Kyro

<p align="center"> <img src="logo.svg" alt="Kyro Logo" width="128" height="128" /> </p> <h1 align="center">Kyro</h1> <p align="center"> <strong>Local-First Autonomous Desktop AI Agent</strong><br /> Built with Tauri v2, Rust & React 19. </p> <p align="center"> </p> <p align="center"> <a href="https://launchbuff.com/products/kyro-npnc71" target="_blank" rel="noopener noreferrer" title="Featured on LaunchBuff"><img src="https://launchbuff.com/badge-featured-dark.svg" alt="Featured on LaunchBuff" width="256" height="80" /></a> </p> <p align="center"> <a href="https://github.com/eshanized/Kyro/actions/workflows/ci.yml"><img src="https://github.com/eshanized/Kyro/actions/workflows/ci.yml/badge.svg" alt="Continuous Integration" /></a> <a href="https://github.com/eshanized/Kyro/discussions"><img src="https://img.shields.io/badge/Discussions-Join-purple?logo=github&logoColor=white" alt="GitHub Discussions" /></a> <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT" /></a> <a href="https://tauri.app"><img src="https://img.shields.io/badge/Tauri-v2-24C8D8?logo=tauri&logoColor=white" alt="Tauri v2" /></a> <a href="https://www.rust-lang.org/"><img src="https://img.shields.io/badge/Rust-1.75+-DEA584?logo=rust&logoColor=white" alt="Rust 1.75+" /></a> <a href="https://react.dev"><img src="https://img.shields.io/badge/React-19-61DAFB?logo=react&logoColor=black" alt="React 19" /></a> <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-5.7-3178C6?logo=typescript&logoColor=white" alt="TypeScript 5.7" /></a> <a href="#-zero-trust-security--privacy"><img src="https://img.shields.io/badge/Privacy-100%25%20Local--First-2ea44f?logo=sqlite&logoColor=white" alt="Local-First Privacy" /></a> <a href="#-architecture--demo-walkthrough"><img src="https://img.shields.io/badge/Demo-Architecture%20Walkthrough-FF0000?logo=github&logoColor=white" alt="Demo Walkthrough" /></a> <a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg" alt="PRs Welcome" /></a> </p>

---

🌟 Overview

Kyro is a high-performance, local-first autonomous desktop AI agent that bridges natural language reasoning with real computer interaction. Unlike web-wrapped wrappers or cloud-dependent bots, Kyro runs a multi-threaded Rust native core with Tauri v2 and React 19, delivering zero-latency screen understanding, browser automation, terminal execution, and secure Model Context Protocol (MCP) integrations.

Kyro is built with a Zero-Trust Security Model: all conversations, embeddings, task histories, and artifacts stay strictly on your local disk in SQLite (WAL mode). API keys and credentials are encrypted using your Operating System Keyring (Vault), and dangerous actions require argument-aware authorization and human-in-the-loop verification.

---

🎬 Architecture & Demo Walkthrough

<div align="center"> <img src="assets/Architecting_the_Autonomous_Workspace__Deconstructing_Kyro_s_Ze-cleaned.gif" alt="Architecting the Autonomous Workspace: Deconstructing Kyro's Zero-Trust Architecture" width="100%" /> <p><em>Architecting the Autonomous Workspace: Deconstructing Kyro's Zero-Trust Architecture & Autonomous Workflow.</em></p> <p><a href="assets/Architecting_the_Autonomous_Workspace__Deconstructing_Kyro_s_Ze-cleaned.gif"><strong>🔍 View Full-Resolution Animated Walkthrough (.gif)</strong></a> &bull; <a href="assets/Kyro.mp4"><strong>▶️ Download Full Audio Video Demo (.mp4)</strong></a></p> </div> <br />

📖 Architecture Breakdown & Deep-Dive Explanation

The animated walkthrough (Architecting the Autonomous Workspace: Deconstructing Kyro's Zero-Trust Architecture) provides a visual step-by-step breakdown of Kyro's architecture, demonstrating how it overcomes the critical failure modes of conventional LLM agents through local-first execution, zero-trust security boundaries, and affirmative verification:

