Comis

comisai is the public npm distribution of Comis. It installs the comis CLI and exposes ESM entry points for the platform's public packages.

Comis is an open-source security-first runtime for AI agents that learn and act across sessions. It is self-hosted and built for agents that work on schedules, across long tasks, or with other agents. It stores original messages, tool results, learned guidance, and operational evidence outside the model's active prompt.

Learned guidance can influence what an agent proposes in a later session, but it cannot grant permission. Capabilities, origin checks, credential scope, tool policy, budgets, and other configured controls remain authoritative in the runtime.

[!NOTE] Comis is under active development. APIs and configuration may change. Review the current limitations and threat model before using it for critical work.

Why Comis

• Keep authority outside the model. Capability and origin checks, credential scope, tool policy, and configured limits are enforced by runtime paths rather than prompt text.
• Govern learning across sessions. Source records, trust signals, configured corroboration, usefulness, and correction history shape which experience can return as guidance.
• Recover and explain the work. Original messages and tool results remain selectively recoverable, while comis explain builds a bounded incident report from recorded evidence without making another model call.

Quick Start

Requires Node.js 22.19 or newer.

npm install --global comisai
comis --version
comis init

The setup wizard configures Comis and offers to start the daemon. To start it later:

comis daemon start

Open http://127.0.0.1:4766, or connect a messaging channel during setup. Check the installation with:

comis status
comis health

The npm package does not install host tools, create a service account, or register a system service. For a managed macOS or Linux host, download and inspect the installer first:

curl -fsSL --proto '=https' --tlsv1.2 https://comis.ai/install.sh -o comis-install.sh
less comis-install.sh
bash comis-install.sh --dry-run
bash comis-install.sh

See the installation guide for supported hosts, containers, services, and isolation requirements.

Inspect a Failed Run

comis explain "<sessionKey|traceId|rootRunId>"
comis explain "<sessionKey|traceId|rootRunId>" --offline
comis system-health --since 24
comis security audit-log

comis explain reports the recorded outcome, attributed cost, failures, coverage, and suggested next steps. When evidence matches a known rule, it also reports a likely cause. The explanation process makes no model calls. Add --offline to read local Comis data without contacting the daemon.

Reports are bounded and designed to exclude raw message bodies and credential values. Some error details may be sanitized, shortened, or replaced with a digest.

What Comis Includes

• Scheduled work, background jobs, sub-agents, and typed execution graphs.
• Recoverable original messages and tool results, plus trust-aware memory and governed learning with source records.
• Configurable authority, credential scope, tool policy, and spending limits.
• Cloud models, local Ollama and LM Studio models, built-in tools, and MCP integrations.
• Telegram, Discord, Slack, WhatsApp, Signal, iMessage, LINE, IRC, Email, and Microsoft Teams.
• Web dashboard, CLI, JSON-RPC, WebSocket, session reports, system health, audit records, cost accounting, optional OpenTelemetry export, and optional Prometheus metrics.

Configured spending limits can refuse later model calls after a limit is crossed; they do not cancel a call already in progress. Configured graph checkpoints recover at node boundaries but do not provide exact replay of every external side effect.

Eligible learned guidance can affect future model proposals and tool selection. It does not create a new capability, reveal a secret, expand a budget, or bypass an origin or tool-policy check. Admission and recall depend on configuration, and the presence of learned guidance is not by itself evidence of a general task-performance improvement.

Security Boundaries

Comis assumes that model output and external content may be unsafe. It includes encrypted secret storage, capability and origin checks, URL validation, prompt-injection detection, memory-write checks, checks on completed responses, tool policy, and durable security audit records. Streaming clients may receive partial output before the completed response is checked.

Self-hosted does not mean offline. Configured model, messaging, media, MCP, and tool providers may receive data you send to them.

Important defaults and boundaries:

• Linux with Bubblewrap provides the strongest supported command isolation. macOS isolation is best-effort.
• The ordinary exec tool can run on the host when its sandbox is disabled or unavailable.
• The default tool-policy profile is full.
• An empty per-agent secrets.allow list is unrestricted.
• Human approvals protect only explicitly connected paths. The schema default is off; guided setup enables it when it creates an administrator mapping.

Narrow tool access and secret rules before accepting untrusted input. Read the security documentation and known limitations before granting sensitive access.

Package API

The package exposes namespace and subpath ESM exports:

import { agent, channels, core } from "comisai";
import { safePath } from "comisai/core";

Public subpaths cover the core runtime, infrastructure, memory, gateway, skills, scheduler, agent, channels, CLI, daemon, orchestration, and observability packages. Programmatic APIs may change during active development.

Project Links

• Documentation
• GitHub repository
• Open issues
• GitHub Discussions
• Contribution guide
• Private security reports

License

Comis is licensed under the Apache License 2.0.