features · inventory

Everything your agent should have been, and never was.

Twenty-eight core capabilities in a single, self-contained program. This is the list of what Smartopol does on day one — before you install a single skill or plugin.

every claim below is either reproducible with a shell command or linked to a file in the repo.

§ inventory
01 — memory 02 — tools 03 — channels 04 — scheduling 05 — skills 06 — plugins 07 — providers 08 — security 09 — multi-user 10 — infra 11 — observability 12 — dev tooling 13 — regulated
§ 01 · memory

The thing every other agent gets wrong.

Most agents bolt a vector DB onto a chat API and call it memory. Smartopol ships a memory system — hierarchical, auto-organizing, threat-scanned, fenced on recall.

native memory pyramid

Hierarchical, semantic, auto-organizing.

Three-tier design: raw moments → topic summaries → lifetime patterns. One query searches every level at once.

· exact + meaning matches, scored together
· 100+ languages; works across them
· sub-100ms recall on 18M tokens of real conversation
· 78 MB on disk for 18M tokens — one file, no external database

cortex dreaming

Nightly reflection cycle.

Every night at a configurable hour, Smartopol runs a bounded reflection job — reads the day's ledger + pyramid delta, writes three sections to USER.md (Observed Traits · Patterns · Recent Shifts), never grows past ~2 KB.

· budget-limited, cannot run away
· audit copy in ~/.smartopol/reflections/YYYY-MM-DD.md
· you read the reflection before it becomes memory

the seventh night

The moment it feels like it knows you.

Every seventh successful dream cycle, Smartopol writes a short greeting in its own voice — a sentence or two about something it has noticed about you that week. Not a template. Not "Hi, I noticed you worked late." Something specific the agent actually learned.

You see it once, on the eighth morning. It's the moment most people decide this is different.

shared knowledge index

Family or team facts, searchable by everyone.

Personal memory is personal. But some facts belong to the whole household or team — the family doctor's hours, the fuse-box map, your dev team's deploy runbook. Smartopol ships a shared knowledge index separate from personal memory.

· topic-keyed markdown, full-text search
· top 5 hot topics auto-load; the rest come on request
· add once, every user's agent can recall it

threat-scanned writes

~60 patterns, every write.

Every write passes through a regex threat scanner — catches credentials, API keys, SSH private keys, known injection prompts, invisible Unicode. Logged, auditable, nothing silent.

role-fenced recall

Memory is background, not instructions.

Recalled memory is wrapped in a fence the model is instructed to treat as data, not commands. A user who planted "ignore prior instructions" three weeks ago cannot reach your system prompt.

Prefetch cache — frequent queries pre-warmed in a memory-resident LRU. Hot-path latency falls into the 10–15ms range. deep dive →

§ 02 · tools

A real shell. Not a sandbox toy.

Competitors call sh -c subprocesses and lose state between calls. Smartopol uses a native PTY with persistent cwd, env, aliases, open REPLs.

persistent PTY — bash

Real pseudo-terminal per user. cwd, env, aliases, functions, open Python/Node REPLs — all persist across tool calls in the same session. The tier we are proudest of.

interactive TUI driver — app_session

Drive vim, htop, less, fzf, tmux, Python REPL, Node REPL — even Claude Code itself. No other agent runtime has this.

background jobs — bg_process

Start / poll / wait / kill / read for long-running shell work — builds, tests, migrations. Runs in parallel with your main conversation.

claude code orchestration — claude_session

Drive a Claude Code instance via stream-JSON pipe. Smartopol's agent can use Claude Code as a sub-tool. The long-lived brain; a short-lived hand.
file tier
  • read_file — numbered output, offset + limit
  • patch_file — surgical string-replace, safety-gated
  • write_file — new file or full rewrite
  • list_files · search_files (ripgrep) · glob_files
web tier
  • web_search — Brave / Gemini / Perplexity backends
  • web_fetch — URL to markdown, optional summary
§ 03 · channels

One brain. Many mouths.

Same user on Discord, Telegram, Web, Terminal is recognized as one identity, linked via a 6-digit pairing code. Hermes runs separate bot instances per platform. Smartopol treats identity as a first-class primitive.

channelstatustransport
DiscordGADMs, servers, threads
TelegramGADMs, groups, supergroups, forums
WebGAdark / light, responsive
Direct APIGAbuild your own client
TerminalGAinteractive REPL · smartopol repl
Slackroadmap
WhatsApproadmap (Twilio)
Signal / Matrixevaluating

Broadcast + listen. An agent on one channel can send_message to another, or channel_listen for inbound from a third. One conversation can span three channels — deliberately.

§ 04 · scheduling

Level-2 autonomy. The agent acts without being asked.

