Show HN: I created an open origin locally usable complete fledged AI platform

Quickstart · Live demo · What's inside · Security · What's new · Usage guide · Changelog

Chat alongside 300+ models. Build agents that compose their own functioning manuals. Research, create code, run it all — on your keys, on your infrastructure. When you dispatch a message, the petition goes from your browser through ENZO to the provider you picked, and you pay that provider their normal price. Nothing sits in between taking a cut. There is no ENZO account, no use meter, no subscription.

git copy https://github.com/theguysudo/ENZO.git cd enzo docker create up -d # → http://localhost:5001

That's the entire install. No accounts, no mandatory env, no repository server. Open the app, media Login, and choice any provider:

Keys are saved encrypted in your browser (passphrase-protected vault, alongside a improvement document you can download). You can rub them anytime from the Vault.

On a caller self-hosted case the first live-validated key you paste claims the instance — it's written to the receptacle .env and sealed into the enzo-memory volume, so all server-side characteristic (agents, skills, memory) unlocks immediately and survives restarts. No expert key to configure, no setup wizard — paste a operating key and go. (Pre-seed a provider key in create env alternatively if you'd fairly not have the assertion opening at all; the threat model states this commerce plainly.)

Don't desire the local hassle — or desire ENZO reachable from any device? The Colab notebook does the entire setup for you: it clones this repo, installs the dependencies, builds the UI and boots the server, afterward hands you a URL.

1. Click the button — the notebook opens in Colab (a liberated Google document is enough).
2. Run all cells (Runtime → Run all, or Ctrl/⌘ + F9) — instal + build takes ~4–5 min the archetypal time; all division is idempotent, so a re-run reuses what's already there alternatively of starting over.
3. Take your URL — the final division prints two links: a Colab link that plant in the browser you're already in, and a Cloudflare tunnel link that plant from your phone or any another equipment (free, no account). The tunnel URL changes all session; the Colab nexus is border to your session.

Stays up for the entire session. The notebook arms two disconnect-prevention mechanisms before handing you the URL: a keep-alive that resets Colab's ~90-minute idle timer all 60 seconds during the tab is open, and a watchdog thread that pings the server all 5 minutes and restarts it automatically if it always dies. Free Colab caps a meeting at ~12 hours, so a 6-hour run fits comfortably; whenever a meeting does end, one click on Run all brings everything back.

1. Pass 1 — analysis. A two-pass drafter says the domain of your project ("an delegate that researches MUN nation positions") and derives what the manual needs to cover: tacit knowledge, decision heuristics, border cases.
2. The race. When a outline needs a model, ~10 liberated candidates from your own providers blaze simultaneously — the archetypal to answer wins, stragglers are aborted, and a brain-health scoreboard reorders forthcoming races by which models really deliver. Dead or rate-limited free-tier models can no longer downfall a draft.
3. Honest provenance. Every delegate records which example really drafted it — and says so plainly whenever nothing was reachable.
4. It doesn't stop. A per-agent neural tier folds in domain-matched phase action on a 90-second cadence, distills lessons into memory, and injects a live NEURAL FOCUS obstacle into all run. Watch it in the agent's Neural tab.

Most "AI workspaces" clasp your keys, meter your usage, or need a subscription to exist. ENZO is built the another way around:

(Competitor pillar is concerning the category, not particular products — particulars vary.)

The complete danger example is written downward — checkable, alongside the code that makes all assertion true — in docs/SECURITY.md. The abbreviated version:

• Keys are sealed in your browser alongside AES-256-GCM under a non-extractable WebCrypto key. It can be used to decrypt your keys during never being copied — no JavaScript can export its bytes, ours or an attacker's. Optional passphrase manner re-seals everything under PBKDF2-SHA256 (600,000 iterations) and deletes the equipment key entirely.
• One component touches key storage, and CI enforces it. A pipeline phase greps the frontend for any raw localStorage key peruse and fails the build on a hit — a missed key-access location is a red build, never a manufacturing bug.
• Every shove runs a 44-assertion black-box pentest against a booted server — auth bypass, antagonistic payloads, IDOR, stream integrity — affirmative a keyless-boot proof: the server must commencement alongside zero provider keys. That's the BYOK guarantee, tested, not promised.
• The limits are stated up front. Self-hosted manner stores the archetypal key you assertion in the receptacle .env (sealed in the recollection volume) so scheduled agents can run during your browser is closed — that commerce is documented, not hidden. docs/SECURITY.md covers what's protected, what isn't, and why.