1. The Reliability Paradox: Why Unchecked LLMs Fail on Real Desktops (00:00 – 01:30)

   • The Problem: Conventional AI agents treat desktop automation as open-ended text generation. When unprivileged models emit commands directly to a host, they frequently hallucinate non-existent arguments, misinterpret syntax, and cause cascading system errors (such as unhandled null-pointer exceptions or terminal crashes) because they operate without a deterministic ground-truth feedback loop.
   • Kyro's Approach: Replaces open-ended text guessing with typed, stateful task execution plans. The runtime separates three distinct operational facts: action dispatched, sensory effect observed, and affirmative postcondition verified. A task cannot report completion without machine-verifiable evidence.

2. Centralized Zero-Trust Engine & Lexical Shell Firewall (01:30 – 03:30)

   • The Threat: Prompt injection, malicious workspace repos, or runaway model loops attempting destructive operations (e.g., cat server.log | rm -rf /).
   • Lexical Analysis: Kyro's Rust security kernel intercepts all raw shell inputs before they touch the host OS. Commands are lexically parsed into structured argv[] token vectors (argv[0] = "cat", argv[1] = "server.log", argv[2] = "|", argv[3] = "rm", argv[4] = "-rf").
   • Injection Firewall: Shell metacharacters, subshells, pipelines, and chained commands are identified immediately. Any unverified shell sequence fails closed, halting execution before any command is spawned.

3. Ephemeral Container Sandboxing & Least Privilege (03:30 – 04:30)

   • Execution Isolation: When untrusted scripts or experimental code runs, Kyro delegates execution to an isolated container runtime (docker run --network none --security-opt no-new-privileges --cap-drop ALL).
   • Zero Host Risk: All Linux capabilities are dropped, outbound network connections are blocked by default (NO_NET), the root filesystem is mounted read-only, and memory/CPU quotas prevent fork-bombs and host contamination. If the container engine is missing, Kyro fails closed rather than silently falling back to the host.

4. Developer Workbench & Intelligent Diagnostic Triage (04:30 – 05:30)

   • Build Doctor: Intercepts compiler errors (such as Rust cargo build --release compiler errors like E0308), maps the offending source file and span, and provides automated diagnostic triage.
   • UI Audit & Visual Regression: Captures multi-viewport snapshots and compares layout geometry across viewports, detecting microscopic visual flaws (such as button coordinate shifts (x+5, y+2)) before frontend bugs reach production.

5. Human Takeover & Cryptographically Bound Approvals (05:30 – 06:15)

   • Sensitive Checkpoints: When automation encounters credential forms, 2FA/MFA challenges, CAPTCHAs, or destructive system shortcuts (e.g., Alt+F4, Ctrl+W, Shift+Delete), automation immediately pauses for human intervention.
   • Anti-TOCTOU & Proof Binding: Human approvals emit a single-use authorization token cryptographically bound to the exact run_id, canonical action, and SHA-256 hash of the execution arguments. Replay attacks, argument tampering, or cross-run token reuse are strictly rejected.

6. Hardware-Encrypted OS Keyring & Ephemeral Secret Lifecycle (06:15 – 06:45)

   • Zero Plaintext Persistence: Public settings stay in SQLite WAL on disk, while API keys and OAuth tokens reside exclusively in the OS Keyring (macOS Keychain, Linux Secret Service, Windows Credential Manager).
   • Ephemeral In-Memory Tokens: Tokens are loaded into volatile memory only for the exact duration of an authenticated network call and immediately dropped and zeroed out (token_exposed: false).
   • Scrubbing Engine: Multi-tier redaction automatically sanitizes Bearer tokens, private keys, JWTs, and passwords from UI cards, logs, and database records.