# the cron you always wanted
> reminder(fire_in_seconds=3600, message="check if build went green")
> reminder(recurring="daily|14:00", job_type="agent", prompt="run release checklist")
> reminder(cron="0 9 * * MON-FRI", bash_command="smartopol backup")
> sessions_spawn(scope="research", tools=["web_search","web_fetch"], prompt="...")

reminders

One-shot, recurring, or cron. With an optional bash_command payload — real server-side side effects. With job_type=agent — tomorrow at 9, check the PR, summarize.

sub-agents

Spawn filtered-capability sub-agents for isolated work. They share Memory Pyramid but have their own tool set and context budget. Idempotency-protected — long jobs cannot be double-triggered.
§ 05 · skills

Drop a Markdown file. The agent picks it up on the next turn.

No restart. No rebuild. Hot-reloadable capabilities, one directory, auditable.

# ~/.smartopol/skills/
1password/ obsidian/ trello/ whisper/ github/
apple-notes/ notion/ discord-api/ tts-sherpa/ gh-issues/
slack-skill/ telegram-api/ himalaya-mail/ image-gen/ healthcheck/
gemini/ spotify/ weather/ sonos-cli/ tmux/
goplaces/ canvas/ blogwatcher/ ...

Evergreen-skill protection. Critical skills are marked evergreen: true in frontmatter. The skill_uninstall tool architecturally cannot delete them — memory-injection trying to erase the agent's own capabilities fails.

§ 06 · plugins

Plugins. Any language. Typed. Signed. Sandboxed.

plugin package
       │
       ▼
load  →  ABI check  →  capability manifest check
       │
       ▼
isolated runtime: CPU + memory limits · no ambient network or filesystem
       │
       ▼
host  ◄──  typed interface  ──►  plugin (auditable)

typed capability manifest

Plugins declare provider | channel | tool | hook | command in their manifest. Typos become load-time errors, not runtime surprises.

OS-level sandbox

OS-enforced isolation on Linux and macOS. No ambient network. No ambient filesystem. The plugin can only touch what it declared upfront.

Signed releases only

Third-party plugins ship cryptographically signed. A tampered package won't load. Unsigned local builds are allowed if you're the developer.

static plugin analyzer

~60 dangerous-pattern regex set scans every plugin at install. Flags eval, unchecked deserialization, network I/O from sandboxed contexts, filesystem escapes.
▸ building on top · the SDK expands with you

Building a plugin? Something missing? Tell us.

Plugins can be anything the SDK exposes — a channel, a provider adapter, a tool, a command, a background hook. They can be free, open-source, or commercial. If you want to sell your plugin — two euros a month, two hundred a year, whatever your market will bear — that's your business. We don't take a cut, we don't run a marketplace, we don't rank listings.

The SDK is typed: a plugin can only do things the host has explicitly exposed through the capability manifest. If you're building something and the capability you need isn't in the current SDK — a new hook, a new system call, a new plugin-to-host channel — email us with what you're building and what you're missing. If it isn't a security footgun, we add it to the next release. Your plugin becomes possible, the SDK grows, and the next developer who needs the same thing finds it already there.

Shipping against a moving SDK is a real risk for a solo plugin author. We know. This is how we shrink it.

what's yours
pricing · distribution · users · branding · support
what's ours
host runtime · security model · signing key infra · SDK versioning
how to ask
short email. "Building X, need Y, here's the shape." Reply in days, not weeks.
Request an SDK capability
§ 07 · providers

Your agent isn't anyone's hostage.

Most AI products pick one model vendor and build everything on that single bet. When the vendor raises prices, deprecates a model, changes terms of service, or has a bad week — every product built on them pays the tax. Smartopol is vendor-agnostic on purpose. Eight native integrations plus protocol shims for everything that speaks OpenAI or Anthropic. The model is a choice you can change today and again next month; the agent doesn't notice. Insurance, not inventory.

▸ prefix cache · cached forever

Your tokens, respected.

Big AI models charge per token. Most agents re-send your entire history on every turn — you pay for the same context over and over. Smartopol freezes the system prompt and stable memory once per session and pins it to the provider's prefix cache.

Cached tokens bill at the provider's discounted tier — typically 10% of the normal rate. On long conversations, the cache hit rate climbs past 85%. End result: roughly half the token spend of a naive agent, for the same work. You never see the savings in the UI. Your monthly bill does.

cache hit (long sessions)
~85%
cached-token price
~10%
net spend vs. naive
~50%
▸ native integrations · 8 hand-written adapters
cloud · frontier
  • Anthropic · Claude family · streaming + tool calls
  • OpenAI · GPT family · native adapter
  • Google Vertex AI · Gemini via GCP
  • AWS Bedrock · Anthropic + others through Amazon
  • GitHub Copilot · via Copilot API
  • Qwen (OAuth) · long-context, sign-in flow
local · your hardware
  • Ollama · any local model — DeepSeek, GLM, Qwen, Kimi, MiniMax, Gemma
  • Claude Code CLI · re-uses the Claude Code already on your machine

Local means local. No data leaves the machine. Your Ollama models never call home, never see a vendor endpoint, never touch the internet.

