CortexPrism

The open-source AI agent harness with memory, tools, a web UI, and layered security — powered by Deno.

CortexPrism is a self-hosted, open-source agentic AI harness that turns any LLM into a capable autonomous agent. It provides persistent memory, a rich tool ecosystem, sandboxed code execution, a full-featured web UI, and enterprise-grade security — all running locally on your machine or server.

Works with 12 LLM providers out of the box (Anthropic, OpenAI, Gemini, Groq, Ollama, and more)
Ships as a single Deno binary — no Docker required to get started
100% open source — MIT licensed, no telemetry, data stays on your machine

Features

AI Providers & Model Routing

12 LLM providers — Anthropic Claude, OpenAI GPT, Google Gemini, Mistral, Groq, DeepSeek, OpenRouter, xAI Grok, Together AI, AWS Bedrock, Cohere, Ollama (local models)
Multimodal input — upload images and documents; native vision support for Anthropic and Google Gemini; PDF text auto-extracted for all providers
Model Quartermaster (MQM) — intelligent model selection that learns which model performs best for each task type using a 6-signal prediction engine with adaptive EMA learning and three arbiter strategies (conservative / balanced / aggressive)
Model router — RouteLLM-style cascade (cheapest-first escalation) and threshold (prompt-scoring) routing strategies

Agent Capabilities

Interactive streaming chat — CLI and Web UI with real-time streaming, session persistence, and session resume
Tool use with approval gates — every tool call is reviewed by the security policy before execution; agents can request human approval for sensitive operations
Sub-agent orchestration — agents can spawn specialized child agents (Explorer, Coder, Researcher, Planner, Generalist) for parallel and delegated work
Per-turn reflection — LLM self-assessment of confidence and quality after each response; meta- pattern consolidation over time
Voice pipeline — speech-to-text (OpenAI Whisper), text-to-speech (OpenAI TTS / ElevenLabs), energy-based VAD, real-time audio streaming over WebSocket

Memory System

5-tier memory — episodic (FTS5 full-text search), semantic (vector embeddings), and reflection (learned patterns) with multi-strategy retrieval and decay scoring
Automatic memory injection — relevant memories are injected into each turn's system prompt
Memory search CLI — keyword, semantic, and hybrid search from the terminal

Built-in Tools

Category	Tools
File system	read, write, edit, patch, delete, rename, list, tree, info, search, glob, undo/redo
Shell	execute shell commands (sandboxed through policy validator)
Web	web_search, web_fetch (returns cleaned plain text)
Code execution	sandboxed Docker containers with resource limits; LLM auto-fix loop
GitHub	PR creation, issue tracking, repo browsing
Git workspace	status, commit, push, pull, branch, clone
Voice	speak, listen (STT/TTS agent tools)
Sub-agents	spawn typed child agents for parallel and delegated tasks

Web UI & REST API

Built-in HTTP server — cortex serve starts a WebSocket-powered chat UI on port 3000
Tabs: Chat, Editor (CodeMirror), Git, GitHub, Code Runner, Cortex Lens, Memory, Jobs, Sessions, Agents, Services, Settings, Soul, Plugins, Marketplace, Analytics, Logs
File upload — drag-and-drop or click to attach PDFs, images, and documents in chat
REST API — full HTTP API for sessions, memory, jobs, git, GitHub, and code execution
Session persistence — page refresh resumes the active session (full history preserved)

Security (Parallax Model)

Policy validator — every tool call is evaluated against regex allow/deny rules before execution
AES-256-GCM vault — encrypted credential storage with PBKDF2 key derivation
Default deny rules — ships with protection against rm -rf /, fork bombs, direct disk writes
Cortex Lens — full audit log of all sessions, tool calls, LLM calls, and policy decisions
No telemetry — all data stays on your machine

Ops & Extensibility

Scheduled jobs — SQLite-persisted cron with automatic retry
Daemon supervisor — manages validator, executor, and scheduler processes with exponential backoff restart
Plugin system — WASM and Deno module plugins with sandboxed permissions
Auto-update — cortex update supports source mode and signed binary mode with SHA-256 and optional GPG verification
Desktop app — Tauri-based desktop wrapper (macOS, Windows, Linux)

Requirements

Requirement	Notes
Deno 2.x	Required — the installer handles this automatically
Docker	Optional — needed for sandboxed code execution; subprocess fallback is available
macOS, Linux, or Windows	All platforms supported

Quick Start

Option 1: One-line installer (recommended)

macOS / Linux:

curl -fsSL https://cortexprism.io/install.sh | bash

Windows (PowerShell):

irm https://cortexprism.io/install.ps1 | iex

The installer: checks for / installs Deno, clones Cortex to ~/.cortex, creates the cortex CLI alias, and runs database migrations. After install, run cortex setup to configure your first LLM provider.

