Nell (Open Source Instinct)

Open Source Instinct — a personal AI agent you text to get things done.

Book the table. Buy the tickets. Cancel the subscription. Watch for the drop.
Nell works across your messages, your browser, and your accounts — and asks
before it does anything it can't take back.

Source-available · self-hostable · your keys, your data · it asks first.

What Nell is

Text Nell like you'd text a sharp, reliable friend who gets things done:

You: book me a sushi place Friday for 4
Nell: Found 3 near you. Booking Nozomi, 8pm, party of 4 — that's on your
saved Amex, no cancellation fee. Confirm?
You: yes
Nell: Done ✅ — confirmation #NZ-4471, added to your calendar.

Under the hood Nell drives a real browser, remembers what you like, runs
background monitors ("tell me when a Nobu table opens"), and reaches you on
whatever channel you use — with a permission layer in front of anything that
spends money, sends a message, or touches a credential.

See it work

Booking a cinema ticket

One message. Nell finds the cinema, opens the film, picks the seats — and stops
where the money starts.

Planning a holiday

Four questions in one sentence — flights, stay, places, activities. It answers
each rather than finding one page that mentions the subject.

Why Nell instead of a closed assistant

Closed personal agents ask you to hand over your passwords, your inbox, and your
card, then act silently and hope you trust them. Nell inverts that:

Your keys, your data. Secrets are encrypted before they touch the database
and are never exposed to the model — you can read the code and verify it.
It asks first. Purchases, message sends, and credential use are gated by
explicit approval, enforced in code — not by a prompt you hope the model obeys.
Untrusted content can't act. Email and web pages can't quietly instruct the
agent into doing something you didn't ask for.
Honest deletion. Disconnect an account and its data is actually deleted,
with a receipt.
Self-hostable. Run the whole thing yourself with one command.

Quick start (self-host)

git clone <your-fork-or-this-repo> nell
cd nell
cp .env.example .env   # fill in DATABASE_URL and SECRET_ENCRYPTION_KEY
docker compose up

One Postgres, one command, a working personal agent. See
docs/ for the architecture and self-host guide.

Licensing — read this

Nell is source-available (Fair Source), not "open source" in the OSI sense —
and we'd rather be upfront about exactly what that means:

✅ Free forever to self-host for yourself or your company, at any scale.
✅ Fork it, modify it, contribute — the whole trust core is readable and
auditable; nothing security-relevant is hidden.
✅ Every version becomes Apache-2.0 open source two years after its release.
❌ The one thing you can't do: take Nell and offer it as a hosted service
that competes with ours, without a commercial license.

The core is licensed under the Functional Source License (FSL-1.1-Apache-2.0)
— see LICENSE. The commercial hosting features live under
ee/ with their own license and require a subscription to
run in production; the personal/self-host agent needs none of them.

More detail and a full FAQ:
docs/adr/0002-licensing-open-core.md.

Status

It runs. You can text it, and it does the thing — the video above is a real
task on a real browser, driven by a real model, with the results in a real
Postgres. Self-hosting it needs a Telegram bot token, a model key and a
Postgres, and nothing else. It remembers the conversation, signs in to sites
with credentials you have saved, and writes down what it did.

What that sentence does not cover, and it is a lot: this is one agent working
one task at a time on one machine. There is no hosted service, no coordinator
splitting work across tasks, no cloud browser, and every vendor beyond the
model and search is still an unbound port. The list below is honest about which
side of that line each piece falls on.

1,318 tests · 51 adversarial attacks run on every commit · CI green.