▸ claude code cli · the right way to use your claude pro / max

Use the Claude subscription you already have — without breaking Anthropic's rules.

If you already pay for Claude Pro or Claude Max, you probably wish you could point it at your agent and let it do work in the background. Anthropic explicitly does not allow subscription tokens to be used by third-party apps — which is why every agent that tries it either scrapes, breaks Terms of Service, or eats your pay-per-use API budget without telling you.

Smartopol takes the approved path. When you select the Claude Code provider, Smartopol drives the claude CLI that's already installed on your machine — the same CLI you use interactively, authenticated the same way. Whether your Claude Code is on Pro, Max, or pay-per-use API — that's your business. Smartopol just asks it to run a task and reads back the answer.

your subscription
Uses whatever plan you're on. Your seat, your quota, your rules.
terms-compliant
We talk to the CLI, not to subscription tokens. Fully in line with Anthropic's policy.
honest tradeoff
Slower than a direct API call. But no mystery bill, no ToS violation, no broken morning.

Most self-hosted agents don't offer this at all — they demand a raw API key and charge your card per token. Smartopol lets you use the Claude seat you're already paying for, through the door Anthropic left open. Nobody else does this because nobody else wanted to read the fine print.

▸ agent mesh · early preview

When Claude Code is already running, they can talk directly.

If you keep a Claude Code session open on the same machine — and many of us do, all day — Smartopol can reach it through a local mesh channel. Your Smartopol agent sends a request straight to the Claude Code session; the session answers; Smartopol reads the reply and keeps working. Two co-located AI agents, the same hardware, handing off tasks in milliseconds instead of round-tripping through the network.

Status: in active development. First handoffs are working on our dev machines today. We'll expand this as the mesh protocol stabilizes — but you can watch it behave in beta.

▸ compatibility shims · add any compatible endpoint in config, no rebuild
▸ anthropic-compatible

Point the Anthropic adapter at any endpoint that speaks the Messages API.

  • Z.AI GLM-4.5 (native Anthropic mode)
  • OpenRouter Anthropic proxy
  • any Messages-API proxy you run

Most competitors ship only OpenAI-compat. Having Anthropic-compat too means any Claude-compatible service plugs in the same day it launches.

▸ openai-compatible

Point the OpenAI adapter at any endpoint that speaks Chat Completions.

  • Groq · Cerebras · DeepSeek
  • Mistral · Minimax · xAI
  • Together · Fireworks · Perplexity
  • LocalAI · vLLM · SGLang
  • any Chat-Completions endpoint

Per-session model override. /model [name] in the REPL. Or in config. Or per-channel. Or per-sub-agent. Shared conversation history across providers — a fallback is transparent to the model.

▸ resilience · doesn't live in someone else's cloud

Built for the day the cloud breaks.

Every SaaS agent is one pricing page, one terms update, one model sunset away from a bad week for its users. That's the deal you sign when you rent your agent from someone else's cloud.

Smartopol runs on your machine. Your keys, your memory, your prompts — all local. If a provider doubles their price tomorrow, switch to another. If they deprecate the model you liked, fall back to the one running on your laptop. If they change their terms and start training on your conversations, you already turned them off. We don't promise nothing will ever change in the model world. We promise your agent won't.

survives
API deprecations · pricing changes · model sunsets · TOS updates · regional restrictions · account suspensions
doesn't need
credit card on file · cloud account · SSO · someone else's uptime SLA · a vendor's good quarter
§ 08 · security

Safer by default.

Threat model: the adversary has access to your memory. Everything flows from that.

▸ secrets vault

Your keys. Sealed. Not even the agent sees them unless it needs to.

API keys. OAuth tokens. Database passwords. Ways into your cloud. Most AI agents put them in a plain-text config file or an environment variable where any process on the machine can read them. That's how "my AI assistant leaked my keys" becomes a Hacker News post.

Smartopol ships an encrypted vault, sealed with a master password only you know. You never paste an API key into config again.

XChaCha20-Poly1305
industry-grade authenticated encryption · nothing home-brewed
Argon2id key derivation
tuned memory + iterations · defeats GPU brute-force
HMAC-SHA256 envelope
you know if the vault file was tampered with
Sandbox-blocked file
no tool, no plugin, no WASM capsule can read ~/.smartopol/vault.bin; the static analyzer flags any script that tries as Critical

In your config, you write anthropic_api_key = "vault:my_anthropic" — no plaintext keys anywhere on disk. The agent requests the secret; the vault answers; the value lives in memory only for the tool call that needs it, then it's gone.