Option 2: Manual clone

git clone https://github.com/CortexPrism/cortex.git ~/.cortex
cd ~/.cortex
deno run --allow-all src/db/migrate.ts
deno run --allow-all src/main.ts setup

Add cortex to your PATH by appending to your shell profile:

echo 'alias cortex="deno run --allow-all ~/.cortex/src/main.ts"' >> ~/.bashrc
source ~/.bashrc

Option 3: Pre-compiled binary

Download the latest binary from the Releases page. All binaries include SHA-256 checksums and optional GPG signatures.

First run

cortex setup        # Interactive setup wizard — choose provider, enter API key
cortex chat         # Start your first chat session
cortex serve        # Open the Web UI at http://127.0.0.1:3000

CLI Reference

cortex <command>

Commands:
  chat              Interactive streaming chat session
  setup             Re-run the setup wizard
  sessions          List recent chat sessions
  run <file>        Execute a code file in the sandbox
  serve             Start the HTTP + WebSocket server with Web UI
  daemon            Manage background processes (validator, executor, scheduler)
  start             Start daemon + server processes
  restart           Restart daemon + server processes
  stop              Stop all background processes
  voice             Manage voice mode (enable, disable, status, set-voice)
  memory            Search and manage memory
  reflect           Inspect and consolidate reflection patterns
  jobs              Manage scheduled jobs
  vault             Encrypted credential vault (store / get / list / delete)
  policy            Security policy rules (list / add / remove / check)
  migrate           Initialise or migrate all databases
  update            Check for and apply updates
  git               Git workspace operations
  github            GitHub integration (PRs, issues, repos)
  mqm               Model Quartermaster stats and configuration

`cortex chat`

cortex chat                          # Start a new chat session
cortex chat --model gpt-4o           # Override the active model
cortex chat --resume sess_abc123     # Resume an existing session
cortex chat -s sess_abc123           # Resume (short flag)
cortex chat --no-stream              # Disable streaming output

Slash commands inside chat:

/exit   Quit
/help   Show available commands
/clear  Clear the screen

`cortex run <file>`

Execute a code file in an isolated sandbox with optional LLM auto-fix:

cortex run script.py                    # Run in Docker sandbox (auto-detect language)
cortex run script.py --no-sandbox       # Run as direct subprocess
cortex run script.py --fix              # Enable LLM auto-fix loop on failure
cortex run script.py --fix --max-fix 6  # Up to 6 fix attempts

Supported languages: python, javascript, typescript, bash, ruby, go, rust

`cortex serve`

Start the built-in HTTP + WebSocket server:

cortex serve                         # http://127.0.0.1:3000 (foreground)
cortex serve --port 8080 --host 0.0.0.0
cortex serve -d                      # Run in the background (daemon mode)
cortex serve -d -r                   # Restart background server
cortex serve -s                      # Stop background server
cortex stop                          # Stop server + all daemons
cortex stop --server-only
cortex stop --daemon-only

`cortex daemon`

cortex daemon start                  # Start supervisor in background (auto-restart on crash)
cortex daemon stop
cortex daemon restart
cortex daemon run                    # Run supervisor in foreground (for systemd / tmux)
cortex daemon status

Three daemon processes: Validator (policy enforcement), Executor (tool execution), Scheduler (cron jobs and memory consolidation). The supervisor auto-restarts any crashed daemon with exponential backoff.

`cortex git`

Full git workspace management for agent and global workspaces:

cortex git status [--agent <id>]
cortex git log [--agent <id>] [--limit 20]
cortex git diff [--agent <id>] [--stat] [--file <path>]
cortex git add <file...> [--agent <id>]
cortex git add --all [--agent <id>]
cortex git commit <message> [--agent <id>]
cortex git push [--agent <id>] [--remote origin] [--branch <name>]
cortex git pull [--agent <id>]
cortex git clone <url> <dest> [--branch <name>]
cortex git branch [--agent <id>]
cortex git branch --create <name> [--agent <id>]
cortex git branch --checkout <name> [--agent <id>]
cortex git remote --add <name> --url <url> [--agent <id>]

`cortex github`

GitHub integration — requires GITHUB_TOKEN env var, githubToken in config, or vault entry github_token:

cortex github pr list <repo> [--state open] [--limit 10]
cortex github pr create <repo> <title> <head> <base> [--body "..."] [--draft]
cortex github pr merge <repo> <number> [--method merge|squash|rebase]
cortex github issue list <repo> [--state open]
cortex github issue create <repo> <title> [--body "..."] [--labels a,b]
cortex github repo list [--type all|owner|public|private]

`cortex memory`

cortex memory search "sqlite"           # Keyword + vector hybrid search
cortex memory search "sqlite" --semantic # Vector only
cortex memory add "CortexPrism uses SQLite WAL mode"

`cortex vault`

AES-256-GCM encrypted credential storage:

export CORTEX_VAULT_KEY="your-passphrase"

cortex vault store "openai-key" --service openai  # Prompts for the value
cortex vault get "openai-key"
cortex vault list
cortex vault delete "openai-key"

The passphrase is never stored — only held in the environment variable at runtime (PBKDF2 key derivation, 100k iterations, SHA-256).

