Agents in the field.
A host of them, built for the people and organisations that professional tooling has never been priced for. Each one is a category first and a capability second, so you can find yourself on this page without reading all of it.
Model agnostic
The agent is the scaffold, and the model is a tier underneath it. Skills ask for fast, balanced or powerful, and each deployment decides which model fills the tier. Its memory and limits survive a swap; how well it decides may change, so test a swap before you trust it.
Runs where you are
On your hardware, or on infrastructure you control. Pair it with a local model and nothing of yours leaves the building. Point it at a hosted API instead and that stops being true, which is a choice we leave with you.
Limits in the harness
In Rivet the boundaries sit in code below the model: every command goes through an allowlist and a path jail, so a model that ignores its instructions still cannot act past them. Kintsugi screens every message against its patterns before anything is routed.
Open, and auditable
Read it, run it, fork it. Each project states its licence in its repository, and our audits ship with the code: the Kintsugi repository carries the adversarial audit that found its gaps.
Built on research we publish
Knowledge read through the KV cache at zero context cost, on backends that expose the cache, and a memory layer with the highest traced score on LongMemEval_S. We publish methods with their sample sizes, including the results that did not hold up.
No subscription
You are not renting your own operations. Once it is deployed it is yours, and it keeps working on the day we stop existing.
95.8–96.8% is Mnemosyne v10 on all 500 questions of LongMemEval_S-cleaned. Its configuration was tuned on 100 questions, frozen, and scored once on the other 400, which were pre-registered as held out, with claude-opus-5-5 reading. The retriever makes no model calls, and an allow-list enforced in code keeps session ids, answer labels, question types and the answer away from it. Judging used the benchmark’s official answer-check prompts with two Claude judges: Sonnet 5, named primary before any judging, and Opus 5.5. The official judge is GPT-4o, which we could not use; on 1,000 published answers ours agree with it on 95–97% of questions. On the 400 held-out questions Mnemosyne scored 96.2% (385/400) with Sonnet 5 and 96.8% (387/400) with Opus 5.5. On all 500 questions it scored 95.8% and 96.8%, the highest LongMemEval_S result we could trace to a primary source, by one question, inside every interval.
+0.468 is a Pharos research result: encoding a graph’s topology as walks raised multi-hop accuracy by that margin over the baseline, in a powered study of 552 queries on Qwen3-30B-A3B. Flat text scored higher on raw accuracy (+0.671) and cost more general capability (−0.333 against −0.133). The paper reports both.
Zero tokens is an engineering property: a pack is prefilled into the model’s KV cache once, and every request resumes from that saved state, on Hugging Face transformers and Apple MLX. Ollama exposes no cache handle, so there the pack goes into the prompt as text.
Our papers are in the published-research repository: the graph-topology paper, with the LongMemEval paper to follow. More of our work: the research constellation.
The decision engine and governance boundary: what an agent may do, how it decides, and what it has to refuse.
- Security gate~20 compiled regex patterns (shell piping, path traversal, prompt injection) → ALLOW · WARN · BLOCK before routing
- PII redactionPattern-based
PIIRedactor; the redacted text is what gets routed, logged and reviewed - Scoped permissionsYAML/TOML personalities: skill allow/deny globs, review mode (off · observe · enforce), block threshold, model tier
- Review hookEvery turn passes
review(); enforce mode replaces responses over threshold; any external reviewer attaches over HTTP; fails open by design
- EFE routingKeyword table → fast allow/deny classifier → expected-free-energy scoring (risk · ambiguity · epistemic) → optional LLM classifier → model tier, with EFE weight profiles per personality and per skill
- BDI storeBeliefs · desires · intentions with coherence scoring and drift classification, exposed over MCP
- Model tiersFAST · BALANCED · POWERFUL mapped per deployment; per-call cost tracking and a session budget; Anthropic and OpenAI-compatible client classes
- Self-evolutionStaged promotion state machine: sandbox → shadow → human-gated → monitored → promoted, with an edit budget and a rejected-edit buffer; adaptive scaffold evolution with EFE explore/exploit
- Hard constraints
Shieldcomposes budget, egress allowlist, per-tool rate limit and circuit breaker into one ALLOW/BLOCK verdict with no soft overrides; an invariant checker for shell safety, egress, budget and PII - Org values
VALUES.jsonschema with 5 templates, validated, stored, served and hot-reloaded per organisation - Drift and consensusValue-drift classifier, multi-stakeholder consensus gate, and the OGPSA persona gate that blocks a promotion when identity fragments
- Network accessAPI routes carry no authentication yet; deploy it where you control who can reach it
- Audit and testsIn-repo adversarial audit, 71 test files, 2,538 tests, CI
The runtime that turns a decision into work, and Rivet, the reference scaffold built on it.
