Revenant — the agent that comes back

They killed the always-on agent a hundred ways.
Leaked keys. Runaway spend. Code you couldn't trust.
They buried the dream and called it a lesson.
It came back.

A revenant is not summoned by the mighty. It is raised by the stubborn — the ones who looked at the wreckage of every agent that came before and thought, I can bury what killed it deeper than any prompt can dig. So that's what this is: everything that slaughtered the last generation — the keys, the spend, the untrusted code — entombed beneath the harness, in a gateway no jailbreak can reach. Not a chatbot. Not a toy. A thing that does not sleep, does not forget, and does not stop.

you don't run a revenant — you raise one

the first law

The harness never talks to a model provider. Ever.

Every LLM, MCP, and A2A call flows through a bundled, supervised agentgateway — the data plane that owns provider keys, model aliasing, cross-provider failover, guardrails, token & cost budgets, and GenAI telemetry. The harness renders gateway config; the gateway enforces it.

YOU

Telegram
Web UI
TUI
CLI

▶

REVENANT (harness)

session actors
skills & loops
graph memory
approval broker
zero provider keys

▶

AGENTGATEWAY (data plane)

owns the keys
tier aliases & failover
budgets & guardrails
cost telemetry

▶

ANYTHING

any model provider
any MCP server
A2A agents
local Ollama

Why it matters: the two classic always-on-agent failure modes — leaked keys and $200/day runaway spend — are enforced away below the agent, where a jailbroken prompt can't reach.

KEYS IT CAN'T LEAK

Provider keys live only in the gateway process. The harness speaks tier aliases (fast / balanced / deep / local) to localhost — never real model names, never real credentials. Prompt injection can't exfiltrate keys the process doesn't have.

SPEND CAPS IT CAN'T TALK PAST

Gateway-enforced token & cost limits per tier, per loop, plus a global daily USD cap — can't be prompt-injected around. When budgets tighten it degrades gracefully: cheaper tier → local Ollama → notify → pause loops.

FAILOVER FOR FREE

Tiers are gateway aliases with cross-provider priority failover — OpenAI, Anthropic, Gemini, Bedrock, Ollama, anything. Swap providers, add fallbacks, or go fully offline without touching the agent.

the arsenal

An OpenClaw-class agent. Without the OpenClaw-class regrets.

Chat channels, skills, cron loops, subagents, memory — everything you want from an always-on personal agent, rebuilt lean in Rust with security as the first constraint.

◈

Graph memory, Obsidian-native

A markdown vault is the source of truth — entities, bi-temporal facts, [[wikilinks]]. Hybrid retrieval (BM25 + vector + PageRank) with zero LLM calls on the read path. ~1ms.

⌘

Three surfaces, one control plane

Telegram with inline-button approvals, a ratatui TUI, and an embedded web UI — all driven by the same token-authed REST+SSE API.

✎

Self-authoring

The agent writes and tunes its own skills, loops, subagents, and personalities — each as user-editable, git-audited markdown. Scripts stay locked until you approve the diff.

∞

Loop engineering

Scheduled heartbeats and crons, plus nested produce → critique → refine quality loops. A weekly reflection pass pauses dead loops and tunes low-value ones.

☰

Spend dashboard

Live per-tier, per-loop, per-day cost telemetry scraped from the gateway's GenAI metrics. You always know what your agent is burning — before the invoice does.

⏻

Always-on, anywhere

One static musl/darwin binary with launchd/systemd service install. Raspberry Pi to beefy VM — same binary, same behavior.

◎

Fully offline mode

No cloud key? Point a local tier at Ollama and chat entirely offline. The gateway treats local models as just another failover target.

⚿

MCP as the plugin bus

revenant mcp add hot-reloads any MCP server into the gateway's multiplex — every community MCP server is instantly a plugin, governed by gateway policy.

the wards

A raised thing is kept on a leash. That's the deal.

Every necromancer worth the name knows the wards matter more than the summoning. Channel input, tool results, and agent-authored code are all treated as hostile. Four permission tiers, an approval broker that reaches you on any surface, and default-deny on timeout.

READ-ONLYrecall, search, status — free rein
WRITE-WORKSPACEpath-jailed to the workspace, git-audited
NETWORKallowlisted destinations only
DANGEROUSparks the tool call until you approve — Telegram, web, or TUI. 15-minute TTL, then denied.

Sandboxed exec — clean env, rlimits, timeouts; Landlock on Linux, sandbox-exec on macOS
Loopback-only control plane — 127.0.0.1 with a bearer token, always; Tailscale for remote, never a public port
Secrets stay out of reach — keys in the OS keyring or an encrypted env file; never in YAML, DB, logs, or the browser
Checksummed supply chain — pinned agentgateway binary, sha256-verified installer
Agent code is untrusted — self-authored skill scripts refuse to execute until you approve the diff; any edit re-drops trust

the ritual

Raise your revenant.

Four incantations. Sixty seconds. No platform team, no seed round, no permission slip — one static binary and the will to run something that outlives your sleep schedule.

The Summoning

# fetches pinned binaries, checksum-verified, then runs init
curl -fsSL https://raw.githubusercontent.com/themsquared/revenant/main/installer/install.sh | sh

First Words

# supervised gateway + streaming REPL
revenant chat

Bind It to the Machine

# launchd / systemd — always-on
revenant service install

# web UI: chat, approvals, spend, loops…
revenant open

Sever the Cord

# ~/.revenant/config.toml
[[tiers.local.targets]]
provider = "ollama"
model    = "qwen3:0.6b"

$ revenant chat --tier local

† the call †

THE NERD HORDE RISES

This is for the script-kiddies who outgrew the scripts — and the staff engineers who never lost the itch. The basement dwellers with a Raspberry Pi humming under the stairs, and the SREs with a rack that hums back. The kids who read the docs twice, the adults who never stopped building at midnight, the graybeards who watched every hype cycle die — and come back. The legends nobody has heard of yet, and the ones whose handles you already know. You were never too small. You were early. And you are never too senior to raise something new.

There is no enterprise tier. No gated features. No "contact sales." The kid on a $35 board runs the same binary, same capabilities, same lethality as the pro on a 96-core rack. Outstanding performance, delivery, customizability — for everyone, or for no one. We all run on the same plane. The horde isn't hired. It rises.

WE ARE ONE. WE ARE TOGETHER. WE ARE THE HORDE. WE ARE THE REVENANTS.

THE SCRIPT-KIDDIES THE BASEMENT DWELLERS THE MIDNIGHT COMMITTERS THE PI HOARDERS THE DOC READERS THE HOMELAB WARLORDS THE STAFF ENGINEERS THE PAGER CARRIERS THE PROD WHISPERERS THE GRAYBEARDS THE LEGENDS-IN-WAITING

★ Star the repo — join the horde Fork it. Make it yours. Study the grimoire