{
  "$schema_doc": "https://gtmstacker.com/registry/schema/entry.schema.json",
  "stability": "emerging",
  "generator": "agentic-media-registry",
  "generated_at": "2026-09-18T00:00:00Z",
  "id": "com.gtmstacker.registry/tool/talos",
  "type": "tool",
  "slug": "talos",
  "canonical_url": "https://gtmstacker.com/registry/tool/talos/",
  "title": "Talos",
  "description": "MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel: before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for 30 seconds. The design principle is 'the model proposes, it never decides', so the LLM cannot execute an effect the kernel has not authorized. Runs locally on your own Claude or Hermes key, with no paid service dependency.",
  "category": "mcp-agents",
  "tags": [
    "mcp-agents",
    "agent-security",
    "governance",
    "self-hostable",
    "tool-gating"
  ],
  "status": "active",
  "revision": 1,
  "content_hash": "14c4a721cdf872c95e2801ea488440718caf3ac067db8c4714926747d8604c69",
  "date_published": "2026-09-18T00:00:00Z",
  "date_modified": "2026-09-18T00:00:00Z",
  "source": {
    "name": "github · talos-kernel/Talos",
    "url": "https://github.com/talos-kernel/Talos"
  },
  "license": "MIT",
  "one_liner": "Talos is a self-hosted agent whose deterministic kernel approves or denies every tool call before it runs, with single-use tokens bound to exact arguments.",
  "open_source": "yes",
  "self_hostable": "yes",
  "pricing_model": "free",
  "who_its_for": "Anyone who wants an agent that can act but not act freely: the kernel forces every effect through an allow / needs-human / deny decision, so a prompt-injected or confused model cannot run a tool call you never authorized.",
  "aliases": [
    "talos",
    "Talos kernel"
  ],
  "alternatives": [
    "bumblebee"
  ],
  "secondary_categories": [
    "ai-infrastructure",
    "productivity-knowledge"
  ],
  "last_verified": "2026-09-18",
  "evidence": {
    "claim_type": "mixed",
    "source_id": "https://github.com/talos-kernel/Talos",
    "note": "MIT, Python, ~10 stars but ~113 commits, the PolicyKernel allow/needs-human/deny model, single-use argument-bound 30-second tokens, and local BYO-key (Claude/Hermes) operation confirmed on the repo (WebFetch 2026-09-18, talos-kernel org). Low star count for the amount of code; the security model is the maker's design, so pressure-test the kernel against your own threat model before relying on it."
  },
  "caveats": "Very young by stars (~10) despite real code (~113 commits). The kernel gates calls, but the policy is only as good as the rules you set, and the surface today is terminal plus Telegram, not a broad harness. This is a design worth studying and piloting, not yet a battle-tested dependency.",
  "lead": "MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel. Before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for thirty seconds. The stated principle is that the model…",
  "chunks": [
    {
      "index": 0,
      "heading_path": [],
      "est_tokens": 127,
      "text": "MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel. Before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for thirty seconds. The stated principle is that the model proposes and never decides, so the LLM cannot execute an effect the kernel has not authorized. It runs locally on your own Claude or Hermes key, with no paid service dependency."
    },
    {
      "index": 1,
      "heading_path": [
        null,
        "Provenance"
      ],
      "est_tokens": 181,
      "text": "single-use token bound to the exact arguments and valid for thirty seconds. The stated principle is that the model proposes and never decides, so the LLM cannot execute an effect the kernel has not authorized. It runs locally on your own Claude or Hermes key, with no paid service dependency.\n\n- MIT, Python, ~10 stars, ~113 commits, and the allow/needs-human/deny kernel with single-use argument-bound tokens independently WebFetch-verified on the repo 2026-09-18 (github.com/talos-kernel/Talos).\n- Surfaced via the 2026-09-18 daily pull (Show-HN-style post: \"a personal agent whose kernel gates every tool call\").\n- Curated from the GTM Stacker signal registry (2026-09-18 pass); license independently verified 2026-09-18."
    },
    {
      "index": 2,
      "heading_path": [
        null,
        "Why it matters for a GTM stack"
      ],
      "est_tokens": 298,
      "text": "stars, ~113 commits, and the allow/needs-human/deny kernel with single-use argument-bound tokens independently WebFetch-verified on the repo 2026-09-18 (github.com/talos-kernel/Talos). - Surfaced via the 2026-09-18 daily pull (Show-HN-style post: \"a personal agent whose kernel gates every tool call\"). - Curated from the GTM Stacker signal registry (2026-09-18 pass); license independently verified 2026-09-18.\n\nThis is the agent-security theme this registry keeps returning to, taken down to the mechanism. Most guardrails live in a prompt the model can be talked out of; Talos moves the decision into a deterministic kernel the model cannot bypass, and binds each approval to exact arguments for thirty seconds so a stolen or replayed yes is useless. For a GTM or RevOps team letting an agent touch the CRM, the sending domain or billing, that is the difference between hoping it behaves and being able to deny the call it should never make. Read it plainly: it is a young repo with real code but little adoption, the policy is yours to write, and it covers a terminal-and-Telegram agent rather than your whole stack. As a blueprint for how tool-gating should work, it is worth the pilot."
