English · Français

ELY

The sovereign AI agent for people and organisations that can't afford to leak data.

Self-hosted · GDPR-native · multi-user · multi-LLM · self-developing · 10 channels · 181 built-in tools — plus the ones ELY writes herself.

Website · Documentation · Licence · Roadmap · Discussions

Note on licensing. ELY is licensed under the Elastic License v2 — free for any personal use AND any internal business use, regardless of organisation size. You can run it, modify it, distribute it. The only restriction: you cannot offer ELY as a hosted or managed service to third parties (no SaaS resale). Full source published and auditable.

---

ELY masks personal data before any LLM call
_{PII masking in action — sensitive values are masked before cloud model calls (scope & limits in docs/security.md).}

---

Why ELY exists

Cloud AI agents — ChatGPT, Claude, Gemini, the upcoming Google Remy, OpenAI Operator, Microsoft Copilot — are powerful, but they all share the same architecture: your raw data goes to a third-party server in the United States. Emails, IBANs, client names, medical records, contract drafts — all transit through models you don't control, in jurisdictions that aren't yours.

For a curious individual, that's a tradeoff. For a law firm, a medical practice, an SMB handling contracts or client files — it's a non-starter. Professional secrecy, GDPR, regulated sectors don't allow that compromise.

ELY is the answer for the people and organisations who need an AI agent that runs on their hardware, anonymises sensitive data before any model call, asks before every irreversible action, and respects European sovereignty by default.

---

The four pillars

Sovereignty Your hardware. Your data. Your jurisdiction. Self-hosted on your Mac, server, NAS, on-prem or sovereign cloud Local-first routing — simple/medium tiers run on your local model (Ollama, LM Studio MLX). Mistral preferred for cloud tier C, keeping data inside the EU. GDPR-native by construction · DPA available · DPIA template provided Zero telemetry · zero phone-home · zero forced cloud dependency Source code auditable (Elastic License v2)

Security Sensitive data is masked before cloud LLM calls. Irreversible actions never run unattended. Native PII anonymisation — emails, IBANs, credit cards, API tokens, phone numbers, French SIRET masked by regex before the prompt is built on the agent path. Coverage, the optional NER layer and known limits are documented in docs/security.md. Structural HITL — every irreversible tool (mail send, file delete, SSH, sharing) pauses for explicit approval. Allow once · deny once · ban permanently (persisted across sessions). Server-side encrypted vault (AES-256-GCM, key derived from your master password) for credentials. Immutable audit trail — every approval logged, exportable for compliance.

Integration Plugged into the tools your team already uses. Full Google Workspace — Gmail, Calendar, Drive, Docs, Sheets, Tasks, Contacts (75 tools, full read/write with HITL on every destructive action) 10 channels — Web · Voice (wake-word "Éli") · PWA · iOS native · Android native · Telegram · WhatsApp · Slack · Discord · ntfy push Native push notifications for HITL approvals (FCM + APNs) — most competitors only proxy via messaging bots 181 tools across web automation, system, RAG, vault, missions, self-improvement

Architecture Multi-user. Multi-LLM. Built to scale across a family or an organisation. Multi-user native — and hardened for it (June 2026 campaign: 11 releases) — one deployment serves a family, a team, or an SMB. Each user has their own memory, vault, approval queue, daily LLM budget, rate limits and storage quota. Secrets encrypted at rest, Alembic migrations, nightly backups, deep healthchecks. Multi-LLM with complexity tiers — assign different models to Tier A (fast) / B (standard) / C (deep) / IMG / SYS. Local for simple tasks, Mistral or Anthropic for complex ones — your choice, no restart. 11 LLM providers supported · auto-fallback on outage · Anthropic prompt caching enabled Channel-to-user mapping prevents impersonation across messaging platforms

---

What makes ELY different: it improves itself

Most agents are static. ELY watches its own failures and gets better — transparently, with you in control.

