Moltis is one file. You download it, you run it, done. There's no plugin store, no package manager, no runtime that could be compromised. The entire application is a single binary you can verify.
Your AI runs in a sandbox by default. It can't read your files, run commands, or browse the web unless you explicitly allow it. Every tool action can require your approval — or you can pre-approve specific ones you trust.
Your passwords and API keys are wrapped so they can never be accidentally logged, and the memory is zeroed the moment they're no longer needed. The language it's built in (Rust) makes entire classes of security bugs impossible at the compiler level.
What you won't find here
No plugin marketplace to get compromised. No JavaScript runtime. No dependency tree of 1,200 packages you can't review. One binary you can audit end to end.
How we protect you
What if...
How Moltis handles it
Someone finds your instance
Password or passkey required from first launch, automatic HTTPS, rate limiting
AI tries to run dangerous code
Everything runs in a sandbox (Docker or Apple Container). Each action needs your approval first
A dependency gets compromised
There are no npm/pip packages to compromise. One binary, auditable dependencies. Integrations like Telegram are built-in, tested code
AI accesses your internal network
Internal and private network addresses are automatically blocked
Someone tries to steal your keys
API keys and passwords are hidden from logs and zeroed in memory after use
Session gets hijacked
Origin checking prevents cross-site attacks, HTTPS enabled by default
Unauthorized access
Passkeys, scoped API keys, per-tool permission policies
Sandboxed execution
Docker & Podman
Each conversation gets its own isolated container. Shell commands and web browsing happen inside the sandbox, not on your real system.
Apple Containers
On Mac, uses Apple's built-in virtualization for lightweight isolation — no Docker needed.
WASM sandbox
Wasmtime-based sandbox with generic failover. Lightweight isolation without containers.
Fully open source
0
unsafe in core*
0
npm dependencies
~5K
LoC agent core
~150K
lines of Rust (full)
85%
files with tests
MIT
license
*2 unsafe impl Send/Sync exist for the llama.cpp FFI wrapper, only compiled with the optional local-llm feature.
macOS
Linux
Windows
