Everything it does.

148 features across eight categories, and this is the whole list rather than the flattering part of it. Each category opens with the few things worth reading slowly, then indexes the rest one line at a time.

Everything here is shipped and running today. Nothing on this page is a roadmap item, which is why some obvious things are missing: there is no per-person permission model inside one brain, no end-to-end encryption, and Mantle serves tools to your AI rather than consuming other tool servers.

Try the demo Read the source

Memory and recall

Six layers assembled on every turn, so the assistant answers from what you actually have rather than from what fits in a context window.

Six memory layers

Persona, recent turns, conversation digests, profile facts, the content index and the content store. One shared assembly path builds the same context for the web assistant and Telegram, so a ranking change lands everywhere at once.

Hybrid retrieval, vector and keyword

Searches run a vector arm and a full-text arm and fuse them with weighted reciprocal rank fusion. Semantic matches and exact rare tokens both surface, which is why an error code or a coined term is findable even though it embeds badly.

Lossless recall

A dedicated specialist finds when something was discussed by searching conversation digests, then replays the actual turns from that window. You get the words that were said, not a summary of them, and truncation is reported rather than silent.

and 21 more

Knowledge graph in Postgres: Typed, directional, temporal entity edges traversed with recursive CTEs. No second database.
Automatic fact extraction: New content is mined for facts, deduped against existing ones and classified add, update, delete or no-op.
Facts cite their source: Every fact keeps a link back to the content it came from, with validity dates and supersession lineage.
Section-level chunking: Documents split into passages that carry their heading path, overlapping so a fact spanning a boundary is embedded whole.
Contiguous section reads: Ask for a heading outline, then read one section in order, between scattered passages and a whole file.
Salience down-weighting: Bulk and marketing mail rank lower without being filtered out, so it stays findable when you ask for it.
Supersession: A superseded document is demoted and every hit on it is annotated with the living version.
Recency decay by fact kind: Episodic facts age; semantic and preference facts do not decay at all.
Entity resolution: Names, aliases, trigram and embedding matching resolve to one entity, with a guard against merging different people who share a surname.
Duplicate review: A tiered merge queue with one-click merge or dismiss; a merge repoints every fact, mention and edge in one transaction.
Corpus map on every turn: A cached, branch-grouped list of what exists, so the assistant knows the shape of the brain before it searches.
Preferences always injected: Recent preference facts ride into every turn regardless of vector match.
Identity from the journal: Journal entries distil into an always-on block about you, built deterministically with no model call.
Conversation digests with topics: Long conversations roll into digests split by topic, each embedded and searchable.
Persona evolution: A background reflector appends style and relationship notes to an agent over time, never overwriting its seed prompt.
Brain capacity accounting: Documents and passage vectors counted against a split policy, surfaced as a dial and to the assistant.
Recall evaluation harness: Golden question sets scored for recall and MRR across five retrievers, with a baseline flag as a regression gate.
Spreadsheet profile indexing: Sheets index as a profile per sheet rather than embedding grid rows, which kept row noise out of retrieval.
Tables index as schema: A table contributes a data dictionary, never row dumps; rows are reached with SQL instead.
One embedder, one vector space: A single 768-dimension embedding config for the whole brain, with a primary and backup route to the same model.
Embedding cache and re-embed: Content-hash cache makes re-embedding free where nothing changed; a rebuild walks every layer with progress.

Getting your material in

Adding is remembering. There is no "save this to memory" step: anything that arrives is parsed, indexed, mined for facts and connected to the graph.

Contacts are the gate, both directions

Mail is ingested only from people in your contacts, by exact address or a whole domain. The same list bounds who the assistant may write to. Delete a contact and you revoke both at once.

Documents actually read, not filed

Three tiers of parsing: in-process for PDF, Word and spreadsheets, a self-hosted Tika container for the long tail, then an honest skip. A scanned PDF with no text layer is rasterised and read by vision rather than indexed by filename.

Microsoft 365

SharePoint, OneDrive and Outlook through your own Azure app registration, with per-drive opt-in and a folder picker. Files join the same pipeline as everything else and mail obeys the same contacts gate.

