Enterprise-hardened
SLSA Level 3 provenance, cosign-signed checksums, CycloneDX SBOM, reproducible builds, rootless Podman with dropped capabilities.
$ rousseau chat
session bc4a-42d1 · provider=claudecli · workspace=~/team-rousseau
type help or ask anything · Ctrl+L clears
Multi-modal reach
Nine chat transports behind one daemon — WhatsApp, Signal, Telegram, Matrix, Slack, Discord, iMessage, Email, SMS. No public HTTP surface required.
Model-agnostic
Five LLM provider families behind one agent.Provider interface — claudecli, Anthropic, AWS Bedrock, Google Vertex AI, OpenAI-compatible.
MCP-native
Ships a Model Context Protocol server over stdio. Any MCP-compatible client — Claude Desktop, Continue, Codeium — can drive rousseau's tools and sessions.
Zero telemetry
No SaaS control plane, no license server, no analytics endpoint, no unique identifiers. The only outbound traffic is the LLM call and the transport you enabled.
Single static binary
Go 1.26+, CGO_ENABLED=0, embeds modernc.org/sqlite. No libc, no interpreter runtime. Runs identically on macOS, Linux, and Windows.
Get running in five minutes
go install github.com/sebastienrousseau/rousseau-agent/cmd/rousseau@latest
rousseau chat
That's the whole install. go install fetches the module, builds the static binary against your Go 1.26+ toolchain, and drops it in $GOBIN. rousseau chat launches the Bubble Tea TUI with your configured provider.
Every release ships a cosign signature and a CycloneDX SBOM:
cosign verify-blob \
--certificate-identity-regexp 'sebastienrousseau/rousseau-agent' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--signature rousseau_checksums.txt.sig \
rousseau_checksums.txt
sha256sum -c rousseau_checksums.txt
tar -xzf rousseau_*.tar.gz && sudo install -m 0755 rousseau /usr/local/bin/
podman build -t rousseau-agent:local -f docker/Dockerfile .
mkdir -p ~/.config/containers/systemd
cp docker/rousseau-agent.container ~/.config/containers/systemd/
systemctl --user daemon-reload && systemctl --user start rousseau-agent.service
Rootless Podman + systemd Quadlet. Read-only rootfs, dropped capabilities, seccomp filter, non-root UID.
Where to next
Quickstart
Install, configure a provider, hold your first conversation, wire a transport, and verify the release supply chain in about five minutes.
Concepts
Agent loop, session store, tool registry, approval policies, MCP server, cron scheduler, skills loader — how the daemon actually works.
Configuration
Every field in internal/config/config.go, one page. Providers, transports, agent loop, compression, approver, state store.
Deployment
Rootless Podman with Quadlet, systemd unit reference, Kubernetes note, secrets from Vault or cloud secret managers.
Security
Supply-chain posture, trust model, cosign verify recipe, seccomp policy, network egress allowlist, disclosure SLA.
Tutorials
End-to-end walkthroughs — code review bot on Slack, nightly changelog on WhatsApp, MCP + Claude Desktop, hardened approver policy.