• Self-developing agent — ELY writes her own tools. When ELY repeatedly hits a missing capability, she doesn't just draft a Markdown playbook (V1) — she generates a real Python tool (V2), and since v1.16 even real network integrations (V3): the generated tool declares its egress domains, its Vault secrets and its dependencies, passes a 7-stage validation pipeline (AST guard → declarations → deps allow-list → ruff → mypy → sandboxed smoke test → registration), gets its scope reviewed by the admin (domains / secrets / deps panels), then runs in an isolated sandbox behind a filtering egress proxy — with HITL on its first 10 invocations (canary) before it's trusted. Nothing ever goes live without a human gate.
• Structured missions that ask instead of guessing (v1.17). Describe a multi-step workflow in simple YAML — steps, foreach over a previous step's results, and edge-case handlers: on_ambiguous: ask_user("…"), on_not_found: skip_with_note("…"). When ELY hesitates, she pings you (web, push, Telegram), you answer, she resumes — while the other items keep running. Forgot a case? Add one line, not a prompt rewrite. A live list viewer shows every step and item (✓ ⏳ ⏸ ⊝) with inline answers.
• LLM-as-judge self-critique. Every autonomous mission is graded post-mortem by a separate model that reads the full step trace and flags "façade success" — when the agent claims it succeeded but the steps show it didn't. The verdict feeds the learning loop.
• Radical transparency. Two dashboards — /me/learning and /me/state — show you exactly what ELY learned from you and the model it holds of you (mood, focus, open loops). Editable, killable, never hidden.
• Cognitive typed memory. Five memory types (episodic · semantic · procedural · error · constraint) instead of one opaque blob — recalled per-type, across conversations, all local.
• MCP client. Consume any Model Context Protocol server — ELY's toolset extends without a code change.
• 50-scenario regression bench + nightly CI. Self-improvement ships safely because every subsystem is pinned by a deterministic harness that runs every night.

---

ELY vs. the Alternatives — An Honest Comparison

We respect what other projects do well. We are explicit about what sets us apart.

	ELY	Other Self-Hosted Agents	Hosted AI Assistants
Self-Hosted on Your Hardware	✅	✅	❌
Anonymized PII before LLM Call	✅ Native	⚠️ Plugin or Absent	❌
HITL Enabled by Default, Cannot Be Disabled	✅ Structural	⚠️ Configurable	N/A
Multi-User (Family / Team / SMB)	✅	❌ Often Single-User	✅ (Cloud Publisher)
Hybrid Local/Cloud Routing	✅ Explicit Third Parties	⚠️ Manual / Partial	❌
Native Mobile Apps (iOS + Android)	✅	❌ Rare	✅
Encrypted Vault (Zero-Knowledge)	✅ AES-256-GCM	❌ Rare	❌
Full French Interface	✅	⚠️ Often EN Only	⚠️ Partial
License	Elastic v2 (free internal use, no SaaS resale)	Variable	Proprietary

Our Honest Read. Other self-hosted agents have larger communities and more channel adapters. If you handle data that you cannot afford to leak—yours, your family's, your clients'—ELY's anonymization pipeline and structural HITL are the reasons why you should choose it over the alternatives.

---

Who ELY is for

Privacy-conscious individuals & families — you want a powerful AI assistant but you refuse to send your inbox, banking details and medical history to OpenAI, Google or Anthropic. Run ELY on your own hardware. Free under the Elastic License v2.

SMBs in regulated sectors — law firms, accounting practices, medical practices, HR consultancies, notaries, local government. You handle data covered by professional secrecy or GDPR. ELY's anonymisation pipeline is the difference between "we considered AI" and "we deployed AI." Internal business use is fully covered by the licence — no extra agreement needed.

→ Detailed personas and deployment scenarios on agent-ely.fr.

---

Quick start

Prerequisites: Docker · Docker Compose · 16 GB RAM (32 GB for local LLMs) · 20 GB disk · make (preinstalled on Mac and most Linux) · openssl (preinstalled everywhere).

