https://xitter.cf/t.co/EY4L2eWRoi

Joined January 2024
LibreChat retweeted
what if instead of sandboxing the agents we sandboxed ourselves
121
347
64
5,639
167,996
LibreChat retweeted
An MCP server is only as good as the API it wraps. One of many lessons from a year of running @LibreChatAI in production for the whole company: buff.ly/v1QECMG
1
6
481
How to keep AI spend flat while token usage grows exponentially: Not with friction and spend alerts. With better defaults, routing, and caching. Better Defaults (not Usage Caps) – Engineers can choose any model they want, but defaults matter. We’re experimenting with defaulting to open weight models like GLM 5.2 and Kimi 2.7 through our LLM gateway, while still encouraging engineers to choose the right model for the task. 91% of our employees were never hitting their usage caps, so instead of lowering caps and driving up alerts, we're moving to cheaper defaults. Note that code reviews use a diversity of models, so they can check each other's work. Better Routing – In our custom harnesses, we preprocess prompts and route to the best model for the job, considering cache hits and model pricing. For instance, you may want a frontier model for planning, but not for execution where they can be overkill. Ultimately, humans shouldn't be choosing models - AI can automate this task. Better Caching – Cache misses are the easiest way to drive your cost up. All of our requests are cache aware, so we’re reusing a warm cache wherever possible. For example, our cache hit rate went from 5% → 60% in LibreChat once properly implemented. Keep Context Lean – Start fresh sessions when switching tasks. Scope file context narrowly. Disconnect unused tools. Don't just compact. The goal isn't fewer tokens used, it's fewer tokens wasted. Better Visibility – Our engineers can use as many tokens as they want, from whatever model they want, but we’ve made usage visible – and the more you spend on AI, the more impact we expect. The goal isn't to suppress usage. It's to build the infrastructure that makes exponential growth sustainable. Putting this into practice has cut our AI spend nearly in half, while our token usage continues to grow.
477
730
450
6,167
4,302,954
This is why building your AI story on open and scalable foundations is key, and the reason @ClickHouseDB joined forces (acquired) @LibreChatAI and @langfuse. Open platforms on top of a fast data substrate take it to the next level. clickhouse.com/ai
How to keep AI spend flat while token usage grows exponentially: Not with friction and spend alerts. With better defaults, routing, and caching. Better Defaults (not Usage Caps) – Engineers can choose any model they want, but defaults matter. We’re experimenting with defaulting to open weight models like GLM 5.2 and Kimi 2.7 through our LLM gateway, while still encouraging engineers to choose the right model for the task. 91% of our employees were never hitting their usage caps, so instead of lowering caps and driving up alerts, we're moving to cheaper defaults. Note that code reviews use a diversity of models, so they can check each other's work. Better Routing – In our custom harnesses, we preprocess prompts and route to the best model for the job, considering cache hits and model pricing. For instance, you may want a frontier model for planning, but not for execution where they can be overkill. Ultimately, humans shouldn't be choosing models - AI can automate this task. Better Caching – Cache misses are the easiest way to drive your cost up. All of our requests are cache aware, so we’re reusing a warm cache wherever possible. For example, our cache hit rate went from 5% → 60% in LibreChat once properly implemented. Keep Context Lean – Start fresh sessions when switching tasks. Scope file context narrowly. Disconnect unused tools. Don't just compact. The goal isn't fewer tokens used, it's fewer tokens wasted. Better Visibility – Our engineers can use as many tokens as they want, from whatever model they want, but we’ve made usage visible – and the more you spend on AI, the more impact we expect. The goal isn't to suppress usage. It's to build the infrastructure that makes exponential growth sustainable. Putting this into practice has cut our AI spend nearly in half, while our token usage continues to grow.
2
4
58
9,169
LibreChat retweeted
See how @Visa built conversational business intelligence agents at scale with ClickHouse Cloud and @LibreChatAI: ✔️ Sub-second queries over millions of rows ✔️ 8-10 hours saved per user per week ✔️ Millions of dollars in revenue risk surfaced early enough to act on clickhou.se/4af3Ijl
3
1
19
6,386
LibreChat retweeted
This is crazy. The hacker installed a dead-man's switch that will wipe your computer if you revoke the GitHub token they stole from you. Revoking the token is what triggers the wipe.
