A secure open-source AI agent. Secure by architecture, boring by process, capped by default — the spend limits, the vault, and the approvals live in a control plane the agent itself cannot reach.
GUS on GitHubInstall guide
Updates that break the install. Runaway bills with no ceiling. Credentials sitting inside the model's context. Safety instructions silently dropped when the conversation is compacted. GUS is split in two so none of that happens quietly: the agent loop runs in a sandboxed container with no network and no secrets, and everything that keeps it honest — the spend Governor, the credential Vault, the Approval Engine, the Updater — runs in a separate control plane the agent cannot reach.
In February 2026, an agent whose “confirm before acting” instruction was compacted away bulk-deleted more than 200 emails while ignoring stop commands. In GUS, the approval requirement is not an instruction in the conversation — it is a property of the tool layer. The Yue drill proves it still holds after compaction and restarts, against a model that insists. And the kill switch — in the panel, or /stop from your phone — halts everything until you say otherwise.
Each promise is a mechanism, and each mechanism is proved by a named, runnable test in the repository's Promise Suite. If a change ever requires loosening one of those tests, the release does not ship.
The agent loop runs isolated — no network, no secrets — while the Governor, Vault, and Approval Engine run outside its reach. The secret-guard gate holds from the first drill on.
A credential red-team went hunting for a planted canary secret through every path the agent has. The canary surfaced nowhere — credentials are used in flight, never read.
The runaway-cap drill settles at $0.484 of a $0.50 cap; the Yue drill keeps approvals binding after the instruction that asked for them is compacted away.
A deliberately bad update is staged, replayed against recorded automations, caught, and rolled back automatically — the working version is never replaced by a broken one, and data never rolls back.
Tool calls, skill installs, and MCP connections are scanned and receipted before they happen; a “do not install” verdict has no override.
A new operator goes from install to a first verified job in five actions in the panel wizard — no terminal, no config files, starter caps accepted or changed in one step.
Pick the model service in the setup wizard. Keys are entered in the panel and go straight into the encrypted vault — never into a chat — and every call is priced by the Governor against your caps.
A free Google AI Studio key is enough to begin. One honest catch: on Google's free tier, Google may use what you send to improve its models — a paid Gemini key removes that.
Point GUS at any OpenAI-compatible endpoint with your own key — Anthropic, OpenAI, or your own gateway — under the same caps and receipts.
Run a model on your own machine. Nothing leaves your hardware, and the same Governor, vault, and approvals apply.
Capabilities reach GUS through Gateways — governed connections that execute in the control plane, under the same approvals, caps, and receipts as everything else. Gmail is the first Gateway; Calendar is a separate, later one.
Setup is one short guided step: a Google OAuth credential stored in the vault under your control, revocable in one click from either side. The token never enters the agent's context.
You need a computer that stays on — a home machine or a small rented server is plenty; GUS is built to fit in 1 GB of memory — and Docker installed. One compose command starts both halves. After that, the five-step panel wizard takes over: connect the Shield, add Telegram for approvals in your pocket, pick a provider, accept or change the starter caps, and run your first job to its signed receipt.
What GUS does not do — published in the same place as what it does.
The container drills to date ran the same OCI images via podman instead of a Docker daemon, and the Shield-gate drill replays responses captured from the live Agent-Shield API (the receipts earned are real, and were verified live). A re-run on a stock Docker host is scheduled and retires both caveats.
In v1, third-party skills are scanner-gated and stored, but GUS does not yet run third-party skill code. The built-in job types are the working surface, and safety is never the upsell — everything on this page ships in the open-source core.
A signed receipt proves a scan happened, what it covered, and what it found — “no known-bad patterns detected.” It is not a guarantee that content is safe, and GUS never markets the gate as one.
GUS sends nothing home by default; the one anonymous install heartbeat is opt-in and off unless you turn it on. “GUS” is a working name pending formal trademark clearance.