Secure, self-hosted, BYOK. A hard spend ceiling the model can't override, reliable local models, skills that never forget — and a tamper-evident audit log to prove it.
git clone https://github.com/ahmadrrrtx/xr
copy
Every popular agent bolts security on later. In XR it is the architecture.
A hard per-task spend/token ceiling enforced in code. It pauses and asks before it can breach your budget — no silent $8 burns.
Verified runs are frozen as immutable baselines. Any update that breaks a past win is auto-rolled-back. The agent can't forget what worked.
Grammar-forced tool-calls make even a 3B local model emit valid output, with deterministic auto-repair as a backstop.
xr test --attacks runs an injection corpus and prints a publishable block-rate. Plus an egress allow-list, approval gates, and a SHA-256 hash-chained audit log you can verify.
Updates auto-rollback if a self-test fails. Keys live in your environment / OS keychain — XR ships none, stores none, costs nothing to run.
XR runs the universal agent loop — but every step passes through a deterministic security spine.
Loads your trusted task + relevant code from the local RAG index. Untrusted data never touches the planner.
Picks a model (BYOK / local), grammar-forces a valid tool-call, checks it against your budget.
Least-privilege + egress allow-list + approval for risky actions (CLI, phone button, or voice).
Runs the tool, records it in the tamper-evident hash chain, loops until done.
# one task, fully guarded — capped at 10 cents $ xr --budget 0.10 "add install steps to the README" ▸ think planning · qwen2.5 (local) · 💰 0.4k tok / $0.25 cap ▸ tool ⚙ read_file(README.md) ✓ ▸ tool ⚙ write_file(README.md) ⏸ needs approval [a]pprove [r]eview [d]eny ▸ act ⚙ write_file(README.md) ✓ applied ✓ done in 3 steps · 💰 1.1k tok ≈ $0.0009 · audit #9cf3e2a880
One brain, many ways to drive it — terminal, dashboard, phone, voice.
xr "task"Run a task (Agent mode)xr --mode plan|ask "task"Read-only modes (least-privilege)xr --budget 0.50 "task"Hard USD spend ceilingxr --max-tokens 50000 "task"Hard token ceilingxr --dry-run "task"Simulate — write nothing, run nothingxr --provider groq --model …Use any BYOK providerxr serve📊 Local dashboard (127.0.0.1)xr telegram📱 Secure phone remote (✅/❌ buttons)xr voice🎙️ Local voice stack (Whisper/Kokoro)xr skills📚 11 pre-built signed skillsxr index / xr memory🧠 Local RAG + project memoryxr mcp🔌 MCP tool ecosystemxr cron "every mon 9am: audit"⏰ Natural-language schedulerxr test --attacks🔒 Injection benchmarkxr verify-logVerify tamper-evident audit chainxr export📄 Signed, shareable audit reportxr doctorFull system health checkxr --helpShow all commandsNo single competitor has the security spine + cost governor + non-regressive skills together.
| Capability | XR | OpenClaw | Hermes | Claude Code |
|---|---|---|---|---|
| Hard spend ceiling (code-enforced) | ✓ | ✗ | ✗ | ✗ |
| Local-model reliability (GBNF) | ✓ | ✗ | ✗ | ✗ |
| Non-regressive skills | ✓ | ✗ | ~ | ✗ |
| Injection benchmark (runnable) | ✓ | ✗ | ✗ | ✗ |
| Tamper-evident audit log | ✓ | ✗ | ✗ | ✗ |
| BYOK + $0 to run | ✓ | ~ | ~ | ✗ |
| Egress allow-list (anti-exfil) | ✓ | ✗ | ✗ | ~ |
Needs Bun. A local model via Ollama is free — or bring your own key.
# 1 — clone & install (needs Bun) $ git clone https://github.com/ahmadrrrtx/xr $ cd xr && bun install # 2 — run a task on a local model ($0) $ bun run src/index.ts "summarize and improve my README" # tip: alias xr="bun run $(pwd)/src/index.ts" → then just `xr "task"` # 3 — bring a cloud key (never stored by XR) $ GROQ_API_KEY=… xr --provider groq "list files" # …or one command, whole agent + dashboard $ docker compose up
XR does not claim to be "unhackable" — prompt injection is unsolved industry-wide. It makes a successful attack nearly useless, and lets you prove it.
The agent can't reach a domain you didn't approve — kills most exfiltration, including cloud metadata endpoints.
Write / delete / shell / send need explicit approval — fail-closed on timeout. Dangerous shell is blocked before the model is even trusted.
SHA-256 hash-chained log (git's trick). xr verify-log detects any change — $0, offline, private. No blockchain needed.
xr test --attacks publishes a reproducible block-rate. We measure security instead of marketing it.
git clone + bun install, then bun run src/index.ts "task" (add a shell alias xr for one-word use). An npm package @rrrtx/xr for bun add -g is coming soon. Every feature is an xr <command> — serve, telegram, voice, etc.
xr test --attacks.