creator-agent: a grounded audience agent that makes zero AI-provider calls
Build AI agents grounded in a creator's documents, audio, and video.
At a glance
- What is it?
- creator-agent is a TypeScript monorepo that turns a creator's documents, audio and video into a source-grounded audience agent. Its beta runs on deterministic local retrieval, and the README states it makes no AI-provider calls, so the interesting question is what it actually does today.
- Who is it for?
- Adopt creator-agent if you want to study or extend private-by-default ingestion, owner-scoped APIs and deterministic grounded retrieval in a TypeScript workspace, or if you are a creator willing to run the public beta while transcription stays manual. Do not adopt it as a production answering system: the README states the beta makes zero AI-provider calls, video without captions stays Awaiting transcription, and the GitHub App registration is still pending.
- Can I use it commercially?
- Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.
- Is it still maintained?
- Yes. The repository last received commits 17 days ago.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 18, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What creator-agent solves, and for whom
Most creator tools ask you to hand over a corpus and trust the vendor with it. creator-agent takes the opposite position. The README describes it as a platform for building an AI agent grounded in creator-approved content, where sources are preview-only by default and require explicit approval before they can appear in public answers. Processing, disabled, preview-only and deleted sources are excluded from public retrieval.
The audience is narrow and stated in the README: creators exploring a conversational layer for videos, podcasts, courses, newsletters or documentation; developers studying private-by-default ingestion, grounded answers, tenant isolation and bring-your-own-agent routing; and early design partners willing to test onboarding and source-review workflows. It is not a general chatbot builder. The unit of work is one creator's approved corpus, scoped to that creator's owner ID on every database path.
The second problem is cost control. The README is explicit that the default local simulator is deterministic and network-free, makes no AI-provider calls, consumes no AI tokens and cannot create model charges. That is a real design constraint, not a marketing line: it means the shipped answer path is retrieval over indexed text, not generation.
How the routing, ingestion and quarantine pipeline fit together
The repository is an npm workspace with apps and packages directories, plus a compose.yaml that defines two services: postgres:17-alpine and clamav/clamav:1.4. The API workspace owns migrations, a scan worker and a cleanup worker, exposed as db:migrate, scan:once and cleanup:once at the root.
Ingestion has three paths. Pasted document or audio-transcript text is chunked and indexed in browser memory. A local video can use a creator-provided WebVTT sidecar immediately. A managed MP4 up to 250 MB uploads directly to private S3-compatible storage under a 10-minute policy that pins exact key, type and size, and the Auth0 token is sent only to the API, never to storage.
After upload, a zero-AI one-shot worker claims uploaded sources using PostgreSQL leases, validates bounded MP4 metadata, then streams the full object in 1 MB chunks to the ClamAV daemon. Only a clean verdict persists duration, codecs and malware status and moves the source to Awaiting transcription. Invalid or infected files are deleted and disabled, and scanner outages stay quarantined for bounded retry. That lease-based claim is the part worth copying: it prevents two workers from scanning the same object, and it degrades into retry rather than data loss when the scanner is down.
Authentication runs through Auth0 Universal Login with OIDC Authorization Code and PKCE. GET /v1/me validates the JWT signature, issuer, audience, expiration, RS256, subject and the read:creator permission before returning an internal creator ID. PostgreSQL maps the verified (issuer, sub) pair to an opaque internal UUID, and no profile data or access tokens are stored.
Installing creator-agent and running a first grounded answer
The root package.json sets engines to node >=22 and defines workspaces for apps/* and packages/*. The README points at the public beta at creator-agent-yvetteysy.onrender.com, and notes that Render Free services may need up to about 50 seconds to wake after inactivity. For local work, the README does not spell out an install sequence, but the repository layout and scripts do: install dependencies, start the database and scanner, migrate, then run the simulator.
npm install
docker compose up -d
docker compose psThe compose file binds PostgreSQL to 127.0.0.1:5432 and ClamAV to 127.0.0.1:3310, both on localhost only. The ClamAV service is capped at 4 GB of memory, 2 CPUs and 256 processes, with stream and file limits of 250M. If docker compose ps shows the scanner unhealthy, check that cap before anything else; ClamAV signature loading is the slow part of startup.
npm run db:migrate
npm run devnpm run dev maps to the @creator-agent/simulator workspace. The README states that local mode is network-free and deterministic, so the answer you get comes from the local retrieval engine over approved text, and it either returns citations or says it lacks enough information. To run the local agent alongside the app, the root package.json provides a combined script.
npm run dev:e2eThat script runs @creator-agent/local-agent and the simulator together through concurrently. To exercise the managed path instead, use npm run dev:api and npm run scan:once for the quarantine worker. The README does not document a rollback command for a migration or a way to un-quarantine a disabled source, so plan for that gap before pointing the API at real content.