and 18 more

IMAP mailbox sync: Any IMAP host, credentials sealed, incremental sync on a schedule.
Backfill on a new contact: Adding someone pulls their recent history in immediately instead of waiting for new mail.
Sender discovery: A bounded scan lists recent senders who are not contacts yet, storing nothing itself; one click adds them.
Delivery-kind classification: Every message tagged direct, list, automated or marketing from headers alone, feeding salience.
Per-account folder scoping: Choose exactly which mailboxes are scanned and how far back the first scan reaches.
Attachments become files: Each attachment is deduplicated across the brain and lands as an ordinary file node, extracted normally.
Images inside documents: Diagrams and screenshots are pulled out of Word, PowerPoint, Excel and PDF in reading order and named from their captions.
Password-protected PDFs: Saved passwords are tried in turn so protected statements index without manual decryption.
Spreadsheets become tables: Every sheet of an uploaded workbook becomes a queryable tab, whatever path the file arrived by.
Microsoft Project import: An MSPDI export becomes typed Tasks, Resources and Assignments tabs, detected by content rather than extension.
Files mirrored to disk: Everything under files is a real folder on the host, so cp, vim, Syncthing and a folder copy all work.
External edits round-trip: A watcher reflects off-Mantle changes back into the brain and re-indexes them.
Documentation collections: Point it at folders of markdown and they sync one way into the brain, with a choice of retrieval-only or full extraction.
Calendar subscriptions: Any iCalendar feed, read-only, with recurring series expanded into individual events.
Events are first-class: Synced events are ordinary searchable nodes, so a question about this week spans your calendar and your mail.
HEIC transcoding: iPhone images convert before vision reads them.
Content-addressed storage: Bytes go to any S3-compatible store, deduplicated by hash; the bundled stack ships MinIO.
Honest refusals: A format that cannot be read is recorded as skipped with the reason and the recovery step, never as a silent success.

Work that happens without you

The difference between a chat window and a brain that is awake: standing instructions, durable jobs and background workers that run whether or not you open the app.

Heartbeats

A standing instruction with a schedule, a skill, an agent and a memory that persists across fires. It can end itself when its job is done, and it respects quiet hours, cooldowns and earliest-time guards rather than pinging you at 3am.

Durable runs

Big jobs are planned as a tree of sequential and parallel steps and executed from compiled state. A run survives closing the page, a restart or a crash, can be cancelled, and asks a question rather than guessing when it hits one.

AI workers

Extraction, summarising, persona reflection, speech to text, text to speech, vision and image generation each run as their own background job with their own model, provider and key, and their own primary and backup route.

and 17 more

Specialist agents: Recall, research, pages, tables, docs, code, apps, integrations and formulas each have a dedicated agent the assistant delegates to.
Worker groups: A run step fans out to a panel of workers, then an audit step judges every attempt and produces the authoritative answer.
Chat failover between different models: A primary and a backup route that can be different models entirely, so a local model can fail over to a cloud one.
Bulk model switching: A matrix of every agent and worker, staged as before and after, applied in one go.
Traces: Every unit of work broken into ordered steps with tokens, cost, duration and status, openable as a step tree.
Delegated work is attributed: A specialist run gets its own child trace and its cost lands against the specialist, so per-agent spend stays honest.
Journey: A live action-and-reaction feed: what arrived, what the brain did about it, and what is running now.
Node history: Every trace that ever touched one item, gathered into a single timeline.
Agent studio: The whole agent graph on a canvas, with a composed-prompt preview, a sandbox that persists nothing, and versioned prompt history with diff and revert.
Live turn streaming: Tool calls, reasoning and tokens stream as they happen, with gap-free replay if the connection drops.
Stop a turn mid-sentence: A running answer can be interrupted.
Runners console: Queue health, timing and bounded, recorded retries for the durable workflow machinery.
Maintenance reports: A nightly read-only pass, including a check that the model ids your agents pin still exist.
Brain health heartbeat: A weekly capacity and recall check that messages you only when something has drifted.
Skipped work is recorded: A pipeline that consciously declines writes a trace saying so and why, rather than going quiet.
Tool calls are checked before they run: Deduplication, volume caps, schema validation with teaching errors, loop guards, then the approval gate.
Live narration: A separate worker turns raw step events into readable status, keeping the grounded trail distinct from the prose.

Where the work lives

Documents, data and small applications that are ordinary content: indexed, searchable, editable by you and by the assistant.

Pages

Rich documents with callouts, columns, tables, to-dos, code, maths and Mermaid diagrams. Typing autosaves a private draft and only an explicit commit publishes and re-indexes, so a long writing session costs one indexing pass rather than dozens.

Tables

Each table is a real SQLite workbook with tabs and typed columns, including formulas and cross-tab reference columns. The assistant answers questions by running read-only SQL against it, so a table stays useful at a size no prompt could hold.

