The Swarm That Had to Audit Itself

Every few months, the AI tooling world produces a repository whose README reads like a systems vendor’s dream deck and whose download numbers suggest something important is happening. Ruflo — formerly Claude Flow, renamed at v3.5.0 in February 2026 after 5,800-plus commits and 55 alpha iterations — is currently that repository. The badges claim 22.2 million ecosystem downloads and 115,000 git clones in fourteen days. Those numbers describe momentum. They do not, by themselves, describe software. What makes Ruflo worth an editor’s attention is that it has already been through the argument about the difference, publicly, and come out the other side changed.

What it is, minus the confetti

Strip away the animated GIFs and the thirty-three plugins and the summit banner, and Ruflo is a harness for Claude Code and Codex. It sits between the coding agent and the LLM providers, and it gives that agent things Anthropic’s product doesn’t ship: persistent vector memory, swarm coordination across dozens of agent roles, a hooks system that intercepts tool calls to store context and trigger background workers, and — most ambitiously — a federation layer that lets agents on different machines authenticate and exchange work without leaking data.

The boring part is where the value is, as usual. The memory layer, AgentDB, is SQLite-backed vector storage with HNSW indexing over 384-dimensional embeddings. That is not exotic technology; it is the same approximate-nearest-neighbor machinery that underpins half the retrieval systems on earth. But persistent, sub-millisecond memory that survives sessions is the single most requested missing feature in agentic coding tools, and Ruflo’s implementation of it is, by all available accounts including the project’s own audits, real code that works. The hooks system — twenty-seven interceptors that route tasks, learn from successful patterns, and coordinate agents in the background — is the mechanism by which Ruflo claims session-to-session learning. Users keep writing code; the coordination happens underneath.

The less boring part is federation, which the README markets as “Slack for agents.” The analogy is more precise than it sounds. Slack gave teams shared channels across organizational boundaries; Ruflo’s federation gives agents shared workspaces across trust boundaries. Remote agents start untrusted, prove identity via mTLS and ed25519 challenge-response — no API keys, no shared secrets — and a PII-detection pipeline scans every outbound message before it leaves the node, with per-trust-level policies to block, redact, hash, or pass. Behavioral trust scoring continuously evaluates peers on a weighted formula of success rate, uptime, threat signals, and integrity; upgrades require history, downgrades are instant. Two teams could, in the README’s own example, share fraud-pattern analysis without sharing customer data. Whether that scenario works end-to-end today is a separate question, addressed below.

The audit saga

Here is why Ruflo is being talked about right now, and it is not the download badges.

In April 2026, an external audit by a reviewer going by roman-rr examined version 3.5.51 and flagged roughly 290 of the 300-plus advertised MCP tools as stubs — functions that returned success-shaped objects without doing the work. This is the oldest sin in the agent-tooling genre: a tool surface that looks comprehensive in a README and dissolves under inspection. The audit also confirmed a historical baseline of fake sleep calls standing in for real work and hardcoded token-savings figures — the += 100 school of benchmarking.

Most projects respond to such an audit with a defensive issue comment and a quiet refactor. Ruflo, one month and nine architecture-decision records later, ran its own verification swarm — a self-audit documented in ADR-093 — against the running server, and published the results. The picture inverted: approximately 195 of roughly 240 tools verified as real code. The gaps that remained were architectural rather than surface-wide, tracked in ADR-095 as seven named execution-layer holes: agent execution, hive-mind transport, the workflow runtime, the WASM agent, and neural prediction among them. ADR-085 acknowledged the fake-sleep and hardcoded-numbers history on the record.

The AlphaSignal write-up that catalogued all this was careful to note that its findings reproduce the project’s own published documentation, not independent test results. That caveat matters. But the shape of the response is unusual and, frankly, healthier than the industry norm. A project that publishes its own gap ledger, names its stubs, and fixes contract honesty — no more silent “completed” lies, schemas that round-trip what callers actually pass — is a project that has decided trust is a feature. The cryptographic verification command, which checks installed bytes against a signed witness manifest, extends the same instinct to the supply chain.

The honest benchmark, which is rarer than it sounds

There is a small detail in the README that deserves more attention than the 1.3×-to-1953× SOTA matrix against LangGraph, AutoGen, and CrewAI (a range so wide it functions more as a mood than a measurement). The vector-memory section states plainly that HNSW beats brute-force search by roughly 1.9× at twenty thousand vectors and 3.2×–4.7× at five thousand, with recall@10 around 0.99 — and then adds, unprompted, that approximate search ties or loses at small N, that there is a crossover point, and that the numbers come from a reproducible benchmark script and a dated audit file.

