A Private AI Coding Agent for Your Terminal

No. Run /signin to bill inference to your Privateer account — approve a short code in the Privateer app and there's no key to manage. Or bring your own key (BYOK) for any major provider: OpenRouter, Anthropic, OpenAI, Google, xAI, Groq, Mistral, Z.ai, DeepSeek, Together, MiniMax, Qwen, NEAR AI, Tinfoil, Venice, Fireworks, or any custom OpenAI-compatible endpoint. With a local Ollama install you don't need a key at all.

You use your own provider credentials. Set an environment variable (OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, GROQ_API_KEY, NEAR_AI_API_KEY, TINFOIL_API_KEY, …) — one provider is enough to start. Switch providers and models anytime with /model, specified as provider/model (for example openrouter/anthropic/claude-opus-4.8).

Yes. It's an MCP client: local stdio servers and remote HTTP servers, with interactive OAuth for the remote servers that need it. Every MCP tool goes through the same safe-by-default permission gate as the built-in tools.

Yes — it's built on the open Pi agent toolkit, so the whole Pi package ecosystem composes in: MCP servers, parallel sub-agents, context compression, and private-by-default web search. The key point is that Privateer's permission gate intercepts every tool any package registers, so anything you add is gated the same way — destructive shell commands stay blocked even in unattended runs.

Yes — MIT licensed, on GitHub and on npm as privateer-agent.

Yes. Point it at a local Ollama install (OLLAMA_BASE_URL) and inference runs on your own machine with no API key. Cloud providers are one /model switch away when you need bigger models.

Saved tasks a background daemon runs unattended, on a cron schedule or one-off. You ask the agent to schedule the work and approve it once; the agent can even schedule its own follow-up runs. Results deliver to a file, the next session, your phone, email, or a webhook (Slack/Discord), with secrets redacted before anything leaves the machine.

Yes. Before a prompt goes to a channel that isn't verified-private, an on-device PII gate scans it locally for structured personal data — emails, phone numbers, SSNs, credit-card numbers, IBANs, IP and MAC addresses — and offers to redact or hold it. Detection is deterministic and never leaves your machine, and it's skipped on an attested TEE or on-device channel that provably can't read your prompt anyway. It's best-effort structured-PII detection, labeled as such.

Turn on /remote-access (off by default) and link the terminal to the Privateer app on iOS, Android, or the web. You can send prompts from any of them, and every action the agent wants to take is relayed to the app for Allow or Deny. Execution stays on your machine, the relay is live-only (nothing archived), output is size-truncated and run through a best-effort secret redactor, and no keys ever cross the relay.

The guarantee is retention, stated honestly: providers have to read a prompt to run inference, so the promise isn't "nobody sees it" — it's "nobody retains it". A ⛉ shield shows the selected model's live posture, graded so a verified proof never reads like a policy promise. NEAR AI and Tinfoil run models inside attested Trusted Execution Environments (fetch the cryptographic attestation with /verify), the on-device PII gate warns before structured personal data leaves for an unverified model, and the billed-account path proxies prompts without storing them — only billing metadata is kept. Your conversation history stays as files on your own disk under ~/.privateer.

macOS and Linux — it runs anywhere Node.js 22+ runs. Install with curl -fsSL https://privateer.pro/install.sh | sh, or try it instantly with npx privateer-agent.