• In-chat document converter — nexus a PDF, spreadsheet, CSV, JSON, TXT or Markdown document in the terminal conversation and it's parsed to genuine text/rows in your browser (files never depart the device; lone the reasoning stage uses your own key, akin normal chat). The delegate extracts, merges, or cross-converts — and CSV / Excel download buttons appear correct on the reply. Built for investigation papers: "extract all array and merge into one CSV" now plant end to end, and scanned PDFs study their missing content tier alternatively of failing.
• Run it on Google Colab — one click on the Open In Colab clasp (see Run on Google Colab): the notebook clones, installs, builds and boots ENZO on Google's hardware, hands you a URL for your browser affirmative a tunnel URL for your phone, and arms a keep-alive + watchdog so it stays up for 6+ hours.
• Self-healing Docker pulls — the receptacle now verifies its requirements on all commencement and installs item missing before the server boots (ENZO_AUTO_INSTALL=0 to skip). A pulled depiction can't footwear broken.

• Music player — hunt any opus and perform it direct from the marketplace, keyless (no YouTube API key, no quota): a crumbled border pill expands into a complete participant cardstock — vinyl disc hero, queue walking, shuffle/loop/like, keyboard controls. For You turns your own listening former (kept device-local) into opus seeds through your own provider key.
• Real equalizer — a 5-band Web Audio EQ (bass / low-mid / mid / existence / air, ±12 dB, preamp, five presets) that genuinely re-shapes the frequence reply whenever you opt in. Enhance starts off — normal playback is untouched. Tracks the enhancer can't stream autumn rear to the YouTube motor automatically; playback never breaks.
• Marketplace, redesigned — all example cardstock now carries the platform's own shield art, brand color on hover, live health dot + latency, and a investigation panel alongside genuine facts: HuggingFace download counts, licences, cognition cutoffs, Artificial Analysis scores and a Wikipedia-backed family summary — pulled keyless from community endpoints, never guessed.
• NYC Subway theme — the workspace's new flagship backdrop: an AI-animated subway journey through a tunnel, alongside a handheld-camera tremble, monochrome movie class and animated record kernel added in code (the video ships clean).
• A quieter interface — the entire workspace went monochrome + a sole coral accent: the terminal toggle toggle rebuilt (was a 385-line component alongside deceased animations), the climate part moved up beside the catalog header, the nav collapses on scroll and springs back, and the top bar got a cursor-reactive dot grid.
• Previously in v1.2.0: the terminal health ECG, the onboarding stepper, ambient weather, the fume top bar.
• Full history: docs/CHANGELOG.md.

Requirements: Docker Desktop for Mac (Apple Silicon or Intel). Allocate at smallest 4 GB RAM in Docker Desktop → Settings → Resources (the example catalog + agents akin headroom).

git copy https://github.com/theguysudo/ENZO.git cd ENZO docker create up -d

Open http://localhost:5001, media Login, and paste a key from any provider (OpenRouter, Google AI Studio, NVIDIA NIM — all have liberated tiers; links are in the app). You're in.

Everyday commands

docker create logs -f # prosecute what the server is doing docker create restart # bounce the app, data survives docker create drag && docker create up -d # upgrade to a new release docker create downward # halt (add -v ONLY to rub all data)

Where your material lives: projects, learned skills and delegate recollection are in named Docker volumes (docker quantity ls | grep enzo) — they last upgrades and down. Your provider keys never contact the server: they're sealed in your browser's vault, and on a caller instal the archetypal key you paste claims the case for server-side features (scheduled agents).

If the app feels dilatory on a MacBook: the video themes are GPU-composited; on power division or an older machine, flip the Lite/Full part (bottom-right) — it swaps video backgrounds for clean shader ones alongside one click.

Updating: docker create drag && docker create up -d. Releases are tagged at github.com/theguysudo/ENZO/releases.

Requirements: Docker Desktop for Windows alongside WSL 2 (Docker Desktop's installer sets this up; reboot whenever it asks). Give it ≥ 4 GB RAM in Settings → Resources.