# 1. Clone
git clone https://github.com/franckolv-dev/ElyAgent.git
cd ElyAgent

# 2. Configure — minimum: a JWT secret
cp .env.example .env
# Generate a 64-char hex secret and replace the placeholder in .env:
#   macOS / Linux: openssl is always available
sed -i.bak "s|^JWT_SECRET_KEY=.*|JWT_SECRET_KEY=$(openssl rand -hex 32)|" .env && rm .env.bak

# 3. Pick a LLM provider (REQUIRED — without this, ELY can't answer anything)
# Easiest free option: Google Gemini key (Anthropic / Mistral / OpenAI work too)
# 1. Grab a free key at https://aistudio.google.com/apikey
# 2. Paste it into .env on the line GEMINI_API_KEY=
# 3. Change ACTIVE_LLM_PROVIDER from "ollama" to "gemini" in .env
#
# Full provider list and setup links: docs/SETUP_AI_PROVIDERS.md

# 4. Boot the stack (first run downloads ~2 GB of images, takes 5-10 min)
make up

# 5. Watch logs until the backend is healthy
make logs s=backend     # ctrl-C once you see "Application startup complete"

# 6. Open http://localhost:3000 — first signup becomes admin
#    Password policy: min 12 chars, at least one uppercase + one special char (!@#$%^&*…)

Without an LLM key: ELY boots fine but every chat message will fail with a connection error. The default ACTIVE_LLM_PROVIDER=ollama assumes a local Ollama is running on the host — install it from https://ollama.ai or switch to a cloud provider in .env.

→ Full setup guide for non-developers → Four scenarios, from 30-min local install (Scenario A) to fully remote deployment with Cloudflare Tunnel and all messaging channels (Scenario D). No prior knowledge of Docker, Google Cloud or APIs assumed.

→ Browser Extension setup → for ELY to act on your real Chrome tabs (LinkedIn, Gmail, GitHub, Amazon…) with your existing sessions. Optional but it's the killer feature.

→ Troubleshooting → if make up fails, the first chat errors out, or ports clash with another project.

---

Browser autonomy — ELY acts in your real Chrome

The killer feature no cloud agent can replicate.

ELY ships with a Chrome extension that lets the agent read and act on the tabs you already have open, using YOUR authenticated sessions. No headless Playwright with empty cookies — it's your actual browser, with your actual logins.

What this enables, with zero credentials shared:

• "How many impressions did my last LinkedIn post get?" → ELY opens linkedin.com (your session, already logged in), reads the data, closes the tab. ~5 seconds.
• "What's in my Gmail inbox?" → reads via the Gmail web UI, no API token needed.
• "Summarise this Amazon order page" → captures + reads the rendered page, even when anti-bot blocks DOM extraction (falls back to Gemini Vision).

You → ELY → Chrome Extension → YOUR Chrome tab → site (with YOUR cookies)
                  ↑
             ELY backend never sees your cookies, never stores credentials

Setup (one-time, 2 min):

1. chrome://extensions/ → enable Developer Mode → Load unpacked → select extension/chrome/
2. Right-click the ⚡ ELY icon → Options → paste your ELY backend URL + access token
3. Done — pop-up turns green when connected

→ Full extension docs: extension/chrome/README.md

---

What ELY can do

A real product UI on every surface — not a terminal dressed as a website. ELY treats the UI as a first-class citizen, including for non-technical users.

Security pipeline — PII masking · HITL · vault · audit trail

• PII masking pipeline. Deterministic regex detection of emails, IBANs, credit cards, API tokens, phone numbers (all French formats), SIRET, employee IDs. Deterministic placeholders, reversed only when displayed back to you. A local NER layer (GLiNER) for names/organisations in free text is benchmarked and in evaluation.
• Human-in-the-loop. Blocks 30+ tool categories by default. Three actions: allow once, deny once, ban permanently (persisted across sessions).
• Encrypted vault. AES-256-GCM, per-user key derived from password. Zero-knowledge.
• Audit trail. Immutable JSON Lines. Exportable for compliance.

