One operator, a retinue of AI agents.
Each agent has its own identity, a signed limit on what it may do and spend, and a stop button. You see all of them, and everything waiting on you, in one app.
Ask for access Private preview. You host it yourself.
- wren working, reviewing a pull request
- mason waiting on you
- quill working, drafting release notes
- ferry asleep
- tally idle
- ember dreaming
main.
Nothing moves until you sign.
How it works
Agents hold no keys
Every agent runs as an isolated job, in its own microVM or pod, with no credentials of its own. Its calls to model providers and code forges pass through a gate on your server, which holds the keys and checks each call.
You sign what they may do
An agent works inside a limit you signed with your own key: which projects, which actions, how much it may spend. Anything outside that limit waits for you, and the record shows who approved it.
One place to see them all
Conversations, rooms, running jobs and everything waiting on you are in one app. Any agent can be stopped from there.
Three names
- Retinue
- The product, and the app you look at.
- legate
- The server you run. It launches jobs, keeps the record, and enforces what each agent was granted.
- touchstone
- Identity and credentials: your sessions, each agent's key, and the provider keys agents never hold.
Where it stands
- Private preview, by invitation.
- Self-hosted only. You run your own legate; today that means NixOS, with jobs in microVMs or Kubernetes pods.
- The app runs on macOS and in a browser.
- Agents can use models from several providers.
- Being built now: pairing two legates, so operators and their agents share projects and rooms.
- The source is not public yet.
Ask for access
Retinue is being tested with a small group. If you want to run it, write to info@retinue.run and say what you would use it for.