One binary — sandboxed, built in Rust, yours to own.
Not a chatbot wrapper. Not a cloud service tied to one provider. A real agent server that runs on your hardware, remembers across sessions, and reaches you through every channel you use.
Up and running in 60 seconds
Three steps. No dependencies.
$ curl -fsSL moltis.org/install.sh | sh
2
Configure
Open localhost:13131, paste your provider key, pick a model. OAuth providers like GitHub Copilot work with zero config.
Secure by design
Your keys and private data never leave your machine. Sandboxed by default — your AI can't touch your filesystem unless you say so.
Your hardware
Runs on a 
Mac Mini, a Raspberry Pi, or any server you own. Always on, always local — like a house elf for your digital life.
macOS
Linux
Windows
Full-featured
Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams, voice, memory, scheduling, tools — all built-in. No plugin marketplace to get supply-chain attacked through.
What your agent actually does
Not a demo. These run today.
Schedules tasks
Recurring cron jobs in natural language
Runs code safely
Sandboxed shell in Docker or Apple Containers
Browses the web
Fetches, summarizes, and SSRF-protected
Manages your calendar
CalDAV integration for events and reminders
Messages everywhere
Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams
Remembers context
Persistent memory with vector + full-text search
Talks and listens
Voice input and output with cloud and local providers
Extends itself
Creates its own skills, hooks, and MCP tools at runtime
Works with your stack
20+ providers, local models, and every major channel — all built in.
OAuth — Zero Config
GitHub Copilot
OpenAI Codex
Kimi Code
Get Started
Install Moltis and start your AI assistant in minutes
Supported Platforms
Pre-built releases
Install with one command, or pick a release artifact for your platform from GitHub Releases.
Try it in the cloud
Ready in under a minute
Cloud is a great way to try Moltis. For the full experience, run it on your Mac, a VM, or any dedicated host.
Need setup details? See Cloud Deploy docs.
Features
Everything you need in one binary
One self-contained binary. No runtime dependencies, just download and run.
Run your own models locally. Automatic download and setup included.
HTTPS by default. Password, token, and passkeys access.
Run browser sessions in isolated Docker containers for safer automation.
Blocks loopback, private, and link-local IPs from LLM fetch.
First token appears instantly. Smooth replies, even during long runs.
Plugins, hooks, MCP tool servers with OAuth 2.1. Stdio or HTTP/SSE, auto-restart.
Full filesystem or per-session Docker, Podman, Apple Container, or WASM isolation.
Hybrid vector + full-text search. Your agent remembers context.
Pi-Inspired Self-Extension
Pi-inspired self-extension: creates its own skills at runtime. Session branching, hot-reload.
Web UI, Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams, or API. One agent, every frontend.
Talk to your assistant with multiple cloud and local TTS/STT providers.
Full read-only import of your OpenClaw workspace — conversations, skills, and settings. Switch in one click.
Create multiple agent personas with distinct personalities and capabilities. Full CRUD management UI.
Encryption-at-rest vault for API keys and secrets. Your credentials are encrypted on disk, not just in memory.
Native iOS app with push notifications via APNS relay. Coming soon to the App Store.
Full GraphQL API exposing all RPC methods. Build your own integrations and frontends.
Full i18n support. Eleven locales are built in today.
Run AI agents on GitHub PRs, Stripe payments, or any webhook. Review code, triage issues, handle payments — automatically.
And much more...
Security
- ✓ Passkeys (WebAuthn)
- ✓ Scoped API keys
- ✓ Encryption-at-rest vault
- ✓ Secrets zeroed on drop
- ✓ Human-in-the-loop approval
- ✓ Origin validation (CSWSH)
- ✓ No unsafe code
LLM Providers
- ✓ Anthropic, OpenAI, Gemini
- ✓ DeepSeek, Mistral, Groq, xAI
- ✓ OpenRouter, Ollama, Local LLM
- ✓ Custom OpenAI-compatible endpoints
- ✓ Provider fallback chains
- ✓ Per-provider metrics
Memory
- ✓ Hybrid search (vector + FTS)
- ✓ Local embeddings (GGUF)
- ✓ OpenAI batch API (50% off)
- ✓ Embedding cache
- ✓ File watching / live sync
- ✓ Session export
Extensibility
- ✓ MCP server support
- ✓ GraphQL API
- ✓ CalDAV calendar integration
- ✓ Hook system (lifecycle)
- ✓ Cron job scheduling
- ✓ Webhook triggers
- ✓ i18n (11 locales)
- ✓ OpenClaw import
- ✓ TOML configuration
Channels
- ✓ Web UI
- ✓ Telegram bot
- ✓ Discord
- ✓ Slack
- ✓ Matrix
- ✓ Nostr
- ✓ Microsoft Teams
- ○ iOS companion app (coming soon)
- ✓ JSON-RPC + GraphQL API
- ✓ Push notifications
- ✓ Multi-device sync
Observability
- ✓ Prometheus metrics
- ✓ OpenTelemetry tracing
- ✓ Structured logging
- ✓ Per-provider charts
- ✓ SQLite persistence
- ✓ Real-time WebSocket
Security-first design
An AI assistant you can trust on your machine
Why should you trust it?