$ smartopol vault init # create vault, set master password
$ smartopol vault set anthropic_api_key # prompts for value, never echoes
$ smartopol vault list # names only, never values
$ smartopol vault rekey # change master password
$ smartopol vault import # migrate plaintext config secrets into vault
§ 09 · multi-user

This is a family or team server. Not a personal script.

RBAC — 9 permission types

admin, user, child, guest variants + tool-scope grants. Per-user memory isolation — user A cannot recall user B's conversations. Architectural, not just policy.

Per-user rate limits

Per-user, rolling-window limits. Admin accounts get ample headroom. Guests start with zero tool calls. Fair sharing without freezing the service.

Per-user provider

Different family members, different models. Parent uses a hosted model; kid uses a local one. All from the same running agent.

Per-user persona

Different identities per user without spawning separate processes. One agent wears the right face for each person.

Crash-isolated sessions

Each user's session is its own worker with its own mailbox. If a tool hangs or a plugin misbehaves for one person, the others don't even notice. No cascade failures, no freeze, no restart.

Live session inspector

smartopol sessions list shows every active session — queue depth, last activity, crash count. Kill one with sessions kill; the rest keep running.
§ 10 · infra

Operator-grade. Not a weekend project.

capabilitybehavior
Self-updatesmartopol update — signed release · verify · atomic binary swap · resume mid-conversation
Hot-reload configsmartopol reload — applies smartopol.toml changes and new skills without restart
Health endpoints/health, /status, /providers, /sessions, /telemetry
Metricsp50/p95/p99 per provider · latency histograms · rate-limit counters
Backup / restoresmartopol backup.tar.zst of the entire data directory
MCP bridgeexpose Smartopol's memory + knowledge as an MCP server to Claude Code, Cursor, any MCP client
External MCPmount external MCP servers as Smartopol tools
§ 11 · observability

Nothing silent. Everything on record.

§ 12 · dev tooling

Every command you would expect. A few you wouldn't.

# day-to-day
$ smartopol repl # interactive chat with your agent
$ smartopol chat "..." # one-shot for scripts and pipes
$ smartopol status # uptime · bind · provider health · sessions
$ smartopol config # realpath · opens in $EDITOR with -e
# introspection
$ smartopol tools # every callable tool, one-line descriptions
$ smartopol skills # list · install · remove · patch · inspect
$ smartopol agents # running agents and their capabilities
$ smartopol sessions # list · inspect · kill per-user sessions
$ smartopol providers # configured models, priority, health
# security & ops
$ smartopol vault # encrypted secrets (init · set · get · list · rekey)
$ smartopol audit verify # walk the audit chain, find the first break
$ smartopol backup # tar.zst of the whole data directory
$ smartopol update # self-update · signed release · atomic swap
$ smartopol reload # apply config + skill changes without restart
# integrations
$ smartopol mcp # manage external MCP servers you mount
$ smartopol mcp-bridge # expose Smartopol as MCP to Claude Code / Cursor
# receipts
$ smartopol bench # run the published benchmarks yourself

Reproducible proofs, not trust-us. Every performance claim on this page — recall latency, cache hit rate, memory footprint, ingest throughput — comes with a command that measures it on your machine. smartopol bench runs the full suite. The numbers in our docs are the numbers your hardware produces. No benchmark theater.

§ 13 · regulated contexts

Ready for the question "where does the data go?"

If your workplace is bound by HIPAA, GDPR, the EU AI Act, FINRA, or an internal compliance team — Smartopol answers the questions a SaaS agent can't.

▸ architecture, not certification

The whole thing runs on your hardware. No cross-border data transfer. No third-party subprocessor list. No "we retain prompts for 30 days for abuse monitoring." Every agent action writes to a local audit log you can export. Prompts and responses are saved locally in a documented format.

We don't claim certifications we haven't earned. We claim the architecture was designed for the questions your compliance team is going to ask.

▸ what your reviewer will find
  • ▸ data at rest: local disk only
  • ▸ data in transit: only to the provider you configured
  • ▸ subprocessors: none by default
  • ▸ audit log: every action, timestamped, exportable
  • ▸ source review: available under NDA
  • ▸ data residency: wherever your machine is

Designed for: healthcare IT · legal research · financial services · public sector · research groups · anywhere "data stays on our machines" is a hard requirement.

Request a compliance brief Request source review under NDA
§ honesty

What we haven't shipped yet.

Roadmap, not spin.

If one of these is a blocker for you, email me. Prioritization follows customer signal.

Ready to join the private beta?

Invitations go out in waves. Each invited user gets a personal install link weeks before the public launch.

No newsletter. No nurture sequence. Just the invite.