Pick your view
Self-contained Rust agent runtime

The entire agent runtime in one tiny binary.

Nano Brain runs autonomous AI agents with encrypted storage, a dual WASM + binary plugin host, an agentic loop, and full observability β€” shipped as a single stripped binary measured at ~15.4 MiB. No database server. No runtime sprawl. Just Rust.

Start free trial See key features

Give your whole company AI β€” under control.

Nano Brain lets every team build, share and run AI agents, skills and tools in one place β€” with realtime collaboration, multi-tenant isolation, and the governance to keep it safe. Your data stays yours.

Start free trial See key features
Rust core Wasmtime Β· WASI p2 ≀ 24 MiB budget AES-256-GCM HTTP/2 + HTTP/3 Linux Β· macOS Β· Windows
tokioWasmtimerig agent looprmp-serdeargon2iduuid v7jiffreqwest h3SvelteKit adminOTLP / HTTP+JSONrustls + aws-lc-rsMCP server tokioWasmtimerig agent looprmp-serdeargon2iduuid v7jiffreqwest h3SvelteKit adminOTLP / HTTP+JSONrustls + aws-lc-rsMCP server
// what makes Nano Brain

Six capabilities that run your company's AI.

Catalogs, agents, schedules, any LLM, threat detection, and plugins β€” described clearly so teams know what they get and how control stays with you.

MCP / Connector & Skills Catalog

One home for every connector and skill your teams use. Discover, enable, share, and govern them without wiring auth into each tool by hand.

  • Integrated authentication β€” one auth session across MCPs, not a password per connector.
  • SSO ready β€” Microsoft 365, Google Workspace, and your identity stack.
  • Share & control β€” grant connectors and skills per user or group; let departments contribute without losing oversight.
MCPSkillsSSOgroups
Salesforce MCP
SSO Β· Finance + Sales
Shared
Contract-Review skill
group Β· Legal only
Scoped
One auth to all MCPs
Microsoft 365 Β· Google
Live

Custom agents Β· isolated harness

Build custom agents in the Nano Brain app β€” each one runs in a completely isolated harness. You pick the tools, skills, secrets and connectors that agent may touch; nothing else leaks in.

  • Custom agents β€” specialist profiles for support, ops, research, and more.
  • Completely isolated harness β€” tools, secrets, and connectors scoped per agent.
  • Team sharing β€” publish a profile once; control who can run it.
custom agentsisolated harnessaccess

Schedules

Run schedules on the web or on your local machine. With runners, you choose where the job executes β€” cloud, laptop, or any place you trust β€” and what it can access.

  • Web or local β€” same schedule model, wherever the clock lives.
  • Placement via runners β€” cloud, your machine, or provisioned workers.
  • Access control β€” each run inherits the harness and policy you set.
schedulesrunnersplacement

You choose your LLM β€” no lock-in

Bring your own subscription or any model provider. Chat through Claudia like ChatGPT or Claude Desktop. Mix providers in one workflow β€” and switch with one click.

  • Any provider β€” Claude, ChatGPT, OpenRouter, and more; use the subscription you already have.
  • Claudia β€” talk to agents the way you already talk to ChatGPT or Claude Desktop.
  • Mixed workflows β€” one schedule can plan on Claude and execute on ChatGPT (or the reverse). Change providers without rebuilding.
ClaudeChatGPTOpenRouterClaudia
Claude Β· plan
step 1 Β· reasoning
Live
ChatGPT Β· act
step 2 Β· tools
Live
Claudia
desktop Β· PWA Β· chat
Ready

Observability & threat detection

See where tokens go β€” and catch what shouldn't leave. Detect leaked API keys, prompt injection, and keep spend metrics tied to real runs.

  • Leak & injection detection β€” credentials and prompt attacks flagged with context.
  • Token & cost metrics β€” know which team, model, and run is spending.
  • Investigable findings β€” not buried logs; traces you can open and act on.
threatstokenstraces

Extend with plugins

Install plugins to reach the channels your company already uses β€” WhatsApp, Telegram, Microsoft Teams, and more. Ship private plugins for your stack, or publish publicly.

