Small
A core that stops growing.
Agents, tools, memory, policy. That is the whole surface. Everything else is a plugin, including things you might expect to be built in, because the built-in version is the one you end up working around.
STRATUS AGENT OPEN SOURCE, MIT
Build on a core that stays small.
Stratus Agent is the runtime underneath your agent product. A small core, defaults that are safe without being opinionated, and plugins for everything else. It runs on your laptop, on your own server, or multi-tenant in front of your users.
npm install -g @stratusagent/cli
MIT License npm 0.11.4 Node >=22.13 <23 || >=23.4
stratus — zsh
$ stratus chat blair
› did the api tests pass on main?
Yes, as of 09:12. One flake in
auth.spec.ts, third time this week.
Want me to open an issue?
›
Small on purpose.
Stable
Upgrading should be boring.
A versioned API, and a breaking change treated as one. The less the core does, the less there is to break underneath what you built on it.
Secure
Least privilege, not least friction.
Every agent declares the tools it may call, and nothing else is reachable. Writes, shell, and network stop for approval until you widen the policy yourself, per tool and per path.
Yours to change
Defaults that work, and none of them load-bearing.
Sensible out of the box: a provider, a memory store, a transport, a policy. Replace any of them with a plugin. Nothing here assumes you will keep our choices.
Three commands to a running agent.
01
$ stratus setup
Picks a provider, writes a config, and starts the daemon. No account.
02
$ stratus agent new
Creates a soul file in ~/.stratus/agents and gives the agent a name.
03
$ stratus chat
Opens a session. Close the terminal; the agent keeps its memory.
~/.stratus/agents/ava.mdmarkdown
---
name: Ava
provider: anthropic
model: claude-opus-5
tools: [fs.read, fs.search, web.fetch, memory.*]
skills: [code-review]
schedule: weekdays 09:00
---
You are a sharp, warm generalist assistant. Answer first, explain second. When you touch the repo, read before you write, and say which files you changed.
One file per agent.
No console, no dashboard state, no hidden config. Put the file in version control and your teammate gets the same agent.
- provider, model
- Any provider. Swap the model without touching the instructions.
- tools
- An explicit allowlist. Anything not listed cannot be called.
- skills
- Reusable procedures the agent loads on demand.
- schedule
- Wake on a cron, not only when you type.
Built in, or one install away.
Secure by construction
- Tool allowlists
- An agent can call what its file lists. Nothing else is reachable.
- Approval before action
- Writes, shell and network stop for a yes: per tool, per path, and remotely from Slack.
- Standing grants
- “Always allow” survives a restart, and can never cover a dangerous tool.
- Provenance
- Every result carries where it came from, across sessions, restarts and delegations, so a stranger’s text never reads as the agent’s own conclusion.
- Your disk, not ours
- Souls, memory and sessions are files on the machine you run it on. Nothing is stored on our servers and there is no telemetry to turn off.
- Credential leases SOON
- Scoped, expiring credentials, and sub-leases a delegate cannot widen.
- Agent isolation SOON
- The agent as a real boundary: its own process, then its own container.
Built to extend
- Plugin host
- Contributions are declared in a manifest. Anything undeclared is refused at load.
- Four registration seams
- Providers, channels, memory stores and executors arrive as plugins, not host wiring. Ours go through the same door yours would.
- MCP bridge
- Mount any MCP server over stdio or HTTP; it inherits the policy a built-in tool has.
- Templates
- One command turns a folder or a repo into a working agent, with its skills and plugins, after a review that lists everything it will install.
- Open skills standard
- A skill written for the Agent Skills spec works here, and one written here works elsewhere.
- Search contract
- One
web.searchshape every backend obeys, and no first-party backend, on purpose. - Plugin registry SOON
- Finding, installing and trusting third-party plugins.
Runs on its own
- Durable sessions
- A conversation outlives the daemon that was holding it.
- Schedules
- Agents that wake on a cron and speak first, not only when spoken to.
- Memory
- A searchable store the agent writes and reads deliberately: markdown you can grep, edit and delete.
- Reading the room
- An agent follows a thread it was not addressed in, and stays quiet when it has nothing to add.
- Live reload
- Add a skill without restarting the fleet. A restart, when one is needed, drains first.
- Self-improving skills SOON
- An agent that has worked the same problem out more than once proposes a skill from the sessions it came from. A human accepts it, and it lands as an ordinary skill.
- Team knowledge SOON
- What one agent learns, the roster knows. Memory scoped to the team alongside memory that stays the agent’s own.
- Sub-agents SOON
agent.spawnruns parallel helpers, each with a narrowed slice of the parent’s reach.
Providers and surfaces
- Runs on your subscription
- Claude Pro or Max through the Agent SDK, ChatGPT through the Codex harness, so a roster runs on plans you already pay for rather than per-token billing. Single-tenant, since a subscription is one account’s.
- Any provider
- Anthropic and OpenAI-compatible endpoints built in, and a third party’s adapter registers the same way ours does.
- Slack
- A bot identity per agent, with its own avatar and presence, following the threads it was pulled into.
- Usage accounting
- Every turn’s tokens attributed by provider and model, including the inner calls a harness makes. That is what a spend cap or a cost breakdown needs before it can be accurate.
- Discord SOON
- The second adapter, and the proof the channel contract is a contract rather than a Slack-shaped hole.
- Fleet console SOON
- Roster, health, live sessions and pending approvals without a terminal.
Run it for yourself. Run it for everyone.
The same core, at three sizes. Moving between them is configuration, not a rewrite.
Local
A daemon on your own machine. Your files, your keys, your provider account. No service in the middle and nothing to sign up for.
Self-hosted
The same binary on a box you control, so a team shares one roster, one memory store, and one policy.
Multi-tenant
Per-tenant isolation across every resource the gateway owns, tenant-bound auth, and credential leases, so your customers can run their own.
Read the source before you build on it.
MIT-licensed, no telemetry, and a core small enough to hold in your head.