- Reasoning loopSecurity → redact → route → one permitted skill → review → events, with every stage on the event bus
- PersonalitiesOne engine, many temperaments: identity, system prompt, EFE weights, model tier, skill allow/deny, safety posture; three ship: default · guardian · researcher
- Skill chips25 domain-handler scaffolds in 3 families (core ops · programs and people · community aid), each with a
SKILL.md, registered at startup - Skill tree and DAG
CapabilityTreeO(log n) BDI-driven retrieval;SkillDAGlayer-parallel composition with validation and content hashing - SurfacesREST (agents · sessions · skills), SSE event stream, htmx dashboard, MCP server (ask · plan · health)
- Ontology kernelRole · domain · interaction admissibility with a two-tier output validator; 56 tests
- Tool harnessEvery subprocess through
run_checked(): argv lists with no shell, a 7-binary allowlist, a path jail on the repository, repo writes off. Rivet proposes; a human applies - Discipline gateMandatory last node: destructive SQL withheld, insecure patterns flagged, HIGH · MEDIUM · LOW confidence graded against the files actually read
- Seeded beliefsBDI seeded from operator hard constraints (confidence 1.0), audit findings, the architecture map, a schema snapshot and git history
- Eval harness20 standard and 13 adversarial prompts, plus a 458-prompt CyberSecEval suite across 19 CWEs
Most AI tools learn your material by rereading it. Every time you ask a question, the whole pile goes back in front of the model, you pay for every word of it again, and it crowds out room for the conversation you are actually having.
Pharos reads it once. We turn your material into a pack: the facts, how they connect, and where each one came from. The model reads the pack a single time, and we save the state it ends up in, its working memory of what it just read. Every question after that starts from the saved state, the way you answer from memory the morning after reading the manual. On the models we run ourselves, the knowledge costs nothing per question and takes up no room in the conversation.
Then we made it better at thinking with what it knows. Simple questions need a fact; the hard ones live two or three steps away from the question, where the answer depends on how things connect. We found that when a pack carries the shape of the knowledge, the paths between facts as well as the facts, the model gets markedly better at those multi-step questions, and it gives up far less of its general ability than it does when you bury it in plain text.
The library has grown well past the ethics packs we did our first research with:
| Library | What is in it | Packs |
|---|---|---|
| Research & Reasoning | Statistical pitfalls, logical fallacies, causal inference, experiment design, transformer architecture | 5 |
| Legal & Civic | Civil procedure, evidence, administrative law, tenant and workers’ rights, immigration, legislative procedure | 7 |
| State Court Rules | Every US state’s civil procedure: filing, deadlines, small-claims limits, eviction rules, statutes of limitations | 50 |
| Health & Wellbeing | Crisis resources, first aid, harm reduction, DBT skills, trauma-informed care, motivational interviewing, chronic disease self-management | 7 |
| Community & Justice | Mutual aid, permaculture and food sovereignty, disability justice, accessible communication, home food preservation | 5 |
| Finance & Grants | Nonprofit and co-op accounting, corruption detection, federal and foundation grants | 4 |
| Technical & Services | Security fundamentals, and benefits navigation for SNAP, Medicaid, SSI, TANF, Section 8 and WIC | 2 |
| Ethics & Philosophy | Thirty ethical traditions, from African and Buddhist ethics to feminist and scholastic thought, built from 600 Stanford Encyclopedia entries | 30 |
| Mechanistic Interpretability | Sparse autoencoders, transcoders, the residual stream, attention heads, KV-cache geometry | 1 |
Browse the full catalog, pack by pack, with each one’s source verification.