  • Channel plugins β€” WhatsApp, Telegram, Teams, and the rest of your stack.
  • Private or public β€” develop for your tenant, or share with the marketplace.
  • WASM or binary β€” sandboxed components or full-process extensions, permission-scoped by the host.
WhatsAppTelegramTeamsWASM
Start a free trial
// for teams & product

One place for all your company's AI.

Stop wiring AI into a dozen tools. Give every team agents, skills and connectors they can build and share β€” safely, in a workspace you control.

Multi-tenant by default

Every team, client or department gets its own isolated, secure space. Roll AI out across the org without data ever bleeding between groups.

Custom agents, isolated harness

Create custom agents inside Nano Brain β€” each with a completely isolated harness so tools, skills and secrets never cross agent boundaries.

Realtime artifacts

Co-create documents, specs and code with AI and teammates live. Share with a link, choose who can view or edit, get notified β€” no copy-paste.

Every MCP & Skill, one home

All your AI connectors, tools and skills managed in a single place. Discover, enable and version them β€” no infra, no sprawl.

Controlled sharing

Let people share MCPs and skills with each other β€” on your terms. Approvals, permissions and audit so nothing leaks.

See every action & cost

Full visibility into what every agent did and what it cost β€” per team, per model, per day. No surprises, full accountability.

Own your stack

Self-host the whole platform on your own infrastructure. One tiny binary, no vendor lock-in β€” your data never leaves the building.

Any model, any provider

Bring your own LLM β€” Claude, OpenAI / Codex, Cursor, OpenCode, or anything on OpenRouter, including free models. Switch providers without rebuilding a thing.

Your machines, your runners

Execution runs on runners you own β€” your laptop, one server, or many machines at once. Keep data and compute fully in-house.

Schedules that never sleep

Schedule agents to run on time even when your own machine is offline β€” the platform keeps the clock and runs them for you.

Drive it from chat

Control agents straight from Telegram or WhatsApp. Kick off runs, approve steps and get results in the chats your team already lives in.

Monitor your infra & SRE

Watch your systems and act on them. Trigger investigations and fixes from app errors, schedules, opened tickets, Sentry alerts β€” the sky's the limit.

Plug into your identity

Authenticate with your Google Workspace and Microsoft 365 users out of the box β€” with more identity providers on the way.

Auto threat detection

Credentials and security threats in messages and tool calls are scanned automatically β€” findings stay investigable with context, not buried in logs.

Strong tool policy

Per-tool rules for chat vs background: allow, always approve, or let the model classify risk β€” then apply your low / medium / high policy matrix.

Claudia

Desktop app and installable PWA for agent chat β€” approve or reject gated tools in realtime from your phone, laptop, or anywhere else you're signed in.

Progress per task

Track every task and execution from 0–100% as agents work β€” live dashboards so teams see what's running and what's stuck.

Kubernetes your way

Pick images, CPU, memory and pool sizing from the admin UI β€” wire orchestrators into your cluster without hand-editing manifests.

Worker pod pool

A pool of host-worker pods runs orchestrators at scale β€” claim, idle, and autoscale so long jobs don't pile up on one machine.

// build together, live

Create with AI and your team in the same room.

Artifacts β€” docs, specs, code, dashboards β€” are generated by agents and edited together in realtime. Share a link, set view or edit access, and everyone stays in sync. No more emailing files around.

  • Live co-editing with teammates and agents, presence and all.
  • Granular sharing β€” public link, specific people, view or edit, time-limited.
  • Email notifications when something's shared with you or changes.
 
DPJRAL+5 8 editing now
// from artifact to app

Turn an artifact into a live application.

Artifacts aren't just docs and code. They can become real applications β€” built and deployed in a controlled, reviewable way. Your team comments, requests changes and ships, all in one place.

