The only AI agent that doesn't trust its own tools.

A secure, self-hosted personal AI agent framework with 30+ integrations. Every tool runs in its own Docker container. Every action passes through a Guardian safety pipeline. You stay in control.

Get Started View on GitHub
MIT License GitHub Stars

Built for paranoid people (like us)

🐳

Per-Tool Docker Isolation

Every tool runs in its own ephemeral container. No shared filesystems. No ambient authority. A compromised tool can't touch anything else.

🛡️

Guardian Safety Pipeline

Four layers of defense: DeBERTa classifier for fast screening, LLM judge for nuanced review, YAML policy enforcement, and coherence checking. All before any tool executes.

🍎

macOS Host Bridge

Native integration with macOS apps — Calendar, Reminders, Finder, and more — through a secure host bridge. Your agent lives on your Mac, not in the cloud.

📄

YAML-Driven Tools

Define tools in simple YAML. Specify the container image, permissions, arguments, and safety constraints. No code required to add capabilities.

💬

Multi-Channel Messaging

Communicate via iMessage, Telegram, WhatsApp, BlueBubbles, or webhooks. Plugin-based channel architecture makes it easy to add new integrations.

⏰

Cron & Daemon Mode

Schedule recurring tasks with cron, run as a background daemon with a full REST API, or manage everything from the built-in web dashboard.

🤖

Sub-Agents

Delegate complex work to specialized sub-agents that run in parallel. Each sub-agent has its own context and tool access, coordinated by the main agent loop.

🔌

30+ Integrations

Google Workspace, GitHub, Notion, Apple Notes & Reminders, Things 3, Brave Search, browser automation, clipboard, text-to-speech, shell execution, and more — all containerized.

How it works

You
→
Agent Core LLM reasoning
→
Guardian 4-layer safety
→
Tool Containers Docker isolation
Guardian Pipeline
  1. Fast DeBERTa classifier — instant risk scoring
  2. Deep LLM judge — contextual safety review
  3. Policy YAML rules — your explicit constraints
  4. Check Coherence — does the action match intent?

Up and running in 60 seconds

Terminal 
# Install prerequisites
$ brew install pyenv uv age

# Clone and set up
$ git clone https://github.com/Creel-ai/creel.git
$ cd creel
$ pyenv install 3.12.11
$ uv venv && source .venv/bin/activate
$ uv pip install -e ".[dev]"

# Initialize (interactive wizard)
$ creel init

# Start the daemon
$ creel daemon start

🧺 Creel daemon running. Tools loaded: 32. Guardian: active.

# Or run a task directly
$ creel run morning-briefing