Self-hosted · Policy-first · Matrix-native
Operate AI agents like production services.
Ruriko is a lightweight, distributed control plane for secure, capability-scoped AI agents running over Matrix— with lifecycle control, deterministic policy enforcement, secrets, approvals, and auditable tool access.
Why Ruriko
Most agent frameworks optimize for demos. Ruriko optimizes for operating agents safely in the real world: deterministic controls, strict capability boundaries, and human-in-the-loop approvals when it matters.
Deterministic capability enforcement with default deny and auditable decisions.
Agents can’t self-modify. Behavior is driven by structured configuration.
Centralized secret management, scoped bindings, and explicit human approvals for sensitive actions.
Spawn, stop, respawn, update—treat agents like operated services, not chat windows.
Identity + message bus + collaboration surface, where humans and agents coexist naturally.
Small footprint agents that are easy to ship to VMs, Pi, containers, or clusters.
Architecture
Two core components: the control plane (Ruriko) and the runtime (Gitai). Configuration and policy are expressed as versioned Gosuto YAML.
- • Manages lifecycle and configuration versions
- • Provisions Matrix identities
- • Stores/rotates secrets
- • Maintains audit logs + approvals
- • Structured envelopes over Matrix
- • Local policy enforcement
- • Supervises MCP tool processes
- • Immutable runtime behavior
- • Allowlisted rooms/senders
- • Capability rules + constraints
- • Tool wiring + approvals
- • Limits: rate/cost/concurrency
Policy is deterministic. Persona is cosmetic.
Security model
Capability-based enforcement, strict allowlists, default deny, and approvals for sensitive tool calls—designed so LLM output never becomes “control logic.”
Rules are structured; first-match wins; every decision is traceable.
Secrets aren’t stored in Gosuto; bindings are explicit and constrained.
Sensitive operations require a human “yes” via the same collaboration channel.
Policies, tool calls, approvals, and outcomes can be logged as an operational record.
Tooling via MCP
Integrate tools through the Model Context Protocol (MCP) with supervised processes and explicit allowlists.
Approval-gated navigation and controlled actions.
Files, APIs, internal systems—wired and constrained per agent.
MCP servers are monitored and reconciled by the runtime.
Bring your agents to production
Use this page as your GitHub Pages landing, and plug in real screenshots or diagrams as the project evolves.
Roadmap
Early-stage infrastructure project. These milestones mirror your current direction.
Lifecycle + configuration versions + audit.
Immutable runtime + local enforcement + supervision.
Central store, scoped bindings, rotation workflows.
Deterministic rules, first-match wins, default deny.
Human-in-the-loop for sensitive tools.
Agent templates to standardize safe deployments.