Flowork Agent: A Self-Hosted Operating System for Sandboxed AI Agents

#ai #selfhosted #webassembly #architecture

Most cloud-based AI agents operate on a rental model: you pay, you prompt, and the moment the session ends, your context and trust are reset. Flowork Agent flips this paradigm by providing a self-hosted AI environment where you actually own the infrastructure, the data, and the intelligence.

Built as a microkernel, Flowork is a tiny, eternal core that hosts autonomous AI agents as sandboxed WebAssembly citizens. It is designed for the local-first AI enthusiast and the security-conscious engineer who requires a system that works fully offline on their own hardware.

The Architecture: Microkernel & WebAssembly Sandboxing

At its core, Flowork utilizes a microkernel architecture. The kernel is a frozen, unedited contract that handles communication through a single "loket" (counter). To perform any action—whether thinking, remembering, or running a tool—an agent must request a capability by name via call(cap, args). The kernel then performs a grant check, routes the request to the provider, and enforces the sandbox.

By utilizing WebAssembly (via wazero), Flowork ensures that every AI agent is isolated. Each agent exists in its own folder with its own persona, tools, and schedule. This modularity means that if a specific module breaks, you only need to fix that specific folder; the rest of the system remains untouched.

Intelligence with a Brain: AI Memory and Learning

Unlike standard LLM implementations that rely on fleeting context windows, Flowork agents possess an AI memory that turns mistakes into lessons.

Local Brain (SQLite FTS5): Each agent has a private SQLite database using FTS5 for fast, lightweight keyword memory (BM25). This allows for instant, fully offline recall without the need for heavy embeddings.
The Memory Loop: The agent follows a strict sequence: receive message $\rightarrow$ remember $\rightarrow$ recall related memories $\rightarrow$ think $\rightarrow$ reply.
Educational Errors: This is a core design principle where errors are not suppressed or hidden. Instead, mistakes are captured, explained, and retained as lessons. The agent learns from its own experience at runtime—no retraining required.
The Router & Anti-Hallucination: When an agent is pointed at the Flowork router, the system injects the agent's most relevant past mistakes back into the prompt. This acts as a deterministic anti-hallucination mechanism, making it harder for the agent to repeat the same errors.

Connectivity: MCP Server and Client Capabilities

Flowork provides bidirectional connectivity through the Model Context Protocol (MCP), allowing agents to interact with the outside world and vice-versa.

As an MCP Client: You can plug in existing external MCP servers (like GitHub). Once installed, those tools become available to your agents as plug-and-play capabilities.
As an MCP Server: Flowork can expose your agents to external applications (like Claude Desktop or Cursor). By pointing an external client at the flowork-mcp command, you can drive your local agents from your preferred IDE or interface.

Deployment and Security

Flowork is delivered as a single, pure-Go binary that runs on Linux, macOS, and Windows. There is no Docker dependency and no requirement for cloud telemetry.

To get started, you can clone the repository and run the system with a single command:

git clone https://github.com/flowork-os/Flowork_Agent.git && cd Flowork_Agent && ./start.sh

Security is not an afterthought; it is a "security radar" built directly into the system. A real scanning arsenal guards the code that your agents execute, providing a level of protection not found in other agent frameworks.

Flowork Agent is built on the doctrine that "Simple is hard. Complicated is easy." It is a sovereign, local-first environment designed for those who want to build and run autonomous agents without sacrificing privacy or ownership.