  • Build & deploy an application from an artifact, with controlled, reviewable releases.
  • Team feedback in-line β€” comment, request changes and approve before it goes live.
  • Versioned & rollback-safe β€” every change tracked, nothing ships by accident.
v4 β€” checkout redesign
2 comments Β· changes requested
In review
Preview build
staging.nano-brain
Live
"Move the CTA up?"
comment Β· Design
Open
// safe by design

Share AI across the company β€” without losing control.

People can publish and reuse each other's MCPs and skills, but you decide the rules. Approvals, scoped permissions and a full audit trail mean AI spreads fast and stays safe.

  • Approval workflows before a shared skill or connector goes live.
  • Per-team permissions and isolation β€” access only what's granted.
  • Auto threat detection on every message and tool call, with investigable findings.
  • Per-tool policy for chat vs background β€” allow, require approval, or AI-classify risk.
Salesforce MCP
shared by Β· Revenue team
Approved
Contract-Review skill
shared by Β· Legal
Pending
Internal-Wiki RAG
scope Β· Engineering only
Scoped
Onboarding agent
visible Β· whole company
Public
// tool policy that scales

Decide once β€” chat and background stay under control.

Set per-tool rules for interactive chat and for scheduled or background runs. Require approval always, never, or hand risk classification to the model β€” then map low / medium / high to your policy. When a gate fires, the run pauses for human-in-the-loop (HITL) until you approve or reject.

  • Chat vs background β€” different gates for the same tool.
  • AI classify / AI choose β€” the model scores risk; your matrix decides.
  • Human in the loop β€” approve or reject from Claudia on phone, desktop, or PWA in realtime.
bash
chat Β· always require Β· bg Β· AI classify
Gated
http.request
risk Β· medium β†’ require approval
Medium
repo.read
chat & background Β· never
Allow
Pending Β· shell rm -rf
HITL Β· waiting on your phone
Paused
// human in the loop

Approve or reject a live run β€” from your phone, anywhere.

HITL (human in the loop) means a gated tool doesn't execute until a person decides. When an agent hits a policy gate β€” in chat or in the background β€” the run pauses and you get a push. Open Claudia on your phone, tablet, or desktop and approve or reject in realtime. The agent continues only after you do.

  • Realtime decisions β€” pause a running agent and unblock it from wherever you are.
  • Phone, desktop, or PWA β€” same Claudia session; Web Push when a run needs you.
  • Approve or reject β€” clear yes/no on the gated tool; the agent resumes with your choice.
Push Β· tool needs approval
bash Β· rm staging volume
Now
Approve
from iPhone Β· 2s ago
Done
Agent resumed
background run Β· continuing
Live
∞
isolated teams
1pane
MCPs & skills
live
co-editing
100%
your data
// the runtime

Everything an agent needs, nothing it doesn't.

Kernel, storage, API, plugin host and agent loop are one process. Spotlights on what makes that possible at 15 MiB β€” including host-enforced tool policy.

// dual plugin host

Run WASM components and native binaries, side by side.

Sandboxed Wasmtime components (WASI preview 2, component model) for safe extensions β€” or full external-process binaries when you need the whole OS. Both are permission-scoped and tenant-isolated by the host.

  • Capability flags per plugin β€” read/write repository, register routes, register tools, start threads.
  • Tenant isolation enforced on every nb_repo_* call via declared [[repo_objects]].
  • JWT-minted scoped tokens injected per plugin β€” Bash, Node, Python or WASM.
# plugin.toml
kind = "wasm"   # or "binary"
permissions = ["read_repository",
               "register_tools",
               "register_routes"]

[[repo_objects]]
name = "INVOICE"   # tenant-scoped

# host mints a scoped JWT β†’
nb_repo_list("INVOICE", page=0) βœ“
// encrypted repository

An encrypted filesystem database β€” no server required.