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/router/i… Credit to the security researcher for responsible disclosure.
141
960
157
9,332
1,722,973
LibreChat retweeted
Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below
1,331
5,200
1,316
27,490
66,669,167
LibreChat retweeted
have been discovering @LibreChatAI hands-on since we joined Clickhouse & it's such a good product. bullish
Langfuse x @LibreChatAI integration is now available. Shout-out to @lgtm_hbu for the ship! Integrate with this quick guide: langfuse.com/integrations/ot…
1
2
705
Replying to @LibreChatAI
@LibreChatAI just got acquired by ClickHouse! Unified interface for LLMs, use Helicone to access any provider with top-tier observability by default. Try it. File a bug. Run it in prod. Show us the graphs.
2
8
729
🔮Peek into the future of commerce! During the keynote at @mcpsummit, we showcased the integrations of Shopify MCP servers and @LibreChatAI via MCP-UI, enabling seamless product search and purchasing capabilities. 🧵 Watch the live demo by @little_bret & @smlpth:
1
4
8
3,120
We are launching a whole bunch of MCPs internally at @Opendoor all connected to our internal chat system built on LibreChat. Opendoor Assistant (internal AI agent to make us work faster) also shipped yesterday.
99
178
44
1,803
207,554
LibreChat retweeted
Shopify runs an internal fork of librechat, and we merge most everything back. I highly recommend other companies give this project a look for their internal LLM system. It works very well for us.
Very excited to start to work full-time on the internal fork of the LibreChat project led by @lgtm_hbu (link 👇🏽), which is by far the best open-source AI Chat. As we work on making this better for Shopify, we also plan to increasingly contribute upstream 🔥.
26
40
11
907
175,423
LibreChat retweeted
[New post] 🔥A Deep Dive Into MCP and the Future of AI Tooling APIs were the internet’s first great unifier but AI models lack an equivalent. What are the use cases of MCPs today? Where are the challenges? Here's a technical deep dive & map of the current ecosystem 👇
80
280
55
1,359
261,611
💫 Built with Meilisearch: LibreChat @LibreChatAI is an open-source AI Chat app that enables using a single, customizable UI to interact with all AI providers. It uses Meilisearch to search through conversation history.
2
6
18
1,831
The Code Interpreter API and Agents are now live for @LibreChatAI! Agents: • No-code, use Compatible Providers • Integrated Tools & Actions • Private & shareable Code Interpreter API: • Secure sandbox • Multi-language • Available as Agent Tool code.librechat.ai/pricing
3
1
14
1,852
Replying to @LibreChatAI
@LibreChatAI released a feature for GPT before @OpenAI did 🫨 Code artifacts. A way to see not just the code, but its results. Right inside the chatbot 🤯 • Live web pages • Interactive charts • Working UI designs LibreChat now offers this for multiple AI models. And yes, they introduced code artifacts for GPT and @GeminiApp before OpenAI and Google did. I tested it out: 1️⃣ Made a frontend skills diagram 2️⃣ Built a working React to-do list 3️⃣ Turned a sketch into a live UI Key point: See and interact with results instantly. Great for learning, prototyping, and quick builds. Other use-cases of code artifacts? Share your ideas! #ai #aichamps
1
6
707
🪄 Code Artifacts for LibreChat are officially out! 🎥 I made a quick demo showcasing the game-changing features: • Generative UI: React, HTML, Mermaid diagrams • Use any model you have setup • Iterate on created output Check out the demo: 👉 youtube.com/watch?v=GfTj7O4g…
3
4
23
1,366
When you ask where the training data comes from
228
1,876
272
23,561
3,511,400
Hey! 💥 Tired of paying for ChatGPT Plus & Claude Pro? I ditched the subscriptions and self-hosted my own AI solution using the open-source @LibreChatAI youtube.com/watch?v=Y8PHxEng…
1
3
525