Mini-apps

Describe what you want and a specialist writes real React and TypeScript, compiles it, fixes its own build errors and leaves a live preview themed to your palette. Each app gets its own isolated database and runs sandboxed with no direct network.

and 18 more

Notes: Quick markdown capture, summarised and mined for facts on save.
Journal: First-person entries with a mood and a life area, feeding the always-on identity block.
Tasks: Status, priority and due date, indexed and assistant-manageable.
Events: Start, end, location, recurrence and reminders that reach you on your last-used channel.
Secrets: A sealed vault whose titles and tags are searchable while the values are never shown to any model.
Formulas: A stored model of a calculation with branches, lookup tables and units, evaluated with a derivation trace and failing loud rather than returning a silent zero.
Block-addressed editing: Every block carries a stable id, so the assistant can rewrite one paragraph instead of the document.
Visual diff review: A review mode paints exactly what a commit will publish, per block, with discard and restore.
Sub-pages and splitting: Split a long page along its headings or lift one section into a child, deterministically.
Mentions become edges: An @-mention of a person or a document becomes a real graph edge on commit, with a backlinks panel.
Markdown in and out: Toggle a page to raw markdown and back; paste a Notion export and it becomes real blocks.
Embedded assets are indexed: A page is searchable by what is inside the files and images it references.
Export to Office: Pages and notes to .docx, tables to .xlsx with a totals row, or the raw workbook as SQLite.
Read-only SQL: Filter, count and join across tabs under a watchdog with row caps.
App activity log: Every open, tool call and write by a team member, attributed by name.
Search palette: Command-K across the whole brain, with navigation built in.
Universal permalinks: One id route resolves any item to whichever screen edits or displays it.
In-app documentation and changelog: The guide is readable in the app and indexed into the brain, so the assistant explains itself with citations.

Ways to talk to it

One continuous conversation rather than sessions, reachable from wherever you happen to be.

No sessions

The same thread continues across the web, Telegram and mobile. Nothing falls off the end of a context window, because the memory layers are what carry continuity rather than the transcript.

Telegram, including voice

Text, voice notes and photos from your phone. A voice note is transcribed before the assistant sees it and the reply can come back as a real voice message. Gated tool calls arrive as approval cards you can act on from the chat.

Formatted replies

Answers come back as documents rather than walls of text: headings, callouts, tables, checklists, columns, diagrams and images placed mid-answer where the sentence needs them. Any reply can be saved as a page.

and 11 more

Dictation and attachments in chat: Speak into the composer, or attach images, PDFs and spreadsheets to a question.
Question-aware reading: An attachment gets an immediate read for the answer at hand, separate from the neutral durable index.
Desktop app: The owner interface as a native app on Linux, macOS and Windows, with OS notifications and deep links.
Multiple brains from one desktop: Each saved brain keeps an isolated login, switched with a shortcut.
Mobile companion backend: Per-device revocable tokens, unread counts and live chat over server-sent events.
Sealed push notifications: Assistant replies and pending approvals sealed per device and handed to a relay.
Reminders follow you: An event reminder arrives on the channel you last actually used, overridable in your profile.
Live-updating screens: One database listener fans out to every open tab, so a screen repaints the moment new mail or files land.
House style: Free-text writing rules that reach every agent and outrank the shipped guidance, never applied to quoted text or code.
Per-login assistants: Each login can have its own assistant and its own thread. Separation, not privacy.
Named voices: A per-agent text-to-speech voice, including cloned voices where the provider offers them.

Other people, without giving up the brain

Colleagues get answers and peers get scoped data, and neither becomes a tenant inside your instance.

Team members are contacts

Flip a switch on a contact and they get a token, shown once, that is their whole credential. No parallel user list, no accounts to provision, and membership is re-checked on every request so revoking is instant rather than at the next login.

A read-only responder

The agent answering your team can read broadly and has exactly one write: filing a change request into your review queue, stamped with who asked and from which message. A build test fails if that shape ever changes.

Federation between brains

Two sovereign Mantles exchange scoped data with a token per direction. Grants are per item or a standing subscription to a whole category, resolved when the query runs, and every cross-brain read is traced.

and 13 more

Team forum: Titled multi-author threads with kinds, visibility and status, answered into the thread by the team responder.
Team workspace: A read-only mirror listing the notes, pages, tables, apps, tasks and events you have shared.
Team hub: A briefing screen for members, or a mini-app you designate, which falls back safely if anything in the chain breaks.
Quarantined uploads: Member uploads land outside the files tree and are never auto-ingested; you file or dismiss them.
Private corpus off by default: Email and journal are stripped from team answers unless you explicitly opt in, with a dialog spelling out the blast radius.
Per-member access log: Auth, turns and denials per person, each answer linking to its full trace.
Spend and rate caps: A daily turn budget per member, plus burst limits on posts and uploads.
Public share links: Read-only links for eight content types, revocable, one active link per item, never indexed by default.
Never-shareable types: Secrets, email and contacts are refused at the API, not merely hidden in the interface.
Live folder shares: A shared folder covers files added later and denies files moved out, evaluated per request.
Sub-page cascade: Share a page with its descendants; un-sharing the parent revokes the children.
Category grants: Grant a peer a whole content type and future items are included, without materialising a list.
Deadlock-free pairing: Add a peer with just a name and a URL and paste the token later, so neither side has to go first.