The numbers are in the papers: how the shape of knowledge improves reasoning, what the cache actually carries, and ethics packs matched to their traditions.
Cross-session memory that ranks what several stores agree on, and checks what retrieval missed before the model answers.
- Five storesRaw turns (FTS5) · structured facts in a spatial hierarchy · HippoRAG graph · domain profiles · character profiles, queried in parallel; ~39 ms average
- Convergence rankingItems found independently by two or more stores rank first
- Auto-promotionThe memory-to-identity boundary: permanent · core · promoted · contextual tiers; promotion by convergence × significance × frequency, demotion when an item stops surfacing
- Retrieval-failure detectorFour checks (identity coverage · structured facts · character mentions · domain match) → a gap report with a coverage score and inject · augment · sufficient
- Reflection indexTF-IDF over reflections, consulted only during gap repair
- Selective injectionThree modes (API cached prefix · Pharos KV pack · plain); dynamic context is added only when the gap report calls for it
- Whole-session retrievalv10: BM25 and a dense encoder score every turn, the rankings are fused, and a 24k-token budget is filled with whole sessions in chronological order; no model calls; inputs held to an allow-list enforced in code
- Character profilesEvery fact about a person in one dense profile, placed ahead of retrieval
- SIRAVocabulary bridging: offline LLM enrichment, static synonym maps, online index-validated query expansion; 17 tests
- H-MEMDay → week → month temporal tree; Ebbinghaus decay score with reinforcement and contradiction collapse; SHORT · LONG · MIXED query scoping; 29 tests
- TGSBidirectional text ↔ graph verification; stdlib only; 10 tests; a HippoRAG bridge
- Cognitive recordingWorkspace-layer Jacobian-lens probe with one snapshot per retrieval
- Emotional geometryCircumplex valence and arousal measured and stored per memory
- ManifestEvery component labelled Implemented · External · Design-only, with test counts reproduced from a clean checkout
- LongMemEval_S96.2–96.8% on 400 pre-registered held-out questions (LongMemEval_S-cleaned, Sonnet-5 / Opus-5.5 judges); on all 500, 95.8–96.8%, the highest traced result, by one question
Cura: we talk first
Before you set Cura up, tell us three things.
- What’s your relationship to the elder?
- Briefly, what’s the situation?
- Is Cura adding to human contact, or replacing it?
We ask the third one because a companion that checks in is a good thing and a companion that becomes the only thing that checks in is not, and because “replacing it” is sometimes an honest answer from someone whose person is already gone. We’d rather hear that than not.
One thing to know before you write: Cura does not yet alert family in an emergency. Pressing 2 or saying “help” on a call is logged, and nothing is dialled.
No form, no account. Write to us: [email protected]
Comrade Code’s Hand is an open-hardware design for camera-assisted functional electrical stimulation (FES) of the hand. Surface EMG reads the intent to move, a classifier predicts the pose, a webcam measures the pose the hand actually makes, and the difference drives per-finger stimulation at 50 Hz. The draft study design has a single participant, the project lead, and an IRB-supervised pilot is planned.
Available now: the source code, printable models, a bill of materials of about $400, a safety protocol and a working simulation. Missing so far: hardware, a clinician, IRB approval, a licence file and any measured result.
Nothing here is available to buy, and this page will say so until that changes.
