New Full OpenClaw import — switch in one click

A secure persistent personal agent server

One binary — sandboxed, built in Rust, yours to own.

Not a chatbot wrapper. Not a cloud service tied to one provider. A real agent server that runs on your hardware, remembers across sessions, and reaches you through every channel you use.

Get Started Documentation

Onboarding — secure your instance with passkey or password

Onboarding — setup summary with identity, LLM and channel config

Voice settings — speech-to-text and text-to-speech providers

Sandboxed shell execution in Docker container

Telegram bot channel with voice and events

Web UI showing Telegram channel messages

Up and running in 60 seconds

Three steps. No dependencies.

Install

$ curl -fsSL moltis.org/install.sh | sh

Configure

Open localhost:13131, paste your provider key, pick a model. OAuth providers like GitHub Copilot work with zero config.

Chat from anywhere

Web UI

Discord

Slack

Matrix

Nostr

Teams

Secure by design

Your keys and private data never leave your machine. Sandboxed by default — your AI can't touch your filesystem unless you say so.

Your hardware

Runs on a Mac Mini, a Raspberry Pi, or any server you own. Always on, always local — like a house elf for your digital life.

macOS

Linux

Windows

Full-featured

Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams, voice, memory, scheduling, tools — all built-in. No plugin marketplace to get supply-chain attacked through.

What your agent actually does

Not a demo. These run today.

Schedules tasks

Recurring cron jobs in natural language

Runs code safely

Sandboxed shell in Docker or Apple Containers

Browses the web

Fetches, summarizes, and SSRF-protected

Manages your calendar

CalDAV integration for events and reminders

Messages everywhere

Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams

Remembers context

Persistent memory with vector + full-text search

Talks and listens

Voice input and output with cloud and local providers

Extends itself

Creates its own skills, hooks, and MCP tools at runtime

Moltis worked in 1 command. I found several AI guardrails missing or turned off in OpenClaw which are working out of the box here. Moltis is way more performant and stable.

Noita on Discord #1 #2

I've found the project incredibly useful. In fact I do my Moltis contributions in Moltis.

Cstewart-HC on GitHub discussion

Works with your stack

20+ providers, local models, and every major channel — all built in.

Cloud Providers

Anthropic

OpenAI

Google Gemini

Mistral

DeepSeek

Fireworks

Cerebras

MiniMax

Moonshot

Z.AI

Venice

NEAR AI Cloud

Local & Bring Your Own

Ollama

LM Studio Local GGUF CPU/GPU

MLX Apple Silicon

Hugging Face

OpenRouter

Any OpenAI-compatible

OAuth — Zero Config

GitHub Copilot

OpenAI Codex

Kimi Code

Channels

Web UI

Discord

Slack

Matrix

Nostr

Microsoft Teams

iOS Soon

GraphQL API

JSON-RPC

Get Started

Install Moltis and start your AI assistant in minutes

~ quickstart

$ curl -fsSL https://www.moltis.org/install.sh | sh

Supported Platforms

Pre-built releases

macOS

Apple Silicon & Intel

Linux

x86_64 & ARM64

Windows

x86_64

Install with one command, or pick a release artifact for your platform from GitHub Releases.

Try it in the cloud

Ready in under a minute

Cloud is a great way to try Moltis. For the full experience, run it on your Mac, a VM, or any dedicated host.

Deploy on DigitalOcean

Fly.io

Need setup details? See Cloud Deploy docs.

Features

Everything you need in one binary

Single Binary

One self-contained binary. No runtime dependencies, just download and run.

Local LLMs

Run your own models locally. Automatic download and setup included.

Authentication

HTTPS by default. Password, token, and passkeys access.

Sandboxed Browsing

Run browser sessions in isolated Docker containers for safer automation.

SSRF Protected

Blocks loopback, private, and link-local IPs from LLM fetch.

Streaming-first

First token appears instantly. Smooth replies, even during long runs.

