Talos is a self-hosted agent whose deterministic kernel approves or denies every tool call before it runs, with single-use tokens bound to exact arguments.
Yes, Talos is open source under the MIT license.
Talos is free to use.
Yes, Talos can be self-hosted (the source is available under the MIT license).
MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel. Before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for thirty seconds. The stated principle is that the model proposes and never decides, so the LLM cannot execute an effect the kernel has not authorized. It runs locally on your own Claude or Hermes key, with no paid service dependency.
This is the agent-security theme this registry keeps returning to, taken down to the mechanism. Most guardrails live in a prompt the model can be talked out of; Talos moves the decision into a deterministic kernel the model cannot bypass, and binds each approval to exact arguments for thirty seconds so a stolen or replayed yes is useless. For a GTM or RevOps team letting an agent touch the CRM, the sending domain or billing, that is the difference between hoping it behaves and being able to deny the call it should never make. Read it plainly: it is a young repo with real code but little adoption, the policy is yours to write, and it covers a terminal-and-Telegram agent rather than your whole stack. As a blueprint for how tool-gating should work, it is worth the pilot.