Every object is encrypted at rest with AES-256-GCM behind an Argon2id-derived key. Crash-safe atomic writes (tmp β†’ fsync β†’ rename), MessagePack on disk, and hybrid storage that spills blobs over 64 KB to their own files.

  • Typed schema with implicit core fields β€” id, created_at, updated_at, enabled.
  • Filter + page + sort on every listing, with a full boolean filter tree and SQL-style LIKE.
  • Additive evolution β€” nullable fields only, no migrations to fear.
  • Bring your own database β€” backend plugins swap the built-in file store for MySQL, PostgreSQL and more.
AGENTS2.1k
THREADS1.6k
SECRETS312
TRACES48k
ARTIFACTS904
AES-256-GCM Β· Argon2id Β· atomic-rename
// observability built in

Every run, step and tool call β€” traced by default.

A fire-and-forget TraceSink records LLM steps, tool timings and token usage without ever blocking a run. Persisted to the repository and exported straight to any collector over OTLP/HTTP+JSON β€” no heavyweight SDK.

  • Per-run traces + daily usage rollups for cost analytics by team, model and day.
  • OTLP export to Tempo, Jaeger, Honeycomb, Datadog β€” set one env var.
  • Auto threat detection scans messages and tool I/O for credentials and security threats β€” findings stay investigable.
agent.run812ms
llm.plan276ms
tool.glob81ms
tool.repo114ms
llm.answer298ms
TraceSink β†’ OTLP/HTTP+JSON Β· usage rollups
// tool approval Β· HITL

Host-enforced gates β€” human in the loop when it matters.

Before dispatch, the host evaluates chat vs background policy: never, always_require, or ai_classify. Classified risk maps through your low / medium / high matrix. Gated calls pause for HITL β€” approve or reject in realtime from Claudia on your phone, desktop, or PWA, wherever you are.

  • Per-tool Γ— mode β€” independent chat and background rules, with profile overrides.
  • Risk matrix β€” LLM scores low / medium / high; your tenant settings decide the action.
  • Realtime HITL β€” Web Push + approve/reject from phone or elsewhere while the run waits.
# tool approval policy
bash      chat=always_require
           bg=ai_classify
http      both=ai_classify
repo.read both=never

# risk bands (chat)
low β†’ never Β· med β†’ always_require
high β†’ ai_choose

gate(tool) β†’ pause β†’ Claudia HITL
// full capability set

One binary. The whole platform.

From the agentic loop to the plugin marketplace β€” every subsystem ships in the box.

Agentic loop

LLM-driven multi-turn loop on the rig framework β€” tool invocation, sub-agent spawning, iteration limits and approval workflows.

rigmulti-turnapprovals

Multi-agent

Spawn isolated sub-agents for parallel work, each with its own conversation, resource limits and custom tool access.

sub-agentsdetached

Embedded REST API

Full CRUD over agents, plugins, secrets and config maps. Filter + page + sort on every listing, permission-checked per call.

CRUDfilter/page/sort

MCP server (inbound)

Expose the whole tool catalog β€” builtins, plugins and proxied MCP β€” as a native MCP server over HTTP. Claude.ai connector ready.

MCPconnector

Code mode

Tools exposed as REST endpoints; the model writes JavaScript to chain calls, keeping huge intermediate data out of the context window.

tool APIjs chaining

Hybrid RAG search

Lexical + vector retrieval over your knowledge base with semantic ranking and trust-tier filtering across multiple sources.

lexical+vectortrust tiers

Secrets & config maps

Encrypted storage for API keys and configuration, bound to plugins by manifest with required/optional flags.

encryptedbound

Message ingest

A single inbound endpoint with synchronous SSE streaming or async job polling, plus full thread, message and job tracking.

SSEasync jobs

Plugin store

Publish and install plugins from a hosted marketplace with versioning and one-click install β€” running in-process.

publishinstall

SvelteKit admin UI

Manage tenants, plugins, agents, LLM profiles, secrets, scheduled prompts, observability and threat findings.