Skills, Hooks & MCP

Plugins, hooks, MCP tool servers with OAuth 2.1. Stdio or HTTP/SSE, auto-restart.

FS or Sandbox

Full filesystem or per-session Docker, Podman, Apple Container, or WASM isolation.

Long-term Memory

Hybrid vector + full-text search. Your agent remembers context.

Pi-Inspired Self-Extension

Pi-inspired self-extension: creates its own skills at runtime. Session branching, hot-reload.

Multi-Channel

Web UI, Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams, or API. One agent, every frontend.

Voice

Talk to your assistant with multiple cloud and local TTS/STT providers.

OpenClaw Import

New

Full read-only import of your OpenClaw workspace — conversations, skills, and settings. Switch in one click.

Multi-Agent Personas

Create multiple agent personas with distinct personalities and capabilities. Full CRUD management UI.

Encryption Vault

Encryption-at-rest vault for API keys and secrets. Your credentials are encrypted on disk, not just in memory.

iOS Companion

Soon

Native iOS app with push notifications via APNS relay. Coming soon to the App Store.

GraphQL API

Full GraphQL API exposing all RPC methods. Build your own integrations and frontends.

Internationalization

Full i18n support. Eleven locales are built in today.

Webhooks

New

Run AI agents on GitHub PRs, Stripe payments, or any webhook. Review code, triage issues, handle payments — automatically.

And much more...

Security

✓ Passkeys (WebAuthn)
✓ Scoped API keys
✓ Encryption-at-rest vault
✓ Secrets zeroed on drop
✓ Human-in-the-loop approval
✓ Origin validation (CSWSH)
✓ No unsafe code

LLM Providers

✓ Anthropic, OpenAI, Gemini
✓ DeepSeek, Mistral, Groq, xAI
✓ OpenRouter, Ollama, Local LLM
✓ Custom OpenAI-compatible endpoints
✓ Provider fallback chains
✓ Per-provider metrics

Memory

✓ Hybrid search (vector + FTS)
✓ Local embeddings (GGUF)
✓ OpenAI batch API (50% off)
✓ Embedding cache
✓ File watching / live sync
✓ Session export

Extensibility

✓ MCP server support
✓ GraphQL API
✓ CalDAV calendar integration
✓ Hook system (lifecycle)
✓ Cron job scheduling
✓ Webhook triggers
✓ i18n (11 locales)
✓ OpenClaw import
✓ TOML configuration

Observability

✓ Prometheus metrics
✓ OpenTelemetry tracing
✓ Structured logging
✓ Per-provider charts
✓ SQLite persistence
✓ Real-time WebSocket

Security-first design

An AI assistant you can trust on your machine

Why should you trust it?

Moltis is one file. You download it, you run it, done. There's no plugin store, no package manager, no runtime that could be compromised. The entire application is a single binary you can verify.

Your AI runs in a sandbox by default. It can't read your files, run commands, or browse the web unless you explicitly allow it. Every tool action can require your approval — or you can pre-approve specific ones you trust.

Your passwords and API keys are wrapped so they can never be accidentally logged, and the memory is zeroed the moment they're no longer needed. The language it's built in (Rust) makes entire classes of security bugs impossible at the compiler level.

What you won't find here

No plugin marketplace to get compromised. No JavaScript runtime. No dependency tree of 1,200 packages you can't review. One binary you can audit end to end.

How we protect you

What if...	How Moltis handles it
Someone finds your instance	Password or passkey required from first launch, automatic HTTPS, rate limiting
AI tries to run dangerous code	Everything runs in a sandbox (Docker or Apple Container). Each action needs your approval first
A dependency gets compromised	There are no npm/pip packages to compromise. One binary, auditable dependencies. Integrations like Telegram are built-in, tested code
AI accesses your internal network	Internal and private network addresses are automatically blocked
Someone tries to steal your keys	API keys and passwords are hidden from logs and zeroed in memory after use
Session gets hijacked	Origin checking prevents cross-site attacks, HTTPS enabled by default
Unauthorized access	Passkeys, scoped API keys, per-tool permission policies

Sandboxed execution

Docker & Podman

Each conversation gets its own isolated container. Shell commands and web browsing happen inside the sandbox, not on your real system.