`cortex policy`

cortex policy list
cortex policy add "curl.*evil\.com" --kind shell --effect deny --reason "Blocked domain"
cortex policy check shell "rm -rf /etc"
cortex policy remove pol_abc123

Default deny rules (seeded on first migrate):

rm\s+-rf\s+/ — recursive root delete
:\(\)\{.*\} — fork bomb patterns
dd\s+if=.*of=/dev/ — direct disk writes
chmod\s+777\s+/ — world-write on root

`cortex update`

cortex update              # Check for updates and apply
cortex update --check      # Dry-run — show available versions without applying
cortex update --channel pre # Include pre-release versions
cortex update --rollback   # Revert to previous version
cortex update --status     # Show current and latest version
cortex update --force      # Bypass dirty working tree check (source mode)

Supports source mode (git pull) and binary mode (download + SHA-256 + optional GPG verification).

`cortex mqm`

cortex mqm stats            # Performance statistics per model
cortex mqm decisions        # Recent routing decisions
cortex mqm weights          # Current signal weights
cortex mqm accuracy         # Prediction accuracy metrics

`cortex voice`

cortex voice enable         # Enable voice mode
cortex voice disable
cortex voice status
cortex voice set-voice <voice-id>

Configuration

Config file: ~/.cortex/config.json (created by cortex setup)

{
  "version": 1,
  "defaultProvider": "anthropic",
  "providers": {
    "anthropic": { "kind": "anthropic", "model": "claude-sonnet-4-5", "apiKey": "sk-..." },
    "openai":    { "kind": "openai",    "model": "gpt-4o",            "apiKey": "sk-..." },
    "google":    { "kind": "google",    "model": "gemini-2.0-flash",  "apiKey": "..." },
    "mistral":   { "kind": "mistral",   "model": "mistral-large-latest", "apiKey": "..." },
    "groq":      { "kind": "groq",      "model": "llama-3.3-70b-versatile", "apiKey": "gsk_..." },
    "deepseek":  { "kind": "deepseek",  "model": "deepseek-chat",    "apiKey": "sk-..." },
    "openrouter":{ "kind": "openrouter","model": "openai/gpt-4o",    "apiKey": "..." },
    "xai":       { "kind": "xai",       "model": "grok-2-latest",    "apiKey": "..." },
    "together":  { "kind": "together",  "model": "meta-llama/Llama-3.3-70B-Instruct-Turbo", "apiKey": "..." },
    "bedrock":   { "kind": "bedrock",   "model": "us.amazon.nova-pro-v1:0", "region": "us-east-1" },
    "cohere":    { "kind": "cohere",    "model": "command-r-plus",   "apiKey": "..." },
    "ollama":    { "kind": "ollama",    "model": "llama3.2",         "baseUrl": "http://localhost:11434" }
  },
  "server": { "port": 3000, "host": "127.0.0.1" },
  "reflection": { "enabled": true },
  "memory": { "maxHits": 5 },
  "voice": {
    "enabled": false,
    "provider": "openai",
    "defaultVoice": "alloy",
    "autoTTS": false
  }
}

Environment Variables

Variable	Purpose
`CORTEX_DATA_DIR`	Override data directory (default: `~/.cortex/data/`)
`CORTEX_CONFIG_DIR`	Override config directory (default: `~/.cortex/`)
`CORTEX_VAULT_KEY`	Vault decryption passphrase (required to use `cortex vault`)
`GITHUB_TOKEN`	GitHub personal access token for the `github` command
`OPENAI_API_KEY`	OpenAI API key (alternative to config file)

Web UI

Start with cortex serve and open http://127.0.0.1:3000.

Tab	Description
Chat	WebSocket streaming chat with file upload (PDF, images, documents)
Editor	Full file editor powered by CodeMirror
Git	Visual git workspace — status, stage, commit, push, pull
GitHub	PR management, issue tracking, repository browser
Code Runner	Sandboxed code execution with language selection and live output
Lens	Cortex Lens — full activity audit timeline
Memory	Search episodic and semantic memory
Jobs	View and manage scheduled jobs
Sessions	Browse and resume past chat sessions
Agents	View active and completed sub-agent sessions
Services	Monitor running micro-services
Settings	Provider configuration, voice settings
Soul	Edit the agent's identity / system prompt
Plugins	Manage installed plugins

