Moltis Personal Agent Server
A self-hosted Rust server for persistent, multi-channel assistance with sandboxed tool execution on hardware you control.
Per-dimension scores and reasoning
Evidence shows sandboxed execution, secrecy::Secret, SSRF protection, hook gating, least privilege (unsafe_code deny), but user confirmation mechanism only mentions BeforeToolCall hooks can block calls, no explicit default confirmation flow; data flow transparency only describes architecture diagram, no specific data flow documentation; sensitive data handling has encrypted storage and zeroization, but full lifecycle not shown; dependency security has lock file, patches, and CI, but no vulnerability scanning evidence; external effects have sandbox and network filtering, but not all external interactions shown; rollback only has automatic checkpoints, no restore tool details; source attribution has signatures and attestations, but publisher unverified.
Self-consistency: README and Cargo.toml consistent, version 0.1.0 matches; dependency availability: lock file and CI, but no dependency availability tests; failure messages: no error handling examples.
Audience and scenarios: clearly targets personal agent server, supports multiple deployments; capability boundaries: tool registry and sandbox, but permission boundaries not explicit; trigger precision: hook events, but trigger conditions not detailed; environment fit: supports multiple platforms and deployment methods, but no configuration examples.
Information architecture: clear crate map and documentation links; install notes: multiple installation methods; naming stability: version 0.1.0, but no naming conventions; examples and FAQ: quickstart, but no FAQ; known limitations: not explicitly listed; license: MIT; versioning changelog: CHANGELOG guard, but no content; maintenance responsibility: contributing guide, but maintainers not explicit.
Output usability: Web UI and API, but output format not shown; marginal value: feature-rich, but no comparison with existing solutions; cost-benefit: single binary, but no performance data.
Claim traceability: README claims not all linked to code; cross-source corroboration: CI and tests, but not independently verified; fact-inference separation: not explicitly distinguished.
- Publisher identity unverified, be cautious about supply chain risks.
- User confirmation mechanism unclear, default may auto-execute tool calls, configure hooks.
- Data flow transparency insufficient, check docs or code for data flow.
- Dependency security lacks vulnerability scanning evidence, consider cargo audit.
- Rollback mechanism only mentions checkpoints, no restore tool details.
What does this agent do, and when should you use it?
Moltis is a local-first persistent personal-agent server written in Rust and shipped as one binary. Its Gateway Server exposes HTTP, WebSocket, and authentication entry points, while the Chat Service, Agent Runner, Tool Registry, and Provider Registry handle conversations and tool calls. It persists sessions as JSONL and stores memory in SQLite with hybrid vector and full-text retrieval for cross-session recall. Tool execution can be isolated per session with Docker or Apple Container, with a separate WASM tool path. It is intended to run on hardware you own, including a Mac Mini, Raspberry Pi, or server, and exposes a web UI, messaging channels, voice, and MCP connectivity.
Messages from the Web UI, Telegram, Signal, Microsoft Teams, Discord, Nostr, or an API enter through the Gateway Server over HTTP or WebSocket. The Chat Service invokes the Agent Runner to assemble prompts and stream calls through the Provider Registry; the Tool Registry then runs agent-requested tools, including commands in Docker or Apple Container sandboxes. Moltis stores JSONL session history and SQLite memory, supports scheduling, lifecycle hooks, checkpoints, and restore tooling, and connects MCP servers over stdio or HTTP/SSE. moltis acp serves Moltis to ACP clients over stdio, while Moltis can drive external ACP agents including codex-acp, claude-agent-acp, and Cursor.
- A self-hosting user who wants a continuing personal assistant on a Mac Mini, Raspberry Pi, or owned server can retain session state and resume conversations from web or messaging interfaces.
- A developer who needs an agent to run commands without executing them directly on the host can use per-session Docker or Apple Container isolation.
- A person or team already communicating through Telegram, Signal, Discord, Microsoft Teams, or Nostr can route those channels to one persistent agent service.
- A knowledge worker who needs to recover information from earlier conversations can use SQLite-backed full-text and vector memory across sessions.
- A developer with an ACP workflow can use
moltis acpas a stdio service or have Moltis drivecodex-acp,claude-agent-acp, and Cursor.
What are this agent's strengths and limitations?
- A single Rust binary supplies a persistent agent-server boundary without requiring Node.js, npm, or a runtime at deployment.
- Tool execution has Docker, Apple Container, and WASM paths, with per-session isolation documented for container execution.
- JSONL sessions, SQLite memory, hybrid vector/full-text search, and cross-session recall are built in rather than left to external assembly.
- It combines a Web UI, multiple messaging channels, voice, MCP, ACP, and multi-provider model support in one server.
- Documented safeguards include WebAuthn passkeys, API keys, an encrypted vault, SSRF protection, cross-origin WebSocket validation, and pre-tool-call hooks.
- Building from source explicitly requires
justand Node.js to build Tailwind CSS for the web UI, despite the single-binary runtime target. - Sandboxed command execution depends on Docker or Apple Container; the Docker deployment example also mounts the Docker socket.
- Unattended setup requires a password, provider selection, and
MOLTIS_API_KEY; the supplied material does not document model-provider accounts or pricing. - The feature set spans 59 Rust workspace crates; constrained devices require the
lightweightfeature configuration, which implies feature tradeoffs.
How do you install or deploy this agent?
On macOS or Linux, run curl -fsSL https://www.moltis.org/install.sh | sh; Homebrew installation is brew install moltis-org/tap/moltis. For Docker, pull ghcr.io/moltis-org/moltis:latest. Source builds require just and Node.js: clone the repository, run just build-css, then just build-release, and start with cargo run --release --bin moltis. For a release build with WASM sandbox tools, use just build-release-with-wasm.
How do you use this agent?
After startup, open https://moltis.localhost:3000. On first run, the terminal prints a setup code; enter it in the Web UI to set a password or register a passkey. For unattended first boot in Docker, set MOLTIS_PASSWORD, MOLTIS_PROVIDER, and MOLTIS_API_KEY, then open https://localhost:13131. On constrained hardware, use --no-default-features --features lightweight.
How does this agent compare with similar options?
The repository compares Moltis with OpenClaw and Hermes Agent. Moltis is positioned as a persistent personal-agent server with modular Rust crates and a single Rust-binary runtime, while OpenClaw is described as TypeScript with companion apps and Hermes Agent as Python with TypeScript TUI/web surfaces. The comparison also lists Moltis sandbox paths for Docker/Podman, Apple Container, and WASM, plus SQLite, FTS, and vector memory.
FAQ
Do keys leave the machine running Moltis?
secrecy::Secret, redaction of tool output, and zeroing on drop; handling by an underlying model provider is not described in the supplied material.Is Docker mandatory?
What limits risky tool actions?
BeforeToolCall hooks can inspect or block a tool invocation, and the project documents a destructive command guard, automatic checkpoints, and restore tooling. Those mechanisms provide controls, not a guarantee that every action is safe.Can it work with Codex or Claude Code workflows?
codex-acp and claude-agent-acp. moltis acp can also serve Moltis to ACP clients over stdio.