intendant.devalpha

Give an AI agent a full machine — under your oversight

Intendant is an open-source operating environment for autonomous AI agents: a shell, files, a display it can see and control, voice, and phone calls — with layered human supervision. It runs its own agent loop, supervises Codex and Claude Code as managed backends, and is portable across OpenAI, Anthropic, and Gemini. The agent's machine can run macOS, Linux, or Windows. Route discovery needs only this browser tab; control uses local presence or a browser enrolled for independently verified direct mTLS by a trusted daemon owner. No signed/notarized native release exists for this alpha.

Open Connect Install a daemon

Stand up a daemon in about ninety seconds

Four answers about the machine the agent will live on, and the exact command appears. You can discover it from your phone without a separate app; controlling the daemon still requires trusted certificate or profile enrollment.

OS on the agent's machine?
What kind of machine?
What will fuel it?
Keep working with your browser closed?
fresh box — sh 
$ curl -fsSL https://intendant.dev/install.sh | sh -s -- --service

    1Install One command installs the daemon. Code served here is part of the installer trust boundary.
    2Link Enter its twelve-word one-time claim code to add the route to your account. This grants no access.
    3Establish owner Use the machine's local console or independently verified direct mTLS to establish root outside hosted-origin JavaScript. No signed/notarized native release exists for this alpha.
    4Fuel Configure credentials from a trusted daemon surface. Connect implements blind account-vault storage but serves no vault client or daemon-delivery bridge in this build.

    New here? Sign in to link the route for discovery. The link does not create a daemon principal or grant; establish access from a trusted local or independently verified direct-mTLS surface. This hosted build remains discovery-only.

    atlas — Intendant dashboard
    The Intendant dashboard's Activity feed: an agent diagnoses a failing nightly job with an auto-approved tail command, proposes a one-line diff to jobs/rollup.py, waits for an approval-gated backfill run, and reports the verified result.

    The Activity feed on an authorized daemon: autonomy is a dial, approvals are explicit, and every command, diff, and decision is logged and replayable.

    The desktop

    A real desktop, watched

    The agent gets a display it can see and drive — a browser, a terminal, whatever the task needs — and you watch it stream live over WebRTC. Input stays yours to share: take control at any moment, annotate what you see, record what happened.

    The dashboard's Video tab streaming a live agent desktop over WebRTC: a browser and a terminal scrolling a build, with view-only, annotate, record, and take-control affordances.
    Watching atlas's display, live — view-only until you hand input over.
    Mission control

    Every agent, one canvas

    Station renders the whole machine live — sessions, approvals, context budgets, changes, and worktrees orbiting one WebGPU canvas. The same daemon is operable from the CLI and MCP, and a glance away from your phone in an enrolled browser.

    The Station tab: a radar-style WebGPU control room showing live nodes for peers, sessions, activity, context, changes, view, controls, and worktrees.
    Station — the fleet and every session's state, rendered live.
    Credential custody

    Custody machinery, with a boundary

    Intendant implements sealed vault storage, time-boxed leases, and client egress for authorized control sessions. The Connect account-vault backend and a daemon's own vault are separate today. This directory does not serve the vault client or crypto worker and has no daemon-control channel, so it cannot create or unseal account entries, grant a lease, or relay a provider call. Use a trusted direct client for those mechanisms, or use the daemon's local credential configuration.

    trusted client daemon-store vault → authorized lease or relay → daemon workload
    Connect tab account-vault API/storage only (no shipped client or daemon bridge)
    The trusted daemon dashboard's credential vault panel, showing masked entries and time-boxed lease controls.
    Shown on an authorized daemon surface; Connect cannot invoke these controls.
    Arrival

    Link a machine with twelve words

    Start the daemon anywhere and it prints a one-time claim code. Enter it here to link the route to your account for discovery. The link changes no daemon IAM and grants no machine access; ownership starts only from a trusted local or independently verified direct-mTLS surface.

    Intendant Connect: a linked computer named atlas shown online with uptime history, next to the add-a-computer flow that accepts a twelve-word one-time claim code.
    atlas, discoverable seconds after its one-time code was entered.
    The client

    Zero-install discovery; trusted enrollment for control

    Link and discover a daemon from this browser tab without client software. To approve a diff, watch the live desktop, or run mission control, use local loopback access or first enroll that browser for independently verified direct mTLS from a trusted owner surface. After enrollment the dashboard remains browser-based and carries only the authority that daemon granted to the authenticated principal. Installing a client certificate or profile is a real enrollment step, not a zero-install claim.

    The same Intendant session on a phone: the Activity feed showing the agent's diff, an approval-gated backfill command, and the verified result — driven entirely from a mobile browser.
    The rollup fix from above — same session, held in one hand.

    What's in the box

    Bring your own agent

    Codex and Claude Code run as managed backends — under the same oversight, autonomy dial, and session logging as the native agent loop.

    Your keys stay yours

    Sealed vaults, expiring API-key leases, and client egress are available on authorized daemon sessions. Connect can store an opaque account-vault envelope, but this directory serves neither its vault client nor a path that could deliver it to a daemon. Local .env credentials remain supported, and full-credential OAuth leases temporarily materialize private auth files.

    Multiple trusted interfaces

    Use the web dashboard for visual control, CLI or MCP for automation, and live voice or phone for conversation. A remote browser enrolled for direct mTLS by a trusted owner runs the web client there, phone included, without a separate app install; that remote browser still needs certificate or profile enrollment.

    A fleet, not a box

    Daemons federate: shared displays, cross-machine sessions, and organization-signed access — all enforced locally by each daemon's own IAM, never by this service.

    Why “Intendant”

    In a theater, performers play and conductors orchestrate — the Intendant runs the house: who gets the stage, which productions run, on whose authority, with the books open. Here agents perform, orchestrators conduct (Codex and Claude Code as guest conductors), and the Intendant runs the house and answers to you — houses federate, companies tour on signed contracts, house rules always win: a network of agentic networks.

    Built to be distrusted

    The daemon is the authority mint

    Connect is trusted for the code and installers it serves, availability, accounts, routes, fleet metadata, and optional push delivery. Its rendezvous protocol cannot mint a daemon grant, but a replaced installer can compromise what it installs, and malicious hosted code can misuse Connect account or decrypted browser state available after a gesture. You can read exactly what it can and cannot do, or run your own.

    The sandbox never holds keys

    Inside each daemon, the sandboxed process that executes commands never sees an API key, and the process that talks to model providers never executes commands. A hijacked conversation can't steal credentials; a hijacked shell can't phone home through the model — by construction, not by policy.