SvelteKitTailwind

Per-tenant isolation

Per-tenant encryption keys, quotas and access control, with explicit, audited cross-tenant sharing when you need it.

quotasscoped

Pluggable backend

Binary plugins can replace the built-in filesystem repository with a custom backend via an in-process HTTP bridge.

replaceableMySQLPostgreSQL

Distributed runners

Execute on runners you control β€” your own machine or many machines in parallel. Schedules keep firing even when your laptop is offline.

self-hostedmulti-machineoffline

Chat ops

Drive agents from Telegram or WhatsApp β€” trigger runs, approve steps and stream results straight into chat.

TelegramWhatsApp

Any model provider

Wire up Claude, OpenAI / Codex, Cursor, OpenCode or anything on OpenRouter β€” including free models. Per-agent LLM profiles, swap any time.

OpenRoutermulti-provider

Auto threat detection

Heuristic + optional LLM scan of messages and tool I/O for credentials and security threats. Findings persist with investigation context packs.

credentialssecuritycontext packs

Tool approval policy

Per-tool chat/background gates: never, always require, or AI-classify risk into your low/medium/high matrix β€” host-enforced before dispatch.

HITLai_classifyrisk bands

HITL approvals

Human in the loop: gated tools pause the run until you approve or reject β€” in realtime from Claudia on your phone, desktop, or PWA, anywhere you're signed in.

HITLmobileWeb Push

Claudia

Tauri desktop + installable PWA for agent chat, biometric vault unlock, and push when a run needs your yes or no.

desktopPWAHITL

Task progress

Agents report 0–100% progress per task and execution; dashboards update live so operators see throughput without refreshing.

0–100%livetasks

Kubernetes control

Admin settings for worker images, CPU/memory, and pool bounds β€” integrate orchestrators with your cluster from the UI.

imagesresourcesadmin UI

Host-worker pool

A pool of pods claims and runs orchestrators β€” min idle, max workers, claim-pressure scale-up and idle scale-down.

podsautoscaleorchestrators
15.4MiB
stripped binary
≀24MiB
hard size budget
3OS
linux Β· mac Β· win
100%
runs traced
// extend it your way

Write a plugin in any language.

The host is generic β€” all vendor logic lives in plugins. Pick the boundary that fits the job.

WASM components

Sandboxed Wasmtime + WASI preview 2. Tightly scoped, portable, safe by construction.

Native binaries

Bash, Node, Python or compiled β€” full OS access, scoped JWT injected via env.

Periodic tools

Host worker calls plugin tools on a fixed interval for syncs, webhooks and refreshes.

$ nano-brain serve
β†’ kernel    ready   encrypted FS repo
β†’ api       :8081  REST + MCP + ingest
β†’ plugins   3      wasm:2 binary:1
β†’ agent     rig    tools: 28 registered
β†’ traces    otlp   β†’ tempo:4318

POST /api/:user/main/private/ingest
# SSE stream or async job polling
200 event: token "Nano Brain online."
// free trial

Create your tenant on Nano Brain.

Spin up an isolated trial tenant on nano-brain.aopsi.com β€” capped at 100k tokens by default, with custom agents that run in a completely isolated harness. Captcha + rate limits keep abuse out.

We'll email you a one-time link to set your password. Limit: 5 trials per 24 hours.

Trial guardrail
100k tokens default cap
Custom agents
Isolated harness per agent
Trial group
Auto-joined on create
Website
nano-brain.aopsi.com
// get in touch

Run autonomous agents on your own metal.

Self-host the binary, or talk to us about deploying Nano Brain for your team. Drop a line β€” we read everything.

Website
nano-brain.aopsi.com
Security
AES-256-GCM Β· per-tenant keys
Built with
Rust Β· Wasmtime Β· tokio Β· rig
Contact form
Use the form β€” we read every message