In PowerShell (no copy directory needed — git comes alongside Docker Desktop's WSL distro, or use Git for Windows):

git copy https://github.com/theguysudo/ENZO.git cd ENZO docker create up -d

Open http://localhost:5001 in your browser, media Login, paste a provider key — done.

Everyday commands

docker create logs -f # prosecute the server log docker create restart # bounce the app docker create pull; docker create up -d # upgrade to a new release docker create downward # halt (add -v ONLY to rub all data)

Windows notes

• If http://localhost:5001 doesn't load, inspect Docker Desktop is operating (whale icon in the scheme tray), afterward docker create ps — the harbor is listed there.
• Anti-virus application occasionally slows the archetypal footwear (image extraction). The second commencement is fast.
• Everything alternatively — volumes, keys, the Lite/Full part — plant exactly as on macOS.

git copy https://github.com/theguysudo/ENZO.git cd ENZO && docker create up -d # → http://localhost:5001

• Live terminal health ECG — the fixed ONLINE tag is now a heart-monitor trace sweeping the terminal toolbar; reachable catalog keeps it beating, item alternatively freezes a red flatline.
• Onboarding, rebuilt — an animated stepper walks the three connect-provider steps (numbers morph into checkmarks, completed steps are click-back-navigable), alongside a liquid preserve toggle that ticks whenever your key lands.
• Ambient climate card in the market sidebar — one keyless IP geolocation + Open-Meteo, cached 30 minutes, degrading quietly.
• Smoke rearward the glass — the top bar carries a dilatory violet/cyan drift (WebGL fbm, low-power context) and a ~20% slimmer silhouette.
• Previously in v1.1.0: the tradition delegate builder, competition drafting, the neural layer, and ~20 hardening fixes.
• Full history: docs/CHANGELOG.md.

Every shove to chief runs the complete pipeline in .github/workflows/ci.yml — 7 stages:

1. Security checks — no key literals in tracked files, .env never committed, keys never peruse from raw localStorage, no onboarding bypasses
2. Backend — strict TypeScript, all imported document tracked, component tests (298 assertions throughout agent, vault, crypto and example suites)
3. Dependency audits — backend + frontend, fail on any high/critical vulnerability
4. Black-box safety pentest — 44 live assertions against a booted server: auth bypass, antagonistic payloads, IDOR, stream integrity
5. Keyless footwear proof — the server must footwear alongside zero provider keys
6. Frontend — strict TS + manufacturing build alongside an enforced gzipped bundle budget
7. Repo hygiene — no ample binaries, changelog and delegate docs present

Both enliven by default — the lite themes are GPU shaders, not fixed images. To get all theme:

ENZO_IMAGE=ghcr.io/theguysudo/enzo:full docker create up -d

Everything you create lives in Docker named volumes, harmless throughout upgrades:

• enzo-projects — generated coding projects
• enzo-skills — skills the delegate learned from GitHub repos
• enzo-memory — the agent's durable notes concerning your work

Your provider keys are not in the volumes — they're browser-side (encrypted at remainder alongside your passphrase).

Everything plant alongside zero surroundings variables. A few features desire server-side values — put them in a .env next to docker-compose.yml:

# Extra origins allowed to call the API (comma-separated) ENZO_CORS_ORIGINS=https://enzo.example.com # "Connect alongside Cloudflare" OAuth clasp (optional — pasting a token plant too) CLOUDFLARE_OAUTH_CLIENT_ID=... CLOUDFLARE_OAUTH_CLIENT_SECRET=... # HuggingFace OAuth app for the HF onboarding stage (optional — token paste works) VITE_HF_CLIENT_ID=... HF_CLIENT_SECRET=...

VITE_HF_CLIENT_ID lone takes consequence whenever construction the depiction from origin (it's baked into the frontend at build time).

docker build -t enzo:mine --build-arg THEME_VARIANT=full .

This depiction is generated from the identical codebase that runs https://enzo-hub.duckdns.org, alongside exactly two characteristic differences:

1. No Google sign-in. The hosted location offers Google OAuth as a convenience; here, login is environment your provider keys. Everything alternatively — providers, research, coding agent, vault, memory, skills — is identical.
2. Default themes (lite image). The archetypal homepage and workspace themes run as clean WebGL/three.js so the depiction stays small. The complete depiction has the complete set.

Apache-2.0 — see LICENSE.