Apple Containers

On Mac, uses Apple's built-in virtualization for lightweight isolation — no Docker needed.

WASM sandbox

Wasmtime-based sandbox with generic failover. Lightweight isolation without containers.

Fully open source

small

isolated unsafe surface*

npm dependencies

Rust workspace crates

~270K

lines of Rust

470+

Rust files with tests

MIT

license

*Unsafe code is isolated to Swift FFI, local model wrappers, and precompiled WASM/runtime boundaries. The core agent and gateway paths stay in safe Rust.

How Moltis compares

Open-source AI assistants you can self-host

At a glance

	OpenClaw	Hermes Agent	Moltis
Language	TypeScript + native apps	Python + TypeScript UI	Rust
Runtime	Node.js + npm/pnpm/bun	Python + uv/pip	Single binary
Main shape	Gateway + apps + nodes	CLI + gateway + research tools	Persistent agent server
Sandbox	App-level permissions	Local, Docker, SSH, cloud backends	Docker/Podman + Apple + WASM
Auth	Pairing + gateway controls	CLI + gateway setup	Password + Passkey + API keys
Voice	Voice wake + talk modes	Voice memo transcription	Built-in (15+ providers)
MCP	Plugin/integration support	MCP integration	Yes (stdio + HTTP/SSE)
Memory / RAG	Plugin + context engine	Memory + session search + user model	SQLite + FTS + vector
Hooks	Plugin/runtime hooks	Hooks/plugins	15 event types
Channels	Broad channel and device list	Telegram, Discord, Slack, WhatsApp, Signal, CLI	Web, Telegram, WhatsApp, Discord, Slack, Matrix, Nostr, Teams
API	Gateway APIs	CLI/gateway APIs	JSON-RPC + GraphQL
OpenClaw import	—	Migration command	Full (read-only, safe)

Security comparison

	OpenClaw	Hermes Agent	Moltis
Code sandbox	App-level permissions and tool controls	Local, container, SSH, and cloud backends	Docker/Podman + Apple + WASM
Secret handling	Config, env, and plugin paths	Config and provider credentials	Encrypted vault, redacted, zeroed
SSRF protection	Tool/plugin dependent	Tool/backend dependent	Blocks loopback/private/CGNAT
WebSocket origin	Gateway dependent	Gateway dependent	Cross-origin rejection
Hook gating	Plugin/runtime hooks	Hooks/plugins	Inspect / modify / block
Rate limiting	Gateway dependent	Gateway dependent	Per-IP throttle + login limits

Codebase snapshot

	OpenClaw	Hermes Agent	Moltis
Local source size*	~1.1M app LoC	~152K app LoC	~270K Rust LoC
Package shape	npm packages, extensions, apps	Python package, plugins, tools, UI packages	59 Rust workspace crates
Primary install	npm install -g openclaw	install script, then hermes	Install script, Homebrew, Docker, Cargo
Test surface signal	Large TS/app test tree	Python and TUI tests	470+ Rust files with tests

*Measured with tokei from local checkouts, excluding dependency folders and generated build output. LoC is a scale and auditability signal, not a ranking.

Based on local checkout snapshots and public project information. Projects evolve quickly — check each repo for the latest. Full comparison in the docs.

A secure persistent personal agent server

Up and running in 60 seconds

Install

Configure

Chat from anywhere

Secure by design

Your hardware

Full-featured

What your agent actually does

Works with your stack

Get Started

Supported Platforms

macOS

Linux

Windows

Try it in the cloud

Features

And much more...

Security

LLM Providers

Memory

Extensibility

Channels

Observability

Security-first design

Why should you trust it?

How we protect you

Sandboxed execution

Docker & Podman

Apple Containers

WASM sandbox

Fully open source

How Moltis compares

At a glance

Security comparison

Codebase snapshot

What users are saying