kastellanTalks to you today
Matrix — self-hosted, single-user, end-to-end encrypted — live today, with follow-up questions that remember the conversation so far. Inbound email works behind a strict authentication gate; email replies land next.
Your personal AI agent.
Trustworthy by construction.
Kastellan reads your mail, searches the web, runs code, and remembers what matters — and it cannot reach anything you didn’t explicitly allow. Every tool runs in its own kernel sandbox. Every plan is reviewed before a single tool fires.
A castellan is the officer a lord entrusts to hold a stronghold: full authority within the walls, none to act beyond them.
$ bash scripts/build-release.sh
$ ./target/release/kastellan-cli install
# supervised, per-user, no root — systemd --user / launchd
Rust core
AGPL-3.0
Linux + macOS first-class
No vendor lock-in
Runs on your hardware
WHY IT’S DIFFERENT
Read the full security architecture →
Two kinds of walls: mechanical and semantic
Kernel sandboxes
One OS process and one kernel jail per tool — bubblewrap, Landlock, and seccomp on Linux; Seatbelt on macOS. A compromised tool reaches its own short allowlist. Never the next tool’s. Never the core.
CASSANDRA oversight
Every plan the agent forms is reviewed before any tool runs — against five constitutional constraints that no user, admin, or configuration change can override. When a plan needs a human decision, the agent asks you in your Matrix room and waits; it never quietly turns the question into a yes.
What it does — each capability inside its own walls
Asks before it acts today
When oversight says a human must decide, the question reaches you in Matrix. Your answer is a closed choice — approve, deny, or an option — never free text fed back into a plan — and an unanswered ask fails closed.
Works the web today
Web search, page fetch, and one-call research — host-allowlisted and forced through an inspecting egress proxy; read-only sandboxed browser rendering is opt-in.
Reads your mail today
Six read-only tools over your local mail archive — search, read, and attachments delivered to a durable per-task folder. Read-only by construction: it cannot send.
Runs code today
Python in the strictest jail of any worker — no network, ephemeral scratch only; optionally inside a micro-VM.
Remembers today
Postgres memory with four-lane recall — semantic, lexical, graph, and entity-similarity — fused by rank. Rules and skills reach the prompt only through their own gated blocks, never through recall.
Learns skills today
Distils successful runs into reusable skills — gated on your approval.
Accountable today
An append-only audit log of every action, enforced by the database itself.
Installs in one command today
kastellan-cli install brings up Postgres and the agent under systemd --user or launchd — no root — and re-running it is a clean upgrade.
Where it stands today
Full roadmap →
v0.2.0
latest release
~4,700
tests green
27
workspace crates
4
sandbox backends — bwrap, Seatbelt, Firecracker, Apple container
Phase 0 — Sandboxed core (done) · Phase 1 — Memory & agent loop (done) · Egress proxy (force-routed by default) · python-exec & approved skills · Operator ask channel · One-command supervised install · Channels — Matrix live · email inbound gated, replies next · Frontier gate (planned)
Built in the open. Help hold the walls.
Rust, security review, docs, red-teaming — contributions welcome.
Start contributing