7. Native MCP Host & Multi-Agent Collaboration (06:45 – 07:25)

   • Model Context Protocol (MCP): Dynamic tool discovery and execution via JSON-RPC 2.0 (stdio and HTTP/SSE) connects Kyro to standard MCP servers (e.g., @modelcontextprotocol/server-filesystem) with fine-grained per-tool permissions.
   • Multi-Agent Workspace: Autonomous specialist agents (Apex, Forge, and Scout) operate on independent Git worktrees, allowing parallel development, testing, and auditing without workspace conflicts or state contamination.

---

📸 Visual Showcase

<div align="center"> <h3>Everyday Mode & Interactive Assistant</h3> <img src="assets/screenshot_1.png" alt="Kyro Everyday Mode" width="90%" /> </div> <br /> <div align="center"> <h3>Developer Workbench & Managed Dev Servers</h3> <img src="assets/screenshot_2.png" alt="Kyro Dev Workbench" width="90%" /> </div> <br /> <details> <summary><strong>🔍 Click to view more features and interface previews</strong></summary> <br />

| Safe Reversible File Organizer | Local-First Document Assistant | |:---:|:---:| | <img src="assets/screenshot_3.png" alt="File Organizer" width="100%" /> | <img src="assets/screenshot_4.png" alt="Document Assistant" width="100%" /> | | Categorization rules & SHA-256 duplicate detection | Text/PDF parsing, date extraction, and side-by-side diffing |

| Multimodal Screen Explainer | Teach-a-Task & Routine Scheduler | |:---:|:---:| | <img src="assets/screenshot_5.png" alt="Screen Explainer" width="100%" /> | <img src="assets/screenshot_6.png" alt="Teach a Task" width="100%" /> | | Visual fact extraction, inferences, and 1-click actions | Demonstration recorder with cron & interval scheduling |

| Connections & MCP Integration Center | Multi-Agent Worktree Workspace | |:---:|:---:| | <img src="assets/screenshot_7.png" alt="Connections & MCP" width="100%" /> | <img src="assets/screenshot_8.png" alt="Multi-Agent Workspace" width="100%" /> | | Model Context Protocol, OAuth PKCE, and token isolation | Specialist agents (Apex, Forge, Scout) with isolated git worktrees |

</details>

---

✨ Key Features

🖥️ Dual Experience Modes

• Everyday Mode: Intuitive natural language workflows for non-developers:
  • File Organizer: Reversible file organization, collision handling, and SHA-256 deduplication.
  • Document Assistant: In-depth local PDF and plaintext parser with date/action item extraction and privacy disclosures.
  • Screen Explainer: Multimodal visual grounding with grounded 1-click prompt triggers.
• Dev Workbench: Specialized tools for software engineers:
  • Projects & Dev Servers: Auto-discovery of local projects, port status detection, and managed process lifecycles.
  • Code Checkpoints & Diffs: Instant git-aware snapshots, working tree clean checks, and rollback safety.
  • Build Doctor: Automated diagnostic triage for build failures, dependency issues, and syntax errors.
  • UI Audit & Visual Regression: Visual defect detection with multi-viewport baselines (Desktop, Tablet, Mobile).
  • Multi-Agent Workspace: Isolated Git worktree execution for autonomous teammates (Apex, Forge, Scout).

🔒 Zero-Trust Security & Privacy

• 100% Local-First Storage: SQLite with WAL mode stores chat histories, memories, and task traces on your machine.
• OS Keyring Vault: API keys and OAuth tokens are stored in the OS credential store (macOS Keychain, Linux Secret Service, Windows Credential Manager) with AES-256-GCM authenticated fallback.
• Argument-Aware Shell Governance: Shell commands are lexically parsed into exact argv tokens; command injection and unverified metacharacters are rejected.
• Human-in-the-Loop Takeover: Automatic detection of sensitive checkpoints (2FA prompts, password inputs, CAPTCHA) with smooth interactive user takeover.
• Secret Redaction: Exported routines, templates, and IPC event payloads automatically redact sensitive credentials.

👁️ Computer-Use & Visual Gr