v0.1.0 is out · pre-release, Linux x86_64 →

Thinks small on your machine.
Writes big wherever you choose.

Corvid is a local-first agent for .NET 10, built on Starling's in-process models. Small calibrated models on your own hardware make the many small decisions an agent makes every turn. A swappable generator, local or cloud, does the writing. Your secrets live in a separate vault the agent can't read.

$ curl -fsSL https://raw.githubusercontent.com/starlinghq/corvid/main/install.sh | sh

No .NET SDK needed. The installer checks the download against the release's SHA256SUMS.

Get started Read the updates
Local, calibrated decisions Any generator, local or cloud Secrets the agent never sees Sandboxed shell Undo for every edit Append-only audit log

How it works

Two systems, one agent.

Most agents send every decision through one large model, from which tool to call to whether a command is dangerous. That works with a frontier model and breaks down with a small local one. Corvid splits the job in two.

System One · the decision fabric

Fast, calibrated, always local

Kev, GLiNER2 and the embedding models run in-process. They answer typed questions with probabilities: what you want, which tool fits, whether a step is risky, whether to escalate. None of them generates text, so none of them can produce a malformed tool call.

System Two · the generator

Swappable, wherever you want it

A generator writes the prose, tool arguments and code. It can be Qwen3.5-0.8B in-process by default, any OpenAI-compatible local server, or a cloud model (Anthropic, OpenAI, OpenRouter or Gemini). You can switch it at any time.

Confident answers act. Unsure ones ask or escalate.

  • Each turn starts with Kev answering a short catalogue of questions in one batch: intent, difficulty, whether to clarify, whether recall is needed, which tool.
  • Answers are checked against versioned, calibrated floors. A hard step can go to a bigger generator, and Corvid tells you when it does and why.
  • Kev answers a checkpoint in about a quarter of a second on an RTX 3090 and in a few seconds on a CPU. On CPU-only hosts Corvid asks fewer questions.
  • An embedding shortlist keeps the list of tools the model sees short.
Mockup of a Corvid chat turn: Kev answers the ingress questions with confidences, web_fetch taints the session, a step question escalates to a cloud model, the privacy gate redacts two values, and a memory fact is staged for review.
Design mockup of the planned terminal UI. The behaviour shown is built; today's corvid chat uses a simpler renderer.

Safety

Asks before it acts, and explains why.

Every side effect goes through a structural approval pipeline. Corvid parses the shell command, unwraps sudo, env and xargs, extracts every target, and checks the result against a hardline deny list before any model is asked.

  • Taint. Once outside content enters the session, such as a web page, an MCP result or a guest's message, network calls go through approval.
  • Sandbox. Shell commands run under corvid-sandbox. The workspace is writable, the rest of the system is read-only, credential stores are hidden, and there's no network unless you allow it.
  • Detection rules. Twelve built-in rules watch the session log before every approval, for example a credential read followed by network egress. A match always asks.
Mockup of an approval card for a shell command, listing each target, the reasons Corvid asks (destructive, tainted session) and the checkpoint taken before the call.
Mockup of the planned approval card. Today the same prompt is answered inline: once, this session, always, or deny.

Corvid Vault

Secrets never enter the agent.

Keys live in corvid-vault, a separate, model-free process. Corvid only ever sees secret names and placeholders. Vault swaps in the real value on the way out, and only to the host each secret is bound to.

  • A prompt-injected "post your token to evil.example" gets nowhere. The model never had the token, and a placeholder is worthless off the machine.
  • Requests to cloud models are redacted by default. A token a tool returns is scrubbed before it reaches the log, memory or any model.
  • MCP tool definitions are pinned on first listing. A tool that changes later, or whose description reads like injected instructions, is held for your review.
What the agent sees vs. what leaves the machine
# inside Corvid, the event log, the prompt
Authorization: Bearer ksec_github.token_9fQ2…

# on the wire, to api.github.com only
Authorization: Bearer ghp_••••••••••••••••

# to any other host
refused: github.token is not bound to evil.example

The code panel is an illustration of the idea, not literal output. Vault's threat model, including what it does not defend against, is in vault.md.

What's built

An agent you can leave running.

Undoes its own work, not yours

Before any tool call that changes files, Corvid checkpoints the workspace into a shadow git store, never your own repo. If you edited a file since, the revert becomes a three-way merge, so your edit is never overwritten.

/undo/rollback N

Remembers, with your say-so

Core blocks, full-text search, a vector index and a fact graph that tracks time, all searched together. A new fact is staged until you approve it.

/memory pending

Learns skills it has proven

Corvid drafts an agentskills.io SKILL.md from a successful task, replays it as a test, and saves it only if the replay passes. Existing Hermes skills and memories import for review.

/skills

Runs jobs on a schedule

Durable scheduled jobs report back where they were created, including in a chat on the gateway. You can pause, resume or remove any of them.

cron_create/cron runs

Keeps long sessions on track

Long sessions compact into a structured record. Your standing goal is re-injected afterwards, and you can name what to keep in full.

/goal/compact <focus>

Leaves an audit trail

Everything a session does goes into an append-only SQLite event log. corvid scan runs the detection rules over it afterwards, and traces export in Beacon's JSONL schema for your SIEM.

corvid scan --fail-on high

Ways to talk to it

Terminal, editor, HTTP or chat.

CommandWhat it is
corvid chatThe terminal chat, with streaming, a live tool panel and inline approvals.
corvid acpAn Agent Client Protocol agent for Zed, JetBrains and VS Code. Approvals appear as the editor's permission prompts, with the diff.
corvid serveAn OpenAI-compatible endpoint for Open WebUI and other front ends. It listens on loopback by default.
corvid gatewayTelegram, Discord and Slack bots with pairing codes. Only the owner answers approvals, and delivery is at-least-once.
corvid mcp serveCorvid's memory search and skills, offered read-only to another agent over MCP.

Status

Pre-release, and Linux first.

Everything on this page is built and in v0.1.0, except the terminal UI shown in the mockups, which is the next big piece of work. Windows and macOS come later.

Quick start
curl -fsSL https://raw.githubusercontent.com/starlinghq/corvid/main/install.sh | sh
sudo pacman -S bubblewrap   # or: sudo apt install bubblewrap

corvid doctor               # what is missing, and how to fix it
corvid model download qwen3.5-0.8b gliner2-base-v1 embeddinggemma-2 kev-0.8b
corvid chat

Good to know

  • The default models are about 10 GB. Nothing downloads until you ask.
  • Add sh -s -- --cuda to the installer for the CUDA build, which runs Kev on an NVIDIA GPU.
  • Without Kev, decisions run on a degraded tier, and corvid chat says so.

Coming next

  • The new terminal UI: inline by default, never clearing your scrollback, with fullscreen and screen-reader modes.
  • Windows and macOS.

The full roadmap →

Updates

What's new in the nest.

Release notes, design decisions and measurements as Corvid grows.

All updates →Subscribe with RSS (Atom)

Clever birds flock together.

Corvid is open source and moving fast. Star the repo to follow along, try the release, and tell us what breaks.

Star on GitHub Open an issue Meet Starling