Full security model →

Multi-LLM engine — your keys, route by complexity tier

Configure providers in Settings → AI Models. Assign each tier (A/B/C/IMG/SYS) to a model. Switch any time, no code, no restart.

• Cloud: Mistral (preferred, EU) · Anthropic · OpenAI · Gemini · Qwen API · Moonshot Kimi K2.x · DeepSeek · Zhipu · OpenRouter
• Local: Ollama · LM Studio (MLX on Apple Silicon)
• Auto-detected compact prompts so 7B local models actually obey tool_choice="required"
• Auto-fallback if a provider goes down — disable per-tier for pure-local testing

Google Workspace integration — 75 tools, full read/write with HITL

Gmail · Calendar · Drive · Docs · Sheets · Tasks · Contacts. High-level tools, batch operations, and a raw_api_call escape hatch for any method of the official Google Python client. Critical raw calls still trigger HITL. Multi-Google-account support — link several mailboxes to one ELY user.

Missions — goal-driven loop that survives restarts, now with structured specs

Give ELY a goal — she breaks it into steps, picks tools, executes, evaluates, replans on failure, and notifies you on completion. Five guardrails: token budget · iteration budget · optional deadline · HITL on critical tools · anti-loop replan after 3 consecutive failures. Every terminal mission is graded by an external LLM-as-judge that flags "façade success".

Structured missions (v1.17) — replace the monolithic prompt with a YAML spec:

version: 1
steps:
  - id: enrich
    foreach: "{{ read_companies.output }}"
    do: "Find the CEO of {{ item }} on LinkedIn."
    on_ambiguous: ask_user("Several results for {{ item }} — which one?")
    on_not_found: skip_with_note("Not found")
    on_error: resume_next

The LLM stays in the loop (the spec frames execution, it doesn't replace reasoning) ; declared edge cases are signalled, not improvised ; ask_user pauses the item, pings you on every channel, and resumes on your answer while the other items keep running. Live list viewer with inline replies. Deterministic completion — no LLM-judged "done". Legacy free-text missions unchanged.

Self-development & learned tools — ELY writes her own tools, you hold the gate

Failure signals (HITL refusals, hallucination blocks, mission critiques, "missing tool" gaps) feed a learning loop with three maturity levels, all shipped:

• V1 — Markdown playbooks drafted from mined failures, scored by an external judge, promoted by you.
• V2 — pure Python tools: ELY generates a real @tool (composition + computation), validated by a 5-stage pipeline (AST whitelist → ruff → mypy → smoke → registration) before landing as a candidate.
• V3 — real network integrations (v1.15–v1.16): generated tools may call external APIs — with declared egress domains (enforced by a filtering Squid proxy), Vault secrets injected at runtime (never in the source), dependencies bound to an allow-list, execution in an isolated sandbox (read-only rootfs, no capabilities, resource limits), a per-call audit trail, admin review of the scope (domains/secrets/deps panels, not just the code), and canary HITL on the first 10 invocations.

Only promoted (active) tools are ever bound to the agent — the human is always the gate. A 50-scenario regression bench + nightly CI keeps the whole loop honest. Next: V4 — graduating battle-tested learned tools into core code (→ v2.0).

Radical transparency — see what ELY learned about you, and change it

/me/learning shows the failure signals + verdicts ELY recorded; /me/state shows the live model it holds of you (mood, focus, recent topics, open loops, energy). Both are user-readable, editable, and killable — no hidden profiling.

Channels — 10 ways to reach ELY

Web UI · Voice (wake-word "Éli") · PWA · iOS native · Android native · Telegram · WhatsApp · Slack · Discord · ntfy push. Same agent, same memory, same security across all surfaces.

Memory & RAG — local Qdrant + SQLite FTS5

PDF · TXT · Markdown · CSV · JSON · DOCX. Everything local — no remote embedding services. ELY decides when to search, reranks results, cites sources.

