A Private AI Coding Agent for Your Terminal

No. Run /login to bill inference to your Privateer account: approve a short code in the Privateer app and there's no key to manage. Or bring your own key (BYOK) for any major provider: OpenRouter, Anthropic, OpenAI, Google, xAI, Groq, Mistral, Z.ai, DeepSeek, Together, MiniMax, Qwen, NEAR AI, Tinfoil, Venice, Fireworks, or any custom OpenAI-compatible endpoint. With a local Ollama install you don't need a key at all.

You use your own provider credentials. Set an environment variable (OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, GROQ_API_KEY, NEAR_AI_API_KEY, TINFOIL_API_KEY, …). One provider is enough to start. Switch providers and models anytime with /model, specified as provider/model (for example openrouter/anthropic/claude-opus-5).

Yes. It's an MCP client built on Pi's own MCP support: local stdio servers and remote HTTP servers, with interactive OAuth for the remote servers that need it. Add them with /connect and check them with /mcp. The model calls MCP tools through codemode, a short script, and every call inside it goes through the same safe-by-default permission gate as the built-in tools.

It keeps going. When a reply is cut off at the model's output limit, Privateer sends the "continue" for you (up to twice in a row) instead of stopping until you type it.

Yes. Any program that can run a command can use a one-shot privateer -p "…" run, and Zed, Buzz or your own program can drive privateer acp over the Agent Client Protocol. With --private, Privateer reads the files itself, works only on a verified-private model (TEE-verified or local), refuses every tool that could send data out, and prints only the answer.

Yes. privateer harbor install and privateer channels install run routines and chat channels as login services (launchd on macOS, systemd --user on Linux; on Windows use privateer harbor run). On a VPS, run them as a dedicated unprivileged user, never root, and sign in over SSH with /login. Nothing needs an inbound port except WhatsApp's webhook.

Yes. It's built on the open Pi agent toolkit, so the whole Pi package ecosystem composes in: MCP servers, parallel sub-agents, context compression, and private-by-default web search. The key point is that Privateer's permission gate intercepts every tool any package registers, so anything you add is gated the same way: destructive shell commands stay blocked even in unattended runs.

Yes. MIT licensed, on GitHub and on npm as privateer-agent.

Yes. Point it at a local Ollama install (OLLAMA_BASE_URL) and inference runs on your own machine with no API key. Cloud providers are one /model switch away when you need bigger models.

Yes. Press alt+t (or type /talk) and speak; the mic closes when you stop talking. /speak on reads answers aloud as they're written, and /talk loop on makes it a hands-free conversation. Out of the box it uses your OS voice, so nothing leaves your machine; once you /login it can use your account's confidential-compute speech models instead. Voice is off by default and only in interactive sessions.

Saved tasks a background daemon runs unattended, on a cron schedule or one-off. You ask the agent to schedule the work and approve it once; the agent can even schedule its own follow-up runs. Results deliver to a file, the next session, your phone, email, or a webhook (Slack/Discord), with secrets redacted before anything leaves the machine.

Yes. Before a prompt goes to a channel that isn't verified-private, an on-device PII gate scans it locally for structured personal data (emails, phone numbers, SSNs, credit-card numbers, IBANs, IP and MAC addresses) and offers to redact or hold it. Detection is deterministic and never leaves your machine, and it's skipped on an attested TEE or on-device channel that provably can't read your prompt anyway. It's best-effort structured-PII detection, labeled as such.

Turn on /remote-access (off by default) and link the terminal to the Privateer app on Android or the web. You can send prompts from any of them, and every action the agent wants to take is relayed to the app for Allow or Deny. Execution stays on your machine, the relay is live-only (nothing archived), output is size-truncated and run through a best-effort secret redactor, and no keys ever cross the relay.

Yes. Bridge a terminal to Telegram, Slack, Discord, or WhatsApp and message the agent like a teammate. You allow-list who can reach it: admins approve its actions right in the chat, everyone else is read-only, and a per-channel posture (read-only, approve-each-action, or unattended) caps how far any turn can go. Set it up from the Privateer app. Bot tokens are sealed to your machine and the config is signed by your account, so the relay that carries it can neither read your token nor forge who's allowed in.

On an attested TEE, the provider can't see your prompt: NEAR AI and Tinfoil run models inside Trusted Execution Environments, so your prompt is only decrypted inside the enclave (fetch the cryptographic attestation with /verify). Every other provider has to read a prompt to run inference, so there the promise is "nobody retains it". A ⛉ shield shows the selected model's live posture, graded so a verified proof never reads like a policy promise. The on-device PII gate warns before structured personal data leaves for an unverified model, and the billed-account path proxies prompts without storing them; only billing metadata is kept. Your conversation history stays as files on your own disk under ~/.privateer.

macOS, Linux, and Windows. The installer is self-contained: it bundles its own runtime, so you need no Node and no npm. On macOS/Linux run curl -fsSL https://privateer.pro/install.sh | sh; on Windows run irm https://privateer.pro/install.ps1 | iex in PowerShell. Already have Node 22+? npm install -g privateer-agent or npx privateer-agent work too.