REST API

GET    /api/health
GET    /api/sessions?limit=20
GET    /api/sessions/:id
GET    /api/sessions/:id/messages
POST   /api/sessions/:id/resume
DELETE /api/sessions/:id
GET    /api/jobs?status=pending
GET    /api/memory/search?q=<query>
GET    /api/workspace/git/status
POST   /api/workspace/git/commit
POST   /api/workspace/git/push
GET    /api/github/repos
POST   /api/code/exec
POST   /api/upload
POST   /api/voice/transcribe
POST   /api/voice/synthesize
WS     /ws   (streaming chat)

Security Model

CortexPrism uses a Parallax security model — all tool calls pass through a multi-layer policy system before execution:

Agent → Tool Intent → Policy Validator → Executor
                             │
                    [regex allow/deny rules]
                    [capability level (CPL)]
                    [optional human approval]

Policy rules — regex-based allow/deny rules evaluated against every shell command, file path, and network request. Managed with cortex policy.
AES-256-GCM vault — all credentials stored encrypted; never written to config in plain text once vaulted.
Cortex Lens — append-only audit log in lens.db; every tool call, LLM call, and policy decision is recorded with timestamp and session context.
Sandbox isolation — code execution runs in ephemeral Docker containers with resource limits (CPU, memory, network disabled by default); subprocess fallback for systems without Docker.

See SECURITY.md for the vulnerability disclosure policy.

Plugin System

CortexPrism supports both Deno module plugins and WASM plugins with sandboxed permissions.

# Install a plugin from the marketplace
cortex plugins install <plugin-name>

# List installed plugins
cortex plugins list

See docs/plugins/ for the full plugin development guide, manifest reference, and submission standards.

Architecture

CortexPrism is a single-process Deno application. All state is persisted in SQLite (WAL mode) via @libsql/client.

CLI / Web UI / REST API
        │
   agent/loop.ts          ← core agent turn: memory inject → LLM → tool parse → execute
        │
   ┌────┼──────────────────────────────────────┐
   │ memory/   tools/   security/   llm/       │
   │ server/   sandbox/ scheduler/ voice/      │
   └────────────────────────────────────────────┘
        │
   SQLite databases (WAL mode)
   cortex.db · memory.db · lens.db · vault.db

Database	Purpose
`cortex.db`	Sessions, jobs, policies, services, nodes
`memory.db`	Episodic, semantic, and reflection memory
`lens.db`	Cortex Lens audit log
`vault.db`	Encrypted credential vault
`plugins.db`	Plugin registry

For the full architecture reference, see docs/ARCHITECTURE.md.

Contributing

Contributions are welcome! Please read CONTRIBUTING.md before opening a PR.

# Clone and verify
git clone https://github.com/CortexPrism/cortex.git
cd cortex
deno task check    # Type-check — must pass before any PR
deno task lint
deno task fmt
deno task test

Reporting Issues

Bug reports — use the Bug Report template
Feature requests — use the Feature Request template
Security vulnerabilities — see SECURITY.md for the private disclosure process

Roadmap

MCP (Model Context Protocol) server — expose CortexPrism as an MCP server to other clients
Distributed cluster mode — Hub + Node agent distribution across machines
Enhanced desktop app with tray support and native notifications
Projects system — workspace-scoped context and memory isolation
Workflow engine — visual no-code agentic workflow builder
Extended LLM provider coverage and streaming improvements

License

MIT — free for personal and commercial use.

Built with Deno · TypeScript strict mode · SQLite · No telemetry

Name		Name	Last commit message	Last commit date
Latest commit History 121 Commits
.github		.github
deploy		deploy
desktop/src-tauri		desktop/src-tauri
docs		docs
packaging		packaging
src		src
tests		tests
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
VERSION		VERSION
deno.json		deno.json
deno.lock		deno.lock
install.ps1		install.ps1

Folders and files

Latest commit

History

Repository files navigation

CortexPrism

Table of Contents

Features

AI Providers & Model Routing

Agent Capabilities

Memory System

Built-in Tools

Web UI & REST API

Security (Parallax Model)

Ops & Extensibility

Requirements

Quick Start

Option 1: One-line installer (recommended)

Option 2: Manual clone

Option 3: Pre-compiled binary

First run

CLI Reference

cortex chat

cortex run <file>

cortex serve

cortex daemon

cortex git

cortex github

cortex memory

cortex vault

cortex policy

cortex update

cortex mqm

cortex voice

Configuration

Environment Variables

Web UI

REST API

Security Model

Plugin System

Architecture

Contributing

Reporting Issues

Roadmap

License

About

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`cortex chat`

`cortex run <file>`

`cortex serve`

`cortex daemon`

`cortex git`

`cortex github`

`cortex memory`

`cortex vault`

`cortex policy`

`cortex update`

`cortex mqm`

`cortex voice`