Connecting it to everything else

Point your existing AI tools at the brain, and let the brain reach services you already use.

A full MCP server

Claude Desktop, Claude Code or any MCP client gets the brain as tools: search, the graph, files, notes, tasks, events, pages, tables and apps. Two transports, a local one over stdio and a remote connector behind OAuth that is off by default and invisible until you enable it.

API console

A built-in request builder over three live catalogues: the REST routes, the MCP tools listed from the real server, and the agent tools run through the exact dispatcher agents use. Prove a request works, then save it as an agent tool.

An agent that builds integrations

Point it at a service’s API documentation and it creates the tool group, writes the request templates, tests them against the live API, distils a usage skill and hands the result to an agent. Credentials resolve from the vault at call time and never reach the model.

and 12 more

Tool groups: Capability is granted in named bundles; a group carries its service, base URL, credential placement and documentation.
Skills: Reusable prose know-how attached to an agent, which can carry the tools it requires.
Templated HTTP tools: Placeholders fill from the model, secret references resolve inside the dispatcher, and error text is scrubbed back to the reference.
cURL in and out: Paste a command from a vendor’s docs to fill the builder, or emit one with secret references left unresolved.
Encrypted credential vault: Third-party keys sealed at rest, shown once, listed from a mask rather than by decrypting, and rotated in place.
Web search and page reading: Cited search results and a guarded fetch that cannot reach private or metadata addresses.
CLI sandboxes: Persistent isolated containers with three egress tiers, a host directory that outlives the container and a full command history.
Talk to a persona over MCP: Run a real turn of a responder agent, with its memory and its tools, persisting nothing to its history.
Approvals reach every surface: A confirmation-gated tool queues for approval whether it was called in chat, over MCP or by a run.
Provider breadth: Chat, embedding, vision, speech and image models across the major providers, with a documented seam for adding another.
Local models over a private network: One auth key lets a hosted brain reach a GPU box at home by name, with no port forwarding.
Local embedder: A keyless on-box embedding model, so vectors never leave the machine.

Running it, and trusting it

A brain that reads your inbox and holds your keys has to be operable and honest about its own limits.

Ingested content is data, never instructions

Retrieved mail, pages and tool results are fenced with explicit markers, and forged markers are stripped so a payload cannot escape. The real defence is structural: on every external surface the worst an injected prompt can do is what that surface’s write path already allows.

Approval gates upstream of execution

A tool marked as requiring confirmation never dispatches inline. The loop writes a pending row instead, so there is no path where an agent talks its way past the gate, and an operator’s requirement outranks an agent’s preference.

One line to install

One command checks disk, memory, ports and DNS before a large pull, generates its own secrets, brings up the stack behind automatic HTTPS and runs migrations before the app starts. A failed health check says the install is incomplete rather than printing a URL that will not answer.

and 14 more

Sealed secrets and credentials: API keys, mail passwords, bot tokens and vault entries sealed with the row id bound in, so a value cannot be replayed in another row.
Staged key rotation: A new master key stages alongside the old one, and a script walks the tables.
Audit log: Who caused what, distinguishing a login from the assistant, an MCP client, a peer and a team member.
Revocable sessions: Every live device session listed and individually signed out.
Scheduled backups: Verified database dumps on a schedule with rotation, including every mini-app database.
Restore drill: A restore script and an explicit list of what to copy offsite, including the caveat about the master key.
Update from the interface: A sidecar with no ports and exactly one hardcoded operation pulls images and rolls the stack.
Configuration drift check: The live agent, skill and tool graph diffed against the shipped manifest, adoptable item by item.
Integrity checker: Add content and watch its full memory footprint appear, plus a corpus audit for invariant violations.
Spend visibility: Cost by model and by agent, with a seven-day comparison and a thirty-day series.
One Postgres: Vectors, graph, full-text, job queues and realtime in one database. A backup is a dump plus a folder.
Themes that pass their own contrast test: Forty-one palettes solved from seeds, with contrast asserted in CI for every theme in both modes.
Uninstaller: Removes the stack and keeps your data by default, with a dry run that prints the blast radius first.
Dual licensed: Free for self-hosting and internal business use under the FSL, each release turning MIT two years after it ships, with a commercial licence for competing or embedded use.

The honest way to judge this list is to use it.

The demo runs the real application over a seeded, read-only brain, and the source is open, so nothing above has to be taken on trust.

Try the demo How it is built