Open source / Self-hosted / Active development
Security-first agent runtime
Comis is an open-source, self-hosted, security-first runtime for agents that work across sessions. It can carry qualifying experience forward as sourced, correctable guidance, while configured runtime controls decide what the agent may do.
The control problem
Prompt injection is not limited to one prompt when an agent can remember, run tools, start other agents, and return later. Useful learning and safe action need one control system.
The runtime is the software around the model that stores state, applies rules, runs tools, and records evidence. In Comis, that layer owns permission. Prompt text and learned text do not.
Signals that cross sessions
can shape memory and later proposals
can turn a proposal into an outward action
can extend reach across time and a task tree
Model proposes. Runtime decides.
Governed learning
Comis can carry qualifying experience across sessions with its source, evidence, usefulness, and correction history attached.
Consider the outcome, source trust, and usefulness of an experience.
Validate candidate guidance and apply the configured evidence rule.
Surface sourced guidance in a later session without changing authority.
Use later outcomes to promote, demote, retire, or preserve guidance.
The runtime
Security is not one filter. It is a connected set of controls around context, learning, tools, delegation, credentials, and evidence.
Keep lossless messages and tool results outside the active prompt. Recover selected details with ctx_search, ctx_inspect, and ctx_expand. Recall memory and admit learned guidance with trust, source, usefulness, and correction signals.
context recovery / provenance / correction
Apply capability gates, origin checks, scoped secrets, encrypted storage, and the optional Credential Broker outside prompt text. The model can request access; the runtime controls whether that access exists.
capabilities / origin / secrets / leases
Run typed dependency graphs with cache-aware parallel subagents. Share limits across the full task tree for spawn count, cost, tokens, time, rates, outward actions, and leases.
typed DAG / parallel fanout / tree limits
Use cache-aware execution across Anthropic, OpenAI, and Gemini, context transforms, and graph fanout. Record execution evidence and assemble a bounded incident explanation without another model call.
cache trace / execution evidence / comis explain
Current evidence
A useful result names the workload, the state transition, the denied escalation, and the limits of the test.
| Property | Current status |
|---|---|
| Guidance acceptedCandidate admission | Internally reproduced across catalog mechanisms |
| Reused in a new sessionFresh-session reuse | Reproduced in selected scenarios |
| Works with changed inputRotated-input transfer | Reproduced in selected scenarios |
| Measured task improvementGeneral measured lift | Not yet measured |
| Reproduced by another teamIndependent reproduction | Not yet |
Internal evidence, not an independent or customer result. Read the learning stress catalog for scenario scope and limitations.
comis explain <sessionKey|traceId|rootRunId>content_heuristic_misclassificationSecurity and deployment
Comis treats model output and external content as untrusted, but safe operation still depends on your host and configuration.
What the runtime can enforce
Privileged paths use capability gates, origin checks, scoped secrets, encrypted storage, and the optional Credential Broker.
CLI-driven autonomy can use jailed execution, capability-limited Unix sockets, expiring leases, and brokered credentials.
Persistent interactive terminals fail closed when the supported Linux isolation path cannot be established.
Configured limits can cover the parent agent and every child it starts, including outward actions and leases.
What operators must decide
Linux with Bubblewrap is the recommended target. macOS isolation is best-effort and does not provide the same boundary. Ordinary exec can reach the host when its sandbox is disabled or unavailable.
The default tool profile is full and an empty per-agent secret allowlist is unrestricted. The approvals schema defaults off; guided setup enables it when it creates an administrator mapping. Approvals protect only explicitly wired paths. Narrow these before accepting untrusted input.
The default evidence rule can admit one owner's experience. It is not independent corroboration. Candidate text may affect tool selection, and validation does not catch every harmful instruction.
Self-hosted does not mean offline. Configured model, messaging, media, MCP, and tool providers may receive data you send to them.
Open evidence and community
Comis Open Evidence is a planned public proof program, not a shipped benchmark suite.
Bring a workload, an attack path, a learning failure, or an integration. Leave a reproducible result or a maintained artifact.
Teams can own recurring workloads, deployment profiles, or adapters with a named maintainer, tested version, evidence link, and known limits.
Ways to contribute
Quick start
The managed installer can add Node.js, host tools, and a background service. Direct npm install keeps host setup in your hands.
Start with a read-only workload on supported Linux isolation. Add tools, credentials, and write access only after testing your policy.
Read the installation guidecurl -fsSL --proto '=https' --tlsv1.2 https://comis.ai/install.sh -o comis-install.shOne-line convenience: curl -fsSL --proto '=https' --tlsv1.2 https://comis.ai/install.sh | bash. This skips local review of the installer.
Comis is an Apache-2.0 TypeScript project built around ports and adapters. Most code integrations are source-integrated and wired in the composition root.