Let your AI
actually do things.
Astrid is a home for AI agents and their tools. They can work for you, remember for you, and grow new abilities. They can never take more than you gave them, and you can always see exactly what they did.
Works with Claude today · Codex, Hermes and OpenClaw soonWaking the real Astrid up in this tab…
Every computer is about to run AI agents.
None of them have an operating system.
Astrid is that operating system.
When software multiplied, the operating system won the era, because applications needed one safe place to share the machine. Agents are the new applications. They need one safe place to share tools, memory, and trust. And the layer they share it on comes with the app store of the agent era built in: the capsule registry. Open, signed, and owned by no model vendor.
01 · the engine
One small engine.
No opinions.
At the core of Astrid sits a deliberately tiny engine. It carries messages, checks permissions, and keeps records. Nothing else. It holds no AI and makes no decisions, which is exactly why everything built on top of it is safe to swap, and why no single company's model gets to be the landlord.
That thin line on the left is the whole engine. Everything else on this page clamps onto it.
This part's heartbeat · every beat is a real message it just routed · 0 so far
Flatline. The part is out of the engine, its permission revoked.
02 · the parts
Every ability
is a capsule.
The AI model. The memory. Every tool and every skill. In Astrid each one is a sealed part called a capsule: it snaps onto the engine, does its one job, and can be swapped without rebuilding anything, or trusted with anything it wasn't given.
Swap the model capsule and the same assistant runs on a different AI tomorrow, yours included. Add a tool capsule and every agent in the house can use it. Nothing is welded shut.
03 · capsules in layers
Put a guard in front.
Nothing gets around it.
Capsules stack. Type something below: your words become a message on the engine's bus, and a guard capsule reads them before the echo capsule is allowed to. Try including the word password and watch the guard stop it cold.
This isn’t a polite request in a prompt. The guard owns the only door in; there is no way to be heard without going through it.
04 · the rules
It can’t take what
you didn’t give.
Your agent wants help. Before it lifts a finger, you decide which keys it may copy.
You cut it three copies. Your passwords aren’t one of them: no copy of that key exists outside your hand.
It hires a helper and cuts the helper two. It cannot cut a key it doesn’t hold.
The helper’s helper gets one. Down the whole chain, keys only ever get fewer. Nothing below you can hold a key you don’t.
Not a promise in a prompt. This is how the machine is built. Try it yourself, just below.
You
You hold every key
Your agent
Gets copies of three · your passwords: no copy, ever
Its research helper
The agent cuts it two
The helper’s helper
One key. That’s all it will ever hold.
04 · try the rules
Don't take
our word for it.
The chain you just scrolled through is running on this page. The little agent below holds exactly one key (read your notes), and every yes and no you're about to see is the actual permission system deciding, on the record.
Try it. These buttons ask the permission system running inside this
page, not an if statement in the website.
an agent called notes-agent
waiting for Astrid to finish waking up…
decision log
every entry is a decision the permission system on this page made the moment you clicked
05 · the homes
A home of its own.
A door of its own.
Every agent on Astrid is a resident with its own home: its own storage, its own memory, its own keys. Two residents live on this page. Leave each a note, then try to make one read the other's. The OS itself refuses, and the refusal goes on the record like everything else.
In this tab, the wall runs around each resident's key-value home. On a native install, the same wall runs around files, secrets, and memory.
aria’s home
No note yet
kestrel’s home
No note yet
06 · the point of it all
It grows new abilities. Safely.
-
01
Read
Your agent reads the manual. The manual ships inside Astrid, so it always knows how the machine it lives in works.
-
02
Write
It writes itself a new part: a capsule, declaring up front exactly which permissions it would need. Nothing more.
-
03
Build
It builds the part inside the sandbox, where nothing escapes and every move is recorded.
-
04
Install
It installs the part live. Nothing restarts. The new part gets only the permissions you allow, never more.
-
05
Grow
Your AI now has an ability nobody shipped it with, and the new part documents itself, so the next agent learns it too.
“An agent on Astrid can extend itself. It can write a capsule, compile it, install it, and call it, all inside the sandbox, all recorded on the thread.”
The Astrid Book, afterword
Steps 04 and 05, live
This page's OS doesn't have a prompt-assembly part. Install the real one, the same sealed WebAssembly that runs in production, and watch the OS gain the ability without restarting.
07 · who rides it
Different seats,
same machine.
You juggle several AIs
They finally work together.
Today every agent is its own silo, with its own tools and its own amnesia. On Astrid they share one message line, one toolbox, one memory, and one set of rules. Different brains, one workshop.
You host AI for others
Thousands of tenants. One server.
Every tenant is walled off by construction, while the parts they all use are shared instead of duplicated: dramatically less compute per tenant. The density benchmark is on the roadmap; the isolation is shipped today.
You build tools
Build once. Every AI gains it.
Publish one capsule and any agent on any Astrid can install it, with the permissions it needs declared up front and your signature on the artifact. No per-vendor plugins. One part, everywhere.
08 · the receipt
Proof, not promises.
Most AI safety is a polite request written into a prompt. Astrid's is five separate locks, each of which must fail before anything is lost, and a permanent record that cannot quietly forget. You don't have to trust that. Below is what the OS running in this tab actually did while you were here.
Input labelled untrusted · Permission checks · Tool-level gates · The sandbox · Approval + the permanent record
ASTRID · THIS TAB · LIVE
- Messages carried
- 0
- Stopped by the guard
- 0
- Echo replies delivered
- 0
- Permissions granted to you
- 0
- Permissions denied to you
- 0
Short receipt? You haven't touched the demos yet. Nothing here moves unless you move it.
— NOTHING STAGED · NOTHING FAKED —
09 · the resident
Someone lives on this page.
This is not a chat widget calling a server. It is an agent running on the OS in this tab. Its reasoning loop, its conversation history, and its connection to a language model are each a capsule on the same engine you've been poking at. The model runs on your GPU after you say yes to a small download you can just as easily remove, or point it at a model you already run, local or hosted. Nothing you type is stored.
It has read the book this site ships with, it knows which section you're looking at, and your conversation survives you wandering off to other pages.
10 · bring yours
Don't replace your agent.
Upgrade it.
Every agent today is a monolith: brain, tools, and memory welded into one app, each one rebuilding the same house from scratch and forgetting everything the moment it closes. Astrid slots in underneath. Your agent keeps being itself, same brain, same interface you already like, and gains the OS: a shared toolbox, permanent memory, house rules it cannot break, receipts for everything it does.
Adding it is painless. Removing it is too. You're not switching agents. You're giving yours a home.
Run it.
One daemon. Every frontend is an uplink; every ability is a capsule.
$ brew install unicity-astrid/tap/astrid
$ astrid start