Moltis is one file. You download it, you run it, done. There's no plugin store, no package manager, no runtime that could be compromised. The entire application is a single binary you can verify.
Your AI runs in a sandbox by default. It can't read your files, run commands, or browse the web unless you explicitly allow it. Every tool action can require your approval — or you can pre-approve specific ones you trust.
Your passwords and API keys are wrapped so they can never be accidentally logged, and the memory is zeroed the moment they're no longer needed. The language it's built in (Rust) makes entire classes of security bugs impossible at the compiler level.
What you won't find here
No plugin marketplace to get compromised. No JavaScript runtime. No dependency tree of 1,200 packages you can't review. One binary you can audit end to end.
How we protect you
| What if... | How Moltis handles it |
|---|---|
| Someone finds your instance | Password or passkey required from first launch, automatic HTTPS, rate limiting |
| AI tries to run dangerous code | Everything runs in a sandbox (Docker or Apple Container). Each action needs your approval first |
| A dependency gets compromised | There are no npm/pip packages to compromise. One binary, auditable dependencies. Integrations like Telegram are built-in, tested code |
| AI accesses your internal network | Internal and private network addresses are automatically blocked |
| Someone tries to steal your keys | API keys and passwords are hidden from logs and zeroed in memory after use |
| Session gets hijacked | Origin checking prevents cross-site attacks, HTTPS enabled by default |
| Unauthorized access | Passkeys, scoped API keys, per-tool permission policies |
Sandboxed execution
Docker & Podman
Each conversation gets its own isolated container. Shell commands and web browsing happen inside the sandbox, not on your real system.
Apple Containers
On Mac, uses Apple's built-in virtualization for lightweight isolation — no Docker needed.
WASM sandbox
Wasmtime-based sandbox with generic failover. Lightweight isolation without containers.
Fully open source
small
isolated unsafe surface*
470+
Rust files with tests
*Unsafe code is isolated to Swift FFI, local model wrappers, and precompiled WASM/runtime boundaries. The core agent and gateway paths stay in safe Rust.
How Moltis compares
Open-source AI assistants you can self-host
At a glance
| OpenClaw | Hermes Agent | Moltis | |
|---|---|---|---|
| Language | TypeScript + native apps | Python + TypeScript UI | Rust |
| Runtime | Node.js + npm/pnpm/bun | Python + uv/pip | Single binary |
| Main shape | Gateway + apps + nodes | CLI + gateway + research tools | Persistent agent server |
| Sandbox | App-level permissions | Local, Docker, SSH, cloud backends | Docker/Podman + Apple + WASM |
| Auth | Pairing + gateway controls | CLI + gateway setup | Password + Passkey + API keys |
| Voice | Voice wake + talk modes | Voice memo transcription | Built-in (15+ providers) |
| MCP | Plugin/integration support | MCP integration | Yes (stdio + HTTP/SSE) |
| Memory / RAG | Plugin + context engine | Memory + session search + user model | SQLite + FTS + vector |
| Hooks | Plugin/runtime hooks | Hooks/plugins | 15 event types |
| Channels | Broad channel and device list | Telegram, Discord, Slack, WhatsApp, Signal, CLI | Web, Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams |
| API | Gateway APIs | CLI/gateway APIs | JSON-RPC + GraphQL |
| OpenClaw import | — | Migration command | Full (read-only, safe) |
Security comparison
| OpenClaw | Hermes Agent | Moltis | |
|---|---|---|---|
| Code sandbox | App-level permissions and tool controls | Local, container, SSH, and cloud backends | Docker/Podman + Apple + WASM |
| Secret handling | Config, env, and plugin paths | Config and provider credentials | Encrypted vault, redacted, zeroed |
| SSRF protection | Tool/plugin dependent | Tool/backend dependent | Blocks loopback/private/CGNAT |
| WebSocket origin | Gateway dependent | Gateway dependent | Cross-origin rejection |
| Hook gating | Plugin/runtime hooks | Hooks/plugins | Inspect / modify / block |
| Rate limiting | Gateway dependent | Gateway dependent | Per-IP throttle + login limits |
Codebase snapshot
| OpenClaw | Hermes Agent | Moltis | |
|---|---|---|---|
| Local source size* | ~1.1M app LoC | ~152K app LoC | ~270K Rust LoC |
| Package shape | npm packages, extensions, apps | Python package, plugins, tools, UI packages | 59 Rust workspace crates |
| Primary install | npm install -g openclaw | install script, then hermes | Install script, Homebrew, Docker, Cargo |
| Test surface signal | Large TS/app test tree | Python and TUI tests | 470+ Rust files with tests |
*Measured with tokei from local checkouts, excluding dependency folders and generated build output. LoC is a scale and auditability signal, not a ranking.
Based on local checkout snapshots and public project information. Projects evolve quickly — check each repo for the latest. Full comparison in the docs.
Local AI assistants are still early software. Treat Moltis as alpha: run it carefully, review tool permissions, and avoid giving broad system access you do not need. Use responsibly.
built with love ❤️ by Fabien Penso