6 AI Agents · Auth0 FGA · Token Vault · Zero Raw Token Exposure

The LeetCode of Open Source

OpenStep AI reads your GitHub, finds the right issue for your skill level, loads the code in a browser editor, and coaches you Socratically — never writing code for you.

Start Contributing See How It Works

AI Agents

User Personas

100%

Free Tier

Raw Tokens Exposed

How It Works

From signup to merged PR — seven steps, six agents, zero raw token exposure.

Sign in via Auth0

GitHub OAuth — Auth0 handles everything. Zero credential management.

Token Vault stores credentials

Your GitHub token goes into Token Vault. Agents only get scoped, short-lived access.

Scout + Oracle discover issues

Scout profiles your GitHub. Oracle finds issues within your exact skill delta.

Forge loads the workspace

Monaco editor + file tree + E2B sandbox in under 5 seconds.

Sage mentors Socratically

Ask questions, get questions back. Sage is forbidden from writing code for you.

Submit your PR

Guardian watches your PR. Maintainers rate it. Ranker awards XP and badges.

The Six Agents

Each agent has exactly one job and gets only minimum scope from Token Vault.

Scout

Reads your GitHub profile & builds a skill fingerprint

Oracle

Finds the perfect open source issue for your skill level

Sage

Socratic AI mentor — guides with questions, never answers

Forge

Monaco editor + E2B sandbox — code & run right in browser

Guardian

Watches GitHub webhooks for PRs and merge events

Ranker

Awards XP, unlocks badges, updates your contribution profile

Auth0 + Token Vault

Credential Passport — each agent gets only the minimum permission it needs. The LLM never sees your raw token.

🔑 Auth0

▸ GitHub Social Login — one-click sign in
▸ Auth0 Actions — fires Scout on login automatically
▸ Fine-Grained Authorization — Student / Maintainer roles
▸ M2M Tokens — agents authenticate to each other

🛡️ Token Vault

▸ Stores GitHub, GitLab, npm credentials
▸ Scout gets read-only profile access only
▸ Forge gets file-read scope only
▸ LLM (Sage) never receives raw credentials

Token Vault Flow

1. GitHub OAuth → Auth0→

2. Auth0 → Token Vault→

3. Agent requests scoped token→

4. Agent runs one operation→

5. Token expires ✓

Security guarantee

🔒 Zero raw token exposureSage (the LLM) only receives structured text — file names, error messages. Never your GitHub token.

⏱ Tokens expire per-operationToken Vault issues a scoped credential for one operation, then it expires. No long-lived secrets in agent memory.

🎭 Two-role system, one codebaseStudents and Maintainers see entirely different UIs, enforced by Auth0 FGA at the server layer before any JSX loads.

The LeetCode Layer

Rank up by shipping real contributions to real projects.

🌱

Newbie

0 XP

🔧

Contributor

500 XP

⚡

Collaborator

2,000 XP

🛠️

Maintainer

8,000 XP

👑

Legend

25,000 XP

🐛First Bug Fix

📚Doc Writer

🔥Week Streak

🧪Test Author

☕Java Hunter

🐍Pythonista

⭐Star Repo

🤝Team Player

Zero-Cost Stack

Every tool has a free tier. No credit card required.

Auth0FREE

Identity, FGA, M2M tokens

Token VaultFREE

Credential passport — scoped per agent

Perplexity SonarHAVE KEY

Powers Sage's Socratic mentorship

E2B.devFREE

Cloud sandbox — 300ms boot

SupabaseFREE

PostgreSQL + Realtime

GitHub APIFREE

Issues, file trees, PRs, webhooks