBase, 'bin', 'cli.js'))ruflo/bin/ruflo.js:58toImportURL(join(cliBase, 'dist', 'src', 'index.js'))ruflo/bin/ruflo.js:61pathToFileURL(join(cliDir, 'node_modules', pkgName, 'dist/index.js')).hrefscripts/check-metaharness-pins.mjs:233../dist/src/mcp-client.jsv3/@claude-flow/cli/bin/cli.js:166
not read 961 · missing file 19 · dynamic import 6 · entry not read 6
Excluded files
.md2,079.json395.sh202.svelte85.yaml83.svg75
+25 more
- External code not checked
- None
- Limits hit
- file count limit
- Symbolic links not followed
- 4
Correction history
No corrections yet.