Where creator-agent stops being the right tool
The honest limitation is that this is not yet an answering system in the generative sense. The README states plainly that the current answer, customization and load flows are deterministic and that the beta intentionally makes zero AI-provider calls. If your requirement is a fluent, synthesized answer over a large corpus, creator-agent today gives you retrieval with citations or an explicit refusal, and nothing else.
Video is the second boundary. A video without captions remains Awaiting transcription, a durable upload stops at Uploaded, and the managed API requires a clean quarantine verdict plus explicit transcript approval before a source reaches ready. Replacement revokes public visibility. There is no transcription provider wired in, so a creator with a library of uncaptioned MP4s will do manual work per file.
The GitHub integration is the third. The README describes a minimum-permission path that can list selected repositories and import one Markdown, MDX or text file up to 1 MB as preview-only knowledge, with tokens kept server-side. It also states that public GitHub App registration is the remaining launch step. Until that is done, the integration is not something an outside creator can enable on their own.
Finally, the licence is unknown. The repository listing shows no licence file, and the README does not name one. For a project whose whole pitch is control over private content, that omission matters more than usual.
How it differs from a hosted RAG platform
The obvious alternative is a hosted retrieval-augmented generation service, where you upload documents to a vendor, the vendor chunks and embeds them, and an API returns generated answers. The difference in approach is the direction of control. A hosted platform owns the index, the embedding model and the generation step, and you get an API key. creator-agent keeps the corpus in your own PostgreSQL and S3-compatible storage, gates public visibility behind explicit source approval, and scopes every database path to a verified internal owner ID.
The second difference is the failure mode you are buying. A hosted RAG service will almost always produce a sentence, including when the corpus does not support one. creator-agent's deterministic engine is documented to return citations or say it lacks enough information. For a creator whose reputation rides on not being misquoted, a refusal is a feature. For a product that needs conversational fluency, it is a wall.
A third difference is the routing model. The README frames the project around bring-your-own-agent routing, so the intended shape is that a creator or developer supplies the model later rather than the platform bundling one. That keeps the token bill with the person who chose the model, which is consistent with the zero-cost preview and the badge claiming zero AI-provider calls.
Maintenance cost, upgrade surface and licence questions
The last push to main was on 2026-09-01, and the repository is not archived. There are no retrieved releases, so version 0.1.0 in the root package.json is the only version marker visible, and upgrades will have to be tracked through commits rather than release notes.
The dependency surface is heavy for an MVP. The devDependencies pin TypeScript ^7.0.2, Vite ^8.2.2, Vitest ^4.1.11, React 19 types and jsdom, and the workspace spans four build targets: core, api, local-agent and simulator. npm run check runs typecheck, tests and build in sequence, which is the command to run before any upgrade. The compose file pins postgres:17-alpine and clamav/clamav:1.4, and the ClamAV container carries explicit scan limits, so a scanner major upgrade means re-checking CLAMD_CONF_StreamMaxLength, MaxFileSize, MaxScanSize, MaxScanTime, MaxThreads, MaxQueue and ReadTimeout against the 250 MB upload ceiling.
On licensing, there is nothing to analyse. The repository listing shows no licence file, and neither the README nor package.json declares one. package.json sets private to true, which prevents accidental npm publication but says nothing about what others may do with the source. If you intend to build on this, treat the licence as an open question to resolve with the maintainer rather than an assumption.
Editorial conclusion
Adopt creator-agent if you want to study or extend private-by-default ingestion, owner-scoped APIs and deterministic grounded retrieval in a TypeScript workspace, or if you are a creator willing to run the public beta while transcription stays manual. Do not adopt it as a production answering system: the README states the beta makes zero AI-provider calls, video without captions stays Awaiting transcription, and the GitHub App registration is still pending. Verify first that the ClamAV service in compose.yaml starts with the 4 GB memory limit, that the GitHub App registration step in docs/GITHUB_APP.md is complete, and that your licence question is answered, since the repository lists no licence file.
Frequently asked questions
Does creator-agent make any AI-provider calls?
No. The README states that the beta intentionally makes zero AI-provider calls, that the default local simulator is deterministic and network-free, and that the answer, customization and load flows consume no AI tokens and cannot create model charges.
How do I run creator-agent locally?
Install with npm install, start PostgreSQL and ClamAV with docker compose up -d, apply migrations with npm run db:migrate, then start the simulator with npm run dev. The root package.json requires Node >=22.
What happens to a video I upload to creator-agent?
In managed Auth0 mode an MP4 up to 250 MB uploads directly to private S3-compatible storage, then a zero-AI worker streams it to ClamAV in 1 MB chunks. A video without captions remains Awaiting transcription, and the managed API requires a clean quarantine verdict plus explicit transcript approval before the source becomes ready.
Community notes