Hi HN — maker here. I built Talos because I wanted to hand an agent a terminal without handing it my trust model. Every tool call (read, write, exec, delegate) passes a small deterministic kernel, ~645 lines of Python, that returns allow, needs-human or deny. Unattended runs can't ask, so needs-human becomes deny. The agent can never grant itself anything.

Around that kernel: 23 gated tools, a UID-separated worker for delegated code, MCP servers confined to that worker from an operator-owned registry (no marketplace, no third-party code in the agent process), a hash-chained audit log, Ed25519-signed updates verified before anything unpacks, and a read-only live dashboard that has no approve button, by design.

Numbers the CI enforces on every page of the site: 2063 tests, 179/179 adversarial cases, 645 kernel lines, 0 inbound ports. The site has a browser reimplementation of the policy kernel you can poke at without installing anything, a replayed real session, and an honest comparison to OpenClaw and Hermes — including what Talos doesn't have (breadth; that's doctrine, not backlog).

Happy to answer anything — especially the parts where the design is wrong.

Site: https://talos-agent.ch — Source (MIT): https://github.com/talos-kernel/talos

Trademark C&D in 3, 2, 1...

The world badly needs more options for running agents securely. I applaud you for making an attempt. But this landing page does nothing to win my trust. The copy is full of LLM-style language that is at best off-putting and at worst impenetrable. Even your comment in this thread looks like it was written by an LLM. If you don't care enough even to describe the thing yourself, why should we trust that you care enough to make the thing work well?

I run my agents on talos... But not this talos