JulianFriedleandAlexandre Teixeira
6fced41220
* feat(mcp): let a deployment declare local MCP tools Tools served by a user-configured MCP server are absent from TOOL_CAPABILITIES, so they are unknown and fail high. For a server with both a read and a write tool that is unusable: the read result arms the post-external gate, because an unknown result is not SYSTEM integrity, and the write that follows is refused until separately authorized. Every second call needs an approval, for a server that never leaves the host. Add ODYSSEUS_LOCAL_MCP_READ_TOOLS and ODYSSEUS_LOCAL_MCP_WRITE_TOOLS. Declared read tools become READ_PRIVATE with SYSTEM integrity, so their output no longer arms the gate; declared write tools become WRITE_PRIVATE and stay inside POST_EXTERNAL_BLOCKED_EFFECTS, so a run tainted by real external content still requires the approval. Unset variables keep the current behaviour exactly. Fixes #6329 * fix(mcp): secure local MCP authorization and preserve external taint gate Keep declared local MCP read tool results untrusted with EXTERNAL_UNTRUSTED integrity so they continue to arm the external-context gate. Introduce a narrowly scoped continuation exception for declared local MCP writes on the same server when no external taint or explicit error payloads enter the run. Preserves gate protection for shell execution, network egress, email, and cross-server actions. Fixes #6329 * fix(mcp): resolve local continuation against stdio transport and enforce built-in classifications Resolve declared local MCP continuation operations against connected stdio servers and enforce established built-in tool security classifications. Ensure remote HTTP and SSE servers, unverified transports, replaced sessions, stale configurations, and operations with dangerous effects or missing request grants fail closed. * fix(mcp): require sealed authority for local continuation * fix(mcp): seal local tool admission and synchronize GPU stacks --------- Co-authored-by: Alexandre Teixeira <general@alexandreteixeira.dev>
A self-hosted AI workspace for chat, agents, research, documents, email, notes, calendar, and local model workflows.
Quick Start · Setup Guide · Contributing · Roadmap
Quick Start
devis the default branch and gets the newest changes first. Usemainif you want the more curated branch.
git clone https://github.com/odysseus-dev/odysseus.git
cd odysseus
cp .env.example .env
docker compose up -d --build
Open http://localhost:7011 when the containers are healthy. The first admin password is printed in docker compose logs odysseus.
The compose files pull the official multi-arch image ghcr.io/odysseus-dev/odysseus (published by CI on every push to main and dev) and only build locally if the pull fails — so this also works on hosts without a build toolchain, e.g. as a Portainer stack.
Production deployments: pin the immutable tag instead of :latest. :latest and bare :X.Y.Z tags move on every push to main, but :X.Y.Z-<sha> (e.g. 1.0.2-7c8070f) always refers to one specific build:
ODYSSEUS_IMAGE=ghcr.io/odysseus-dev/odysseus:1.0.2-7c8070f docker compose up -d
Native installs, GPU notes, Windows/macOS instructions, HTTPS, and configuration live in the setup guide.
Features
- Chat + Agents — local/API models, tools, MCP, files, shell, skills, and memory.
- Cookbook — hardware-aware model recommendations, downloads, and serving.
- Deep Research — multi-step web research with source reading and report generation.
- Compare — blind side-by-side model testing and synthesis.
- Documents — writing-first editor with AI edits, suggestions, Markdown, HTML, CSV, and syntax highlighting.
- Email — IMAP/SMTP inbox with triage, tags, summaries, reminders, and reply drafts.
- Notes, Tasks + Calendar — reminders, todos, scheduled agent tasks, and CalDAV sync.
- Extras — gallery/image editor, themes, uploads, web search, presets, sessions, and 2FA.
Demo
A full hover-to-play tour lives on the Odysseus landing page. Its source lives under website/.
Contributing
Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, docs, and small focused refactors. See CONTRIBUTING.md and ROADMAP.md.
Security
Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model/service ports publicly.
- Keep
AUTH_ENABLED=truefor any network-accessible deployment. - Keep
LOCALHOST_BYPASS=falseoutside local development.
Deployment details are in the setup guide.
Community & Growth
License
AGPL-3.0-or-later -- see LICENSE and ACKNOWLEDGMENTS.md.