Built and tested

Area	What exists
Vault	Logins, addresses, cards and phones. AES-256-GCM, per-item AAD binding, key rotation, CVC never stored
Adding a password	A one-time link to a page served on loopback — the secret never passes through the chat, or any third party at all
Signing in	A login is bound to the site it was saved for, taken from the live URL — so a page that merely looks right gets nothing
Policy chokepoint	One executor both perception modes pass through — a pixel click meets the same gates as a targeted one
Spend	A click that commits money is refused at the chokepoint until you say yes — pixel clicks included
Approvals	Bound to what you were shown: single-use, and consent for £18.50 is not consent for £95.00
Virtual cards	Single-use card per purchase, capped at the approved total — a limit the card network enforces, not our code
Untrusted content	Provenance gate + quarantined readers; a turn whose only new context is email or web text cannot act
2FA	Vaulted TOTP (verified against RFC 6238 vectors) and per-use scoped code reads that return digits and nothing else
Credentials on a page	Taint machine blocks field reads, clipboard, uploads and downloads; captures are masked before the PNG is encoded
Audit	Append-only hash chain, verified on every render rather than behind a button
Deletion	Derived data is rebuildable, so deleting a source provably removes every copy — with a receipt
The computer	One machine per user, profile kept on disk — logins survive a restart, so the vault is rarely touched at all
Computer use	Full pointer/keyboard surface mirroring the Anthropic and OpenAI tool schemas, plus an accessibility-tree fast path
Handoff	A short-lived, single-use link that hands you the controls for a CAPTCHA or 3DS — and stops the agent while you drive
Memory	The conversation, preferences, standing rules, a task ledger and free-form notes — read and edited as `USER.md`, `MEMORY.md`, `TASKS.md`
Remembering a chat	Everything the model can hold — 152k tokens on a 200k model — folded into a summary you can read only when it cannot
Channels	Telegram, WhatsApp (24-hour service window), iMessage (STOP/START/HELP, per-task groups)
Models	Bring your own: Anthropic, OpenAI, Google, xAI, DeepSeek, GLM, Kimi, Mistral, OpenRouter, or your own hardware
Dashboard	Tasks, approvals, machine, vault, memory, audit, model settings
Tenant isolation	Row-level security forced on every table with a `workspace_id` — the migration asks the database, so a new table cannot be missed
Two senses	Accessibility tree for speed; when it stops learning anything the agent switches to looking at the screen
Search	Bound to a live vendor — search engines captcha a headless browser, so searching is not something to do in one
Knowing you	Asks once where you are, then never again; share a pin on Telegram and it takes that
Recurring work	"Every morning at 6, scan the AI news" — leased, deduped, and it stays quiet when nothing changed
Bounds	A task runs while it is getting somewhere and stops when it is not; going round in circles counts as standing still
A task	Spans the conversation it takes — answer the question it asked and it carries on rather than starting something new

Some of the above is tested but not yet reachable from a chat message:
virtual cards, the handoff link, the desktop companion, the dashboard, and the
durable runtime. They are listed because the boundaries are real and covered,
not because you can use them today.

That distinction — built and tested versus reachable — is the one worth keeping
an eye on here, because three things left the second list recently and each left
for the same reason.

The spend gate had been built since Phase 0 and nothing in the agent ever
called it. What actually stopped a live booking at the payment page was the
model saying it should stop. That is obedience, and this project's whole claim is
that it does not rely on obedience.

The vault was three test files of correct cryptography that had never stored
a secret: the executor's secret port had no implementation, and the model was
never told an item existed, so the fill action could only name an id nobody
could produce.

The audit log had a verified hash chain and an append-only table, and the
executor called record(...) at every consequential step — into undefined,
because nothing had ever passed it a sink.

All three now run. The pattern is worth naming rather than hiding: a
well-tested half with no edge to the other half looks exactly like a finished
feature, right up until someone uses it.

Not built yet

Voice calls · Calendar, Slack, Notion, Linear, GitHub and MCP connectors · email
write operations · cloud-browser vendor adapter · the desktop companion · hosted
billing · a coordinator that runs more than one task at a time.

Durable execution belongs on this list rather than the one above, and it is
the largest gap. DBOS passed a crash-resume spike against real Postgres in Phase
0 — killed mid-workflow, resumed from its checkpoint, side-effecting step ran
exactly once — and nothing at runtime has imported it since. So today, killing
the process mid-task loses the task.

The security foundation is deliberately built first: every boundary that protects
your money and your credentials is enforced in code and covered by tests before
any capability is layered on top.

The adversarial suite is worth a look if you are evaluating the trust story —
packages/evals/src/attacks.ts runs 51 real
attacks against the real gates on every commit, and each one records the incident
or hazard it guards against. Run it with pnpm attacks.

See docs/security-model.md for how the boundaries
work and docs/roadmap.md for what lands when.

Contributions welcome — see CONTRIBUTING.md.

Security

Found a vulnerability? Please follow SECURITY.md — do not open a
public issue.