This is a benchmark that admits its own boundary conditions. In a genre where agent frameworks routinely claim 89% task-routing accuracy and 1953× speedups without error bars, a project that says “our index wins above the crossover and loses below it” is displaying a kind of honesty that should be contagious.

Position in a crowded field

The multi-agent orchestration space in 2026 is a comparison-chart arms race. LangGraph models workflows as directed graphs with checkpointing and time-travel debugging, and asks the most of teams upfront. CrewAI offers role-based crews with an intuitive mental model. Microsoft Agent Framework unifies AutoGen and Semantic Kernel for the Microsoft stack. Mastra serves TypeScript teams. The TrueFoundry comparison piece makes the structural point that no framework on the list answers governance — what agents can access, what they cost, who audits them — because that belongs to an infrastructure layer above the framework.

Ruflo’s differentiation is that it isn’t really competing in that list. It is a harness for a specific host — Claude Code and Codex — rather than a general orchestration framework you build applications on. The plugin marketplace (thirty-two native Claude Code plugins plus twenty-one npm packages) leans into that: ruflo-swarm, ruflo-rag-memory, ruflo-security-audit, ruflo-jujutsu for diff risk-scoring, and a long tail that includes ruflo-neural-trader (“AI trading with 4 agents, backtesting, 112+ tools”) and ruflo-iot-cognitum for IoT fleet trust-scoring. That long tail is either a rich ecosystem or a sign that nobody is saying no to a plugin PR, depending on your temperament. The two-install-path split — a lite plugin route that adds slash commands with zero workspace files, versus the full init that drops 98 agents, 60-plus commands, and a daemon into your project — is a genuine usability insight, and the README is candid that the lite path does not register the MCP server, so most of the advertised surface is unavailable there.

The hosted surfaces are a second bet. The web UI at flo.ruv.io is a multi-model chat with parallel MCP tool calling — one model turn can fire four to six tools simultaneously, rendered as cards — and the goal planner at goal.ruv.io ports GOAP, the goal-oriented action planning technique from game AI, to software work: plain-English goals decomposed into preconditions, effects, and an A* path through state space, with adaptive replanning when actions fail. Both are self-hostable, and both are zero-install to try. Porting a classic game-AI planner to agent orchestration is the kind of idea that is either prescient or a category error, and the live agent dashboard — where you can inspect trajectories, kill runaway workers, and reassign — suggests the project at least understands that observability is the product.

The limits, stated plainly

IBM’s primer on agent swarms makes the point that general-purpose wisdom keeps skipping: adding more agents does not automatically make a system better. Multiple agents introduce more coordination, communication, and resource use, and the value of a swarm depends on whether the additional capability justifies the complexity. Ruflo’s answer to that critique is more capability — consensus protocols (Raft, Byzantine, Gossip, CRDT, Quorum), four swarm topologies, three queen types, eight worker roles, twelve background workers. Whether that is justification or escalation is an open question.

The concrete, documented weaknesses are the ADR-095 gaps: agent execution, hive-mind transport, the workflow runtime, the WASM agent, and neural prediction remain stubbed or incomplete as of the May self-audit. That means the federation story — the most interesting idea in the repository — currently rests on plumbing whose execution layer is still being finished. The trust model is specified in impressive detail, but a zero-trust protocol is only zero-trust when the transport underneath it runs. The project’s own status documentation is the right place to check what currently works, and the README’s decision to lead with an “is-it-ready” doc is another point in its favor.

There is also the matter of provenance for the big numbers. The 22.2 million figure is labeled “ecosystem downloads” and links to a proof file in the repository itself; the npm registry carries the same codebase under two names, claude-flow and ruflo, both at the same version, with roughly 52,000 combined weekly downloads as of early May. Ecosystem-wide cumulative downloads across a multi-package family is a legitimate metric, but it is not the same metric as adoption of the current product, and readers should hold the distinction firmly in mind.

Outlook

Ruflo is at an inflection that most hyped repositories never reach: it has been audited, embarrassed, and re-audited, and it responded by building verification into the product and honesty into the benchmarks. The open questions are the ones ADR-095 tracks — whether the execution layer catches up to the specification, whether federation’s trust model survives contact with real cross-organizational use, and whether a hundred-agent swarm earns its coordination overhead on ordinary coding work or only on demos.

The likeliest near-term value is the least glamorous layer: persistent vector memory and the hooks system, which are real, measured, and attached to the most widely used agentic coding tool in the field. The rest — the swarms, the queens, the federation, the trading agents — is a bet that agent-to-agent collaboration across trust boundaries becomes infrastructure. If that bet lands, Ruflo will have been early with an unusually detailed answer. If it doesn’t, the project will still be the one that taught the genre that a self-audit is worth more than a badge.