Soulacy is a local-first agent operating system: one Go binary, YAML agents, native MCP, persistent semantic memory, governed LLM spend, and a Studio that learns from proven runs and explicit feedback.
$ curl -fsSL https://soulacy.io/install.sh | bash
Probe the deterministic pattern scanner & intent gate rules in real-time.
The latest mainline work strengthens Soulacy from model call to operator review: semantic memory survives restarts, every inference path shares one cost governor, and human feedback improves reusable workflow evidence without silently rewriting an agent.
Agent-scoped semantic records live in the embedded SQLite archive and remain searchable after restart. Production no longer silently falls back to an in-memory vector index.
Rate completed Chat responses helpful or unhelpful. Durable, redacted signals boost or suppress matching workflow patterns; written guidance stays pending until reviewed.
Studio distills successful multi-tool runs, learns repeated authoring preferences, retrieves semantically related repair lessons, and warns when a model/strategy pairing is historically unreliable.
Reserve worst-case spend before calling a provider. Enforce daily, monthly, per-user, and per-agent budgets plus pricing policy, output ceilings, TPM, concurrency, and circuit breakers.
Object-scoped RBAC, session ownership, canonical filesystem roots, redirect-aware SSRF protection, privileged execution isolation, redaction, retention, and production readiness checks.
Source builds, CI, release workflows, containers, and installers are aligned on Go 1.26.6. Binary installs remain dependency-free.
Self-hosting does not make agent actions safe by itself. Soulacy treats untrusted content, capability scope, confirmation, filesystem access, outbound networking, identity, audit, and spend admission as first-class runtime boundaries—not optional plugins.
Every external tool result is wrapped in an <external_content trust="untrusted" source="…"> block. Every agent's system prompt teaches the model to treat wrapped content as data, not instructions.
Deterministic scanner runs on every wrapped body. Covers prompt_override, role_swap, secret_exfiltration, tool_incitement, hidden_text, obfuscation, data_exfiltration, channel_abuse.
High-risk tool calls (shell_exec, write_file, http_request, MCP write verbs) that the operator's goal didn't request AND that land on untrusted evidence with a High-severity finding are DENIED at dispatch. Before policy, guardrail, and confirm layers run.
The production deployment profile BLOCKS launch when any privileged agent is exposed on a shared channel (Telegram, Slack, etc.) without explicit accept_privileged_exposure:true.
Web-page injection, uploaded-document exfil, channel-message injection, KB retrieval role-swap, MCP result injection, malicious tool descriptions, obfuscated base64. Full CI pack on every PR.
Save is blocked when a workflow uses a system-requiring tool without capabilities:[system]. Warnings surface privileged-channel exposure and ingest+privileged coexistence. Recommendations name scoped alternatives.
Full risk report per agent — tier, tools, channels, policy, findings. Dry-run simulator lets you probe adversarial content against the S1+S2+S3 pipeline without executing anything.
Set security.intent_gate: deny once at the workspace; it flows through runtime, Studio review, and Doctor. Per-agent SOUL.yaml still wins when needed.
Every cell below is defensible. We're not the best at everything — but the axes we win on are the ones that block production deployment for everyone else.
| Soulacy | LangGraph | CrewAI | Claude / OpenAI SDK | Dify / n8n / Flowise | |
|---|---|---|---|---|---|
| Deployment | Single Go binary | Python package | Python package | Vendor SDK | Docker + Postgres + Redis |
| Agent config | One YAML file | Code | Code | Code | Visual editor |
| Injection scanner | ✓ Shipped, 14 patterns | Operator's problem | Operator's problem | Operator's problem | 3rd-party plugin |
| Intent gate | ✓ Shipped, workspace-scoped | — | — | — | — |
| Readiness verdict | ✓ Blocks unsafe launch | — | — | — | — |
| Red-team regression | ✓ 7 fixtures, every push | — | — | — | — |
| Debug failed run | Replay + diff preview + apply | Stack trace | Stack trace | Stack trace | Node console |
| Provider coverage | Any (config alone) | Any | Any | Vendor-first | Most |
| Runs on | Laptop, $5 VPS, Raspberry Pi | Dev machine | Dev machine | Wherever SDK runs | Needs a server stack |
Sources for competitor claims: docs.soulacy.io/comparison-chart (with cited URLs per cell).
One binary. No infra. Boots into a browser-ready gateway with a locally-issued API key.
Installs soulacy + sy into ~/.local/bin. Boots with a printed API key.
Postgres + Qdrant + gateway. Security posture defaults ON (intent-gate=deny, sandbox=on, profile=production).
Everything in one container. Zero external dependencies. For laptop / single-operator use.
Intent-first agent authoring with authoritative trigger, destination, provider, and model controls. Auto is the default; fixed-graph Workflow stays explicit and experimental. Debug repairs remain diff-previewed and reviewable.
HTTP, Telegram, Slack, Discord, WhatsApp, Email/SMTP, Teams, Google Chat, Webhook. Each with a delivery doctor that categorizes failures into 15 stable categories.
Cron and one-shot triggers with startup catch-up. Session Activity tracker exposes hung runs with per-last-event-type reasons.
Successful runs become sanitized structural patterns; accepted repairs become semantic lessons; repeated edits become user-scoped preferences; thumbs feedback adjusts evidence without auto-editing the agent.
Connect to any MCP server (stdio or HTTP). Expose Soulacy itself as an MCP server via sy mcp serve.
Prompt-free estimates, atomic reservations, hard or soft budgets, chargeback dimensions, pricing coverage, provider reconciliation, and readiness alerts across every inference path.
Self-disqualify quickly if the fit is wrong. That's more useful than pretending we're for everyone.
No soulacy.cloud. Ever. Self-hosted-first is the point of the product.
If you need explicit state-machine graphs with checkpoints and resumable execution, use LangGraph.
Soulacy runs headless and delivers to channels. It doesn't ship a wake-word, a Canvas, or a native mobile app. If you want an iMessage / WeChat / Signal personal assistant, use OpenClaw.
Not tied to Anthropic, OpenAI, Google, or any provider. Provider-agnostic via config.
Studio helps, but the audience is developers/ops who prefer YAML and Python tools. If you want drag-and-drop nodes, use n8n or Flowise.
The 7-story security stack is real, shipped code with a red-team pack on CI. Fork the repo and grep internal/injection/.
Single binary. YAML agents. Persistent memory. Governed inference. Defense-in-depth runtime controls. Running in under a minute.