Fawx is a local-first agentic engine. It runs on your machine, calls LLMs for reasoning, and executes tasks through a structured loop with built-in safety controls. One binary. Your data stays local. The agent works for you.
1,800+ tests. 34 crates. WASM skill plugins. macOS and iOS apps.
# Build
git clone https://github.com/fawxai/fawx.git
cd fawx && cargo build --release
# Configure (interactive wizard)
./target/release/fawx setup
# Run
./target/release/fawx serveBring your own API key (Anthropic, OpenAI, or local models). Fawx never sends data anywhere except the LLM provider you choose.
Fawx runs an agentic loop: the agent reads your files, writes code, runs commands, searches memory, and calls external APIs. The kernel enforces safety boundaries so the agent operates within defined capabilities without per-action consent prompts.
You: "Find all TODO comments and summarize them"
Fawx: [search_text] Searching for TODO patterns...
[read_file] Reading context around matches...
[write_file] Writing summary to docs/todo-summary.md
Found 23 TODOs across 12 files. Summary written to docs/todo-summary.md.
Top areas: error handling (8), test coverage (6), documentation (5).
┌─────────────────────────────────────────────┐
│ Shells │
│ TUI · HTTP API · macOS/iOS · Telegram│
├─────────────────────────────────────────────┤
│ Agentic Loop │
│ perceive → plan → act → synthesize │
├──────────┬──────────────┬───────────────────┤
│ Kernel │ Tools │ Loadable │
│ (safety) │ (13 builtin) │ (WASM skills) │
│ │ │ │
│ cap gate │ file, shell │ web search, fetch │
│ tripwire │ memory, git │ weather, vision │
│ ripcord │ config, node │ tts, scheduler │
├──────────┴──────────────┴───────────────────┤
│ LLM Providers · Memory · Embeddings │
│ Claude · OpenAI · Local (llama.cpp) │
└─────────────────────────────────────────────┘
The kernel cannot be modified by the agent. It defines the boundaries:
- Capability Gate defines what the agent can and cannot do. Restricted actions get immediate structured denial. No modal prompts, no timeouts.
- Tripwire silently activates monitoring when the agent crosses soft boundaries within its capability space. The agent never knows.
- Ripcord atomically rolls back file and git operations from a tripwire point. Shell and API calls get audit-only treatment.
- Budget Control enforces token and iteration limits to prevent runaway loops.
WASM skills extend Fawx's capabilities. Each skill runs in a sandboxed WebAssembly environment with declared capabilities (network, storage). Skills are hot-reloadable and verified via Ed25519 signatures before loading.
- TUI for terminal users, with markdown rendering and streaming output
- HTTP API with SSE streaming for custom integrations
- macOS and iOS apps (native Swift)
- Telegram and webhook channels for remote access
| Category | Tools |
|---|---|
| Files | read_file, write_file, edit_file, list_directory, search_text |
| Shell | run_command, exec_background, exec_status |
| Memory | memory_write, memory_read, memory_list, memory_delete, memory_search |
| Git | git_status, git_diff, git_commit |
| Agent | spawn_agent, subagent_status, self_info, current_time |
Skills are Rust crates compiled to WebAssembly. The recommended local-dev workflow is fawx skill build <project>: it builds the project for wasm32-wasip1, installs it into ~/.fawx/skills/, and signs it when a signing key is present.
#[no_mangle]
pub extern "C" fn run() {
let input = get_input();
let response = http_request("GET", &url, "", "");
set_output(&result);
}# Recommended local-dev workflow
cargo generate fawxai/skill-template
cd my-skill
fawx skill build .Use the other paths when they match your input:
fawx skill build <project>is the canonical local-dev path for a custom skill project.skills/build.sh --installis the repo maintainer path for the built-inskills/collection.fawx skill install <path>is the artifact path for a prebuilt.wasmfile or skill directory.fawx keys generatecreates a local signing keypair and trusts the matching public key for local verification.fawx sign <skill>signs an already-installed skill when it still needs a signature.
If you generate or trust a key while the server is already running, restart it before expecting the loaded skill state to flip from invalid to valid.
# Prebuilt local artifact
cargo build --release --target wasm32-wasip1
fawx skill install ./target/wasm32-wasip1/release/my_skill.wasm
# Built-in repo skills collection
skills/build.sh --installAvailable skills: web search · web fetch · scheduler · weather · vision · TTS · STT · browser · canvas
| Provider | Auth | Streaming | Tool Use | Thinking |
|---|---|---|---|---|
| Anthropic Claude | API key, setup token | ✓ | ✓ | ✓ |
| OpenAI (GPT, Codex) | API key, OAuth PKCE | ✓ | ✓ | ✓ |
| Local (llama.cpp) | None | ✓ | ✓ | — |
Provider fallback with health tracking: if the primary provider fails, Fawx routes to the next healthy provider automatically.
Fawx takes a "boundaries, not checkpoints" approach. The kernel defines what the agent can do and enforces silently. No consent prompts by default.
Capability Gate: Tools operate within declared capability spaces. Restricted actions get immediate structured denial.
Credential Store: AES-256-GCM encryption at rest, per-operation unlock. Credentials are never held in memory longer than needed.
WASM Sandboxing: Skills run in isolated environments. Only declared capabilities are granted. The host API is the sole interface.
Tripwire and Ripcord: Invisible monitoring at soft boundaries, with atomic rollback for reversible operations. The agent operates naturally while the kernel watches.
All configuration lives in ~/.fawx/config.toml:
[llm]
default_provider = "anthropic"
[llm.anthropic]
model = "claude-sonnet-4-20250514"
[server]
host = "127.0.0.1"
port = 8400
[memory]
enabled = true
embeddings_enabled = true
[permissions]
mode = "capability" # or "prompt" for per-action approval
preset = "standard" # open, standard, restrictedRun fawx setup for an interactive configuration wizard.
# Run all tests
cargo test --workspace
# Lint (zero warnings enforced)
cargo clippy --workspace --tests -- -D warnings
# Format
cargo fmt --allSee CONTRIBUTING.md for the full development guide.
fawx/
├── engine/crates/ # Rust crates
│ ├── fx-kernel/ # Loop, capability gate, tripwire, ripcord
│ ├── fx-llm/ # Anthropic, OpenAI, local providers
│ ├── fx-tools/ # Built-in tool implementations
│ ├── fx-loadable/ # WASM skill runtime, hot-reload, signatures
│ ├── fx-memory/ # Key-value store with decay + embeddings
│ ├── fx-auth/ # Credential store, OAuth, setup wizard
│ ├── fx-session/ # Multi-session management
│ ├── fx-journal/ # Reflective memory
│ ├── fx-telemetry/ # Opt-in telemetry with consent persistence
│ ├── fx-api/ # HTTP API, SSE streaming, handlers
│ ├── fx-cli/ # Engine binary, headless mode
│ └── ... # 20+ more crates
├── app/ # macOS and iOS native app (Swift)
├── docs/ # Architecture, specs, design decisions
└── scripts/ # Build and deployment
See docs/roadmap.html for the full roadmap. Current priorities:
- Open source launch with skill marketplace
- Attachments for images, files, and PDFs in the GUI
- OS-level enforcement via Landlock, seccomp, network namespaces
- Signal flywheel for earned autonomy through behavioral telemetry
Business Source License 1.1. Self-hosting for personal and internal business use is always permitted. The license converts to Apache 2.0 on 2030-03-23.
Skills in the fawxai organization are Apache 2.0.