    }
  ],
  "alternates": {
    "markdown": "https://gtmstacker.com/registry/tool/talos/index.md",
    "html": "https://gtmstacker.com/registry/tool/talos/",
    "json": "https://gtmstacker.com/registry/tool/talos/index.json",
    "server_json": "https://gtmstacker.com/registry/tool/talos/server.json"
  },
  "jsonld": {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "WebSite",
        "@id": "https://gtmstacker.com/#website",
        "url": "https://gtmstacker.com/",
        "name": "GTM Stacker Agent Registry",
        "description": "A daily-updated, agent-native registry of open-source tool discoveries, tool updates, and curated news for the go-to-market / RevOps engineering niche. Machine-readable first: agents can discover, parse, page, and delta-sync it without scraping HTML.",
        "inLanguage": "en",
        "publisher": {
          "@id": "https://gtmstacker.com/#organization"
        }
      },
      {
        "@type": "Organization",
        "@id": "https://gtmstacker.com/#organization",
        "name": "GTM Stacker",
        "url": "https://gtmstacker.com",
        "description": "The growth-systems practice of Theo Popov: AI-native enrichment, outbound, content engines and internal tooling for startups and venture programs. Its agent-native media property, the GTM Stacker Agent Registry, maintains a daily-updated catalog of open-source go-to-market and RevOps tools that both people and AI engines can discover, compare, and cite.",
        "foundingDate": "2024-08",
        "knowsAbout": [
          "go-to-market engineering",
          "RevOps",
          "sales automation",
          "marketing operations",
          "open-source software",
          "AI agents"
        ],
        "founder": {
          "@type": "Person",
          "@id": "https://gtmstacker.com/#founder",
          "name": "Theo Popov",
          "jobTitle": "Growth Operations & GTM Systems",
          "url": "https://gtmstacker.com/about/",
          "sameAs": [
            "https://www.linkedin.com/in/theo-popov",
            "https://x.com/Theo_Popov",
            "https://github.com/theopopov"
          ],
          "worksFor": {
            "@id": "https://gtmstacker.com/#organization"
          }
        },
        "sameAs": [
          "https://www.linkedin.com/company/gtmstacker",
          "https://www.youtube.com/@gtmstacker",
          "https://www.instagram.com/gtmstacker/",
          "https://www.tiktok.com/@gtmstacker"
        ],
        "mainEntityOfPage": "https://gtmstacker.com/registry/about/"
      },
      {
        "@type": "SoftwareApplication",
        "@id": "https://gtmstacker.com/registry/tool/talos/#software",
        "name": "Talos",
        "identifier": "io.github.talos-kernel/Talos",
        "description": "MIT self-hosted agent for the terminal and Telegram (Python) built around a deterministic security kernel: before any tool call runs, PolicyKernel.decide() returns ALLOW, NEEDS_HUMAN or DENY, and an approval is a single-use token bound to the exact arguments and valid for 30 seconds. The design principle is 'the model proposes, it never decides', so the LLM cannot execute an effect the kernel has not authorized. Runs locally on your own Claude or Hermes key, with no paid service dependency.",
        "applicationCategory": "DeveloperApplication",
        "url": "https://gtmstacker.com/registry/tool/talos/",
        "datePublished": "2026-09-18T00:00:00Z",
        "dateModified": "2026-09-18T00:00:00Z",
        "isPartOf": {
          "@id": "https://gtmstacker.com/#website"
        },
        "license": "https://spdx.org/licenses/MIT.html",
        "codeRepository": "https://github.com/talos-kernel/Talos",
        "keywords": "mcp-agents, ai-infrastructure, productivity-knowledge, agent-security, governance, self-hostable, tool-gating",
        "author": {
          "@type": "Organization",
          "name": "talos-kernel",
          "url": "https://github.com/talos-kernel",
          "sameAs": [
            "https://github.com/talos-kernel/Talos"
          ]
        },
        "offers": {
          "@type": "Offer",
          "price": 0,
          "priceCurrency": "USD"
        },
        "isSimilarTo": [
          {
            "@type": "SoftwareApplication",
            "name": "Bumblebee",
            "url": "https://gtmstacker.com/registry/tool/bumblebee/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          }
        ]
      },
      {
        "@type": "BreadcrumbList",
        "@id": "https://gtmstacker.com/registry/tool/talos/#breadcrumb",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "GTM Stacker Registry",
            "item": "https://gtmstacker.com/registry/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "MCP Agents",
            "item": "https://gtmstacker.com/registry/category/mcp-agents/"
          },
          {
            "@type": "ListItem",
            "position": 3,
            "name": "Talos",
            "item": "https://gtmstacker.com/registry/tool/talos/"
          }
        ]
      }
    ]
  },
  "tool": {
    "name": "io.github.talos-kernel/Talos",
    "repository": {
      "url": "https://github.com/talos-kernel/Talos",
      "source": "github"
    }
  }
}