The only AI agent that doesn't trust its own tools.

A secure, self-hosted personal AI agent framework. Every tool runs in its own Docker container. Every action passes through a Guardian safety pipeline. You stay in control.

Get Started View on GitHub
MIT License GitHub Stars

Built for paranoid people (like us)

🐳

Per-Tool Docker Isolation

Every tool runs in its own ephemeral container. No shared filesystems. No ambient authority. A compromised tool can't touch anything else.

🛡️

Guardian Safety Pipeline

Four layers of defense: DeBERTa classifier for fast screening, LLM judge for nuanced review, YAML policy enforcement, and coherence checking. All before any tool executes.

🍎

macOS Host Bridge

Native integration with macOS apps — Calendar, Reminders, Finder, and more — through a secure host bridge. Your agent lives on your Mac, not in the cloud.

📄

YAML-Driven Tools

Define tools in simple YAML. Specify the container image, permissions, arguments, and safety constraints. No code required to add capabilities.

How it works

You
→
Agent Core LLM reasoning
→
Guardian 4-layer safety
→
Tool Containers Docker isolation
Guardian Pipeline
  1. Fast DeBERTa classifier — instant risk scoring
  2. Deep LLM judge — contextual safety review
  3. Policy YAML rules — your explicit constraints
  4. Check Coherence — does the action match intent?

Up and running in 60 seconds

Terminal 
# Install prerequisites
$ brew install pyenv uv age

# Clone and set up
$ git clone https://github.com/creel-ai/creel.git
$ cd creel
$ pyenv install 3.12.12
$ uv venv && source .venv/bin/activate
$ uv pip install -e ".[dev]"

# Configure and run
$ export ANTHROPIC_API_KEY=sk-ant-...
$ creel chat

🧺 Creel agent ready. Tools loaded: 12. Guardian: active.