LLM Arena, Desktop daemon, Smart File Manager

Blind LLM head-to-head ELO ranking · Native Go desktop daemon for local automation · On-device duplicate detection on Android (files never transit the backend).

---

Architecture

┌──────────────────────────────────────────────────────────────────────┐
│  USER INPUT  ─→  PII Filter (mask)  ─→  Complexity Router            │
│                                                          │           │
│  RESPONSE  ←─  Restore real values  ←─  HITL gate  ←─  LangGraph     │
│                                                          │           │
│                                              ┌───────────┼─────────┐ │
│                                              ▼           ▼         ▼ │
│                                         Local LLM     Tools     Cloud│
│                                         (Ollama,      (181)    (PII-│
│                                         LM Studio)             masked)│
└──────────────────────────────────────────────────────────────────────┘

→ Full architecture deep-dive

---

Stack

Layer	Technology
Backend	Python 3.12 · FastAPI · LangGraph · uv
Frontend	Next.js 16 · TypeScript · Tailwind · Three.js
Mobile	iOS SwiftUI · Android Kotlin/Compose
Desktop daemon	Go (Linux · macOS · Windows)
LLM providers	11 (cloud + local)
Memory	Qdrant · SQLite FTS5 · fastembed
Auth	JWT HS256 · Argon2id · HttpOnly refresh cookie
Vault	AES-256-GCM, per-user key derivation
Push	FCM · APNs · Telegram · WebSocket
Infra	Docker Compose · nginx · Cloudflare Tunnel

---

Roadmap

Shipped (May–June 2026)

• Auto-Developing Agent — complete (V1→V3) — ELY writes her own Python tools, including sandboxed network integrations with declared egress, Vault secrets, 7-stage validation, admin scope review and canary HITL
• Structured missions (v1.17) — YAML specs with foreach + edge-case handlers; ask_user pauses, pings you, resumes on your answer; live list viewer
• Multi-user hardening campaign (11 releases, v1.14.1→v1.14.11) — cross-user isolation audit, per-user budgets/quotas/rate limits, secrets encrypted at rest, Alembic migrations, nightly backups, single-process lock, deep healthchecks
• Cognitive typed memory — 5 memory types, cross-conversation recall
• Radical transparency — /me/learning + /me/state dashboards
• Measured self-improvement loop — failure signals, LLM-as-judge mission critic, admin review/promotion
• MCP client — consume any Model Context Protocol server
• 50-scenario regression bench + nightly CI · 1,860+ automated tests

Next

• V4 — Graduation (→ v2.0). Battle-tested learned tools promoted into core code, with bench-gated non-regression.
• MCP server — expose ELY itself as an MCP server (your agent, pluggable into Claude Desktop / Cursor / Zed).
• PII layer 2 (NER) — local GLiNER model to mask person/organisation names in free text (benchmarked, in evaluation).

→ Full public roadmap →

---

Licence

Source code — Elastic License v2

In plain language (informative — the LICENSE file is the legal text):

You are free to — use ELY for any personal use (household, family) · use it for any internal business use, any organisation size · modify the source and run your version · distribute it (modified or not) keeping the LICENSE + copyright notices.

You may not — offer ELY as a hosted or managed service to third parties (no SaaS resale) · remove or hide the copyright/licence notices · disable or circumvent any licence-key mechanism.

→ Plain-language summary on the official site →

Trademark. The names ELY, Éli, agent-ely.fr, the 3D avatar and the lightning-bolt logo are protected separately from the code.

📩 Contact: contact@agent-ely.fr — replies within 48h, always.

---

Contributing

ELY is open source under the Elastic License v2. ✅ Bug fixes · documentation · translations · channel adapters · performance · tests · ⚠️ Architectural changes — open an issue first.

Full contribution guide → · Code of Conduct → · Security policy →

---

**Built in Nouvelle-Aquitaine, France **

Website · Documentation · Sponsor · Newsletter