Flocks: a security operations desk where the agents do the swarming

What it does

Flocks is a Python-based SecOps platform where AI agents (build, plan, and general roles) collaborate on security tasks. It ships as a self-hosted service: a FastAPI backend, a browser WebUI, a terminal UI, and a CLI to manage it all. Tooling includes bash execution, file operations, code search, and LSP integration, with support for Anthropic, OpenAI, and Google models plus MCP.

The interesting bit

The auth model is unusually thoughtful for a self-hosted agent platform: every HTTP path is protected by default, non-browser clients (including loopback) must present an API token, and the middleware deliberately refuses to trust loopback requests when a reverse proxy is in front without X-Forwarded-For — closing a classic privilege-escalation hole. Session status is also exposed granularly (idle, busy, dreaming — yes, dreaming), so automation can poll whether work is actually running.

Key highlights

• Multi-agent collaboration with build, plan, and general agent roles
• WebUI, TUI, and HTTP API all served from one origin — cookies and SSE stay on a single host, which simplifies reverse-proxy deployments
• Model-agnostic: Anthropic, OpenAI, Google, and MCP support
• Docker and native installs, plus a beta Windows installer
• Admin CLI covers token rotation, one-time password recovery, and orphan-session reassignment

Caveats

• Docker deployments can’t run the agent-browser in headed mode
• The README is heavy on install instructions and light on what the agents actually do for SecOps — the concrete workflows live in the separate docs site
• Community support runs through WeChat, which may not suit everyone

Verdict

Worth a look if you want a self-hosted, API-first agent platform for security work and care about sane auth defaults. If you were hoping for a detailed description of the SecOps playbooks themselves, the README won’t tell you — you’ll need to dig into the docs.