Set up in the browser, not in a config file.

Version 0.1.20 is published for Linux x64 and for Windows through a WSL appliance. On Linux, agent chat needs a working Podman installation. On Windows, the installer checks and enables its WSL prerequisites for you, so you do not install Podman separately. You also need a model provider. Runs smoothly on a 4 GB Intel Core M tablet (Acer T300 Chi) using a cloud model. Local models through Ollama need more memory. See System requirements.

No. Providers, models, agents, connectors, skills, and channels are all managed from one interface. You add a provider, save a model, create an agent, and start a session from the same screens. Onboarding offers presets for Gemini, Ollama, and OpenRouter, and manual setup exposes every provider type. See Providers and models.

Kautuka is local-first: agent sessions run on your hardware. Installers and release files are offered through GitHub Releases. Update checks contact updates.kautuka.dev for signed channel and catalogue metadata; Google and Microsoft sign-in use the hosted broker at auth.kautuka.io. Cloud model providers you configure receive prompts and context sent for their requests. See Privacy.

Yes, with Ollama running locally. Kautuka’s appliance runs the agent; the model is a separate choice. If you pick a cloud provider, the prompt and selected context for that call go to that provider. See Security.

Ollama runs locally with no API key. Examples of cloud services include OpenAI, Anthropic, Groq, Mistral, Gemini, Azure OpenAI, and Azure AI Foundry. You can also use OpenRouter or any OpenAI-compatible API. Save a model, check what it supports, then assign it to an agent.

No. The admin sets up model providers and models once, for the whole box. Users choose from what’s been configured and allowed, and can’t go around it. See Providers and models.

The capability check records what it observed, such as streaming, tool calling, and structured output. Treat unknown capability data as unknown. Check a model before you depend on tools or structured output with it, and give that agent a model that does support what its job needs.

Only where you point it. The agent runs on your appliance. A cloud model provider receives the prompt and context sent for its calls. Connected services such as mail receive only what the connector needs to authenticate and act. Saved credentials are encrypted in a separate credentials service and kept out of the model conversation.

Only if you have allowed it. Each tool, skill, and connector has a mode, and setting one to Ask makes it pause for your approval. A tool set to On will not ask, so review the modes you have chosen rather than assuming every action pauses. See Approvals.

In browser chat, and from Telegram or Slack. A channel can send approvals and the final reply, or mirror the full chat. Browser chat always works regardless of channels. See Channels.

Conversations are saved, so closing the browser does not lose the session. Workflow runs that were working pick up again, and runs and approvals waiting for you keep waiting. Recovery does not guarantee that an interrupted outside action is safe to repeat — check the external service before retrying.

Optionally. With fact extraction enabled on an agent, small durable facts are stored against that agent and can be reused later. Extraction is selective, so state what should last explicitly. See Memory.

No. You build it on a canvas in your browser: choose who does each step, say what they should do, and add checks. Build and edit on a computer. On a phone you can view a workflow and answer its reviews. See Workflows.

No. Only the steps you mark “Check with me first” wait for your OK. Anything an agent does that’s set to Ask still asks, inside a workflow or not.

You do, with rules. A step returns results, such as a number, a yes or no, or a choice from a list, and each check compares them with the rule you set. The agent doesn’t pick the path.

Yes. “Test this step” runs just that step with sample details you enter. It stops before the agent uses any tool, so nothing real happens.

The run keeps waiting, even through a restart. Reviews don’t wait forever, though. If one runs out of time unanswered, the run stops rather than carrying on.

Yes. One appliance serves one person or a team. The first account is an administrator who invites others by email and can limit each account to selected agents. People can work from browser chat or Telegram and Slack. Google and Microsoft sign-in are available when the appliance is configured with the hosted auth broker. See Users and sign-in.

Yes. A system agent’s configuration and tools are shared, but each person’s agent files and remembered facts are kept apart in Kautuka’s protected storage: files have separate access controls, and facts are recalled only for the user they were extracted from. Give people separate agents when they need different tools or settings.

Households, solo founders, and small teams who want capable agents without leaving them loose on their machine or data. Kautuka is a ready-to-run product, not a developer framework: no code or flow-building is required.

Kautuka runs on your hardware, supports review for configured risky actions, and records runs. Cloud platforms run in a provider environment; developer frameworks are building blocks; self-run assistants vary in where they run and what they record.

Yes. Telegram and Slack are supported for approvals.

No claws, just a band. A kautuka is the protective thread tied around the wrist at the start of something new. That’s the idea here: your agents get to work, and the thread keeps them safe and answerable to you.

Kautuka is open source under Apache-2.0. View source on GitHub. Narad Protocol is a separate project under MIT, so the licences differ.

Pricing for any paid offerings has not been announced.

Linux x64 and Windows through the WSL appliance. macOS is not part of this release.

Not in this release. WhatsApp is deferred rather than rejected: Kautuka currently uses polling or outbound connections and does not accept inbound webhooks, and no unofficial transport is authorised. Telegram and Slack are supported. See Capabilities and limits.

Not in this release. Suspend and recovery are available, and permanent deletion is deliberately left to an administrative lifecycle, because a deleted provider slot could not be safely reconnected.