Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
Talos
Self-hosted personal agent for terminal and Telegram whose deterministic permission kernel rules on every tool call ('the model proposes, it never decides'), with scoped approvals, sandboxed shell and an append-only audit trail.
talos-agent.ch/Active
v0.19.19-alpha release 2026-09-18; changelog beta.6 dated 2026-10-24; repo pushed 2026-10-25. (checked 2026-10-25)
In Agent guardrails
Where it stands apart
- How is it mainly sustained? individual side project, no revenue (25% of 20 others)
- Who is it for? both (5% of 21 others)
- What mainly decides whether an action is allowed? a person approving in the moment (5% of 21 others)
- Which agents does it work with? one specific agent (19% of 21 others)
What it shares with most of the community
- Is it actively maintained? active (81% of 21 others)
- How is the main thing licensed? permissive open source (MIT/Apache/BSD) (67% of 21 others)
- Can it run entirely on your own device or infrastructure, without the maker's servers? yes (76% of 21 others)
- Do you need an account to use it? no account (67% of 21 others)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails closed: the action does not run (71% of 17 others)
- What is the main thing it protects? the developer's machine and files (52% of 21 others)
- What is it mainly for? adding checkpoints, review, or evidence (52% of 21 others)
- Is enforcement kept out of the agent's reach? yes, enforced in code or infrastructure the agent cannot change (95% of 21 others)
Not documented
The public sources we read don't say:
- Does it control the agent's outbound network access?
Nearest neighbors
- Plimsoll 67% of 15 shared answers match
- JitPass 63% of 16 shared answers match
- Airlock 56% of 16 shared answers match
Every answer
| Question | Answer | Source |
|---|---|---|
| Is it actively maintained? | active | source 2026-10-25 |
| How is the main thing licensed? | permissive open source (MIT/Apache/BSD) MIT | source 2026-10-25 |
| How is it mainly sustained? | stands apart individual side project, no revenue MIT, "no Talos subscription fee"; first-person solo author; no company or sponsors found. | source 2026-10-26 |
| Can it run entirely on your own device or infrastructure, without the maker's servers? | yes Ollama local models or Claude/Codex workers. | source 2026-10-25 |
| Do you need an account to use it? | no account Self-hosted install on your machine; no Talos account. Model providers have their own. | source 2026-10-26 |
| Who is it for? | stands apart both Personal agent usable from Telegram as well as terminal. | source 2026-10-25 |
| Which shared standard or format does it mainly build on? | none of these (its own format or interface) Its own agent and permission kernel. | source 2026-10-26 |
| Where does it mainly step in? | at the tool-call, MCP, or API layer (proxy or gateway) Kernel gates every tool call; shell additionally sandboxed. | source 2026-10-25 |
| What mainly decides whether an action is allowed? | stands apart a person approving in the moment Allow once, allow this task, or exact-action standing approvals; hard denials stay denials. | source 2026-10-25 |
| If the guard itself breaks, is missing, or cannot decide, what happens by default? | fails closed: the action does not run run_shell refuses to run where no sandbox is available; missing keys fail closed. | source 2026-10-25 |
| Which agents does it work with? | stands apart one specific agent Talos is itself the agent (with Claude/Codex as workers). | source 2026-10-25 |
| In the default setup, where does the agent's work actually execute? | in a local VM, container, or OS sandbox Shell runs under bubblewrap or sandbox-exec. | source 2026-10-25 |
| What is the main thing it protects? | the developer's machine and files | source 2026-10-25 |
| Does it keep a record of agent actions? | yes, ordinary logs or a timeline Append-only audit trail; intent written before execution. | source 2026-10-25 |
| Does it control the agent's outbound network access? | Not documented | source 2026-10-25 |
| What is it mainly for? | adding checkpoints, review, or evidence | source 2026-10-25 |
| Is enforcement kept out of the agent's reach? | yes, enforced in code or infrastructure the agent cannot change | source 2026-10-25 |
Sources
This page was derived from:
- GitHub · github.com/talos-kernel/Talos · read 2026-10-25
- Web page · talos-agent.ch/ · read 2026-10-25
Are you a maintainer? Claiming and correcting projects is coming soon.