One terminal agent for code, research, analysis, and everyday tasks. Choose a local or hosted model, open your folder, and describe the outcome. Collomia brings the tools, durable sessions, and explicit permissions to help you get there.
Choose the task profile that fits. Both share your models, sessions, tools, skills, and permission controls.
Build applications, understand unfamiliar code, fix bugs, and carry changes through relevant builds and tests.
colloResearch a question, analyze data, write a report, automate a routine, or investigate a system problem. Start with your real files and your own request.
collo --mode workSwitch within a session with /mode work or /mode developer. Your permission settings stay the same. Explore Work mode ↗
“Compare these monthly CSV exports. Explain the changes and write a report with the calculations.”
“Research these options using current sources. Compare the tradeoffs and cite what you find.”
“Find what is taking up disk space. Explain what can be cleaned up before making changes.”
Examples are starting prompts. Available models, installed tools, skills, and permissions determine what can run. Specialized document or browser tasks may need additional tools.
Read, reason, act, and check the outcome in the same session. Bring the models and tools that fit your work.
Connect Ollama, vLLM, or LM Studio locally, or use OpenAI-compatible, Anthropic-compatible, Azure, and AWS Bedrock APIs. Choose where model requests go.
Read a codebase, edit files, run tests, inspect language-server diagnostics, and review the diff. Background processes keep development servers within reach.
Connect tools through MCP and install skills for specialized methods. Work mode uses the tools available to it, so you can shape it around your own tasks.
Durable sessions preserve your conversation and work history. Resume after an interruption, steer an active turn, and review recorded file changes.
Follow streamed text, tool activity, plan progress, and model reasoning when the provider exposes it. Keep the conversation in the terminal or open the local browser interface.
Use tests for code, calculations for analysis, and sources for research. Collo records observed results and makes remaining verification gaps visible.
Standard execution is the default for both task profiles: describe the result and let the agent choose its approach. Developer sessions can also opt into Orchestrated Goal. Work mode currently uses Standard execution.
Describe the task; Collomia works through its ordinary governed tool loop — reading, editing, running commands, checking diagnostics, asking when a decision is yours to make. The agent chooses task-specific checks; the runtime records their results against the current work.
The model proposes a bounded dependency graph; you approve it. From there the runtime — not model prose — owns readiness, immutable attempts, evidence freshness, conservative recovery, budgets, and the terminal outcome.
Permission prompts are in-process policy. The sandbox is the part the operating system enforces. Collomia requests it by default on all three platforms using inbox facilities — no Docker, no Hyper-V, no privileged driver, no extra runtime.
Confines command writes to the workspace and approved temporary locations, and can optionally prohibit reads outside it.
Kernel-enforced filesystem access rules applied to the command's own process tree, with no daemon or root setup.
The child is created suspended and joined to a job object before it runs, so cancellation reaches the whole tree with no window to escape.
sandbox: require
Fails closed. If the requested backend can't be established, the command doesn't run. Use this when degraded execution is unacceptable.
sandbox: auto
The default. Compatibility-first: it visibly reports degradation and continues when a backend is unavailable — fail-visible, not silent.
sandbox: off
An explicit opt-out that only the global configuration owner can make. No project can select it for you.
Sandbox state is always on screen — contained, unsandboxed, or degraded. Sandboxed commands also get a documented minimal environment by default, which omits common API tokens, cloud credentials, proxy settings, and unrelated toolchain state; full inheritance stays available as a deliberate compatibility choice. OS sandboxing and the scoped-egress broker are marked experimental — the security model states exactly what each backend does and does not guarantee.
Four layers merge into the settings a session actually runs with. Each one may raise the floor. None may lower it — so cloning an unfamiliar repository can't quietly relax the posture you chose, and you can always see which layer decided what.
The clamp isn't limited to one setting. It applies to sandbox policy, sandbox network and outside-workspace reads, the command environment, outside-workspace access, command posture, network posture, scoped egress, credential protection, publication posture, and containment presets. An attempt to weaken any of them is refused and reported rather than silently ignored.
Untrusted repositories stay quarantined. A project's
.collomia.json, AGENTS.md instructions, skills, and MCP servers
are inert until you trust that repository's content — and trust is content-bound, so a
meaningful change invalidates it.
Hooks can only push the same direction. Prompt and tool-start hooks, and an optional external reviewer command, may block or escalate an action. Neither can grant permission, bypass the sandbox, or turn a denial into an approval.
Three presets — frictionless, standard, and
hardened — expand into ordinary inspectable fields rather than hiding
behavior, and collo config show reports both effective values and where each
one came from.
Broad approvals are where agent safety usually leaks. In Collomia, a session grant covers the exact declared capability and nothing else, and the consequential categories are carved out so that no blanket "always allow" can quietly include them.
allow, prompt, and deny rules can name tools,
paths, command operations, hosts, and MCP servers. A pattern with a space matches an
operation — so npm install can be routine while
npm publish is not.
Conventional credential stores and files need an exact rule or an exact session grant.
Blanket tool approval and full autonomy mode don't cover them, and under
deny no interactive grant can override the prohibition.
Package and container registries, source remotes, code-forge writes, infrastructure
applies, and commands run on another host are governed separately. Read verbs and
--dry-run rehearsals stay ordinary.
Analysis reads what a command is likely to do, not just which binary it names. Wrappers are unwrapped, nested shell payloads are inspected, and anything unreadable always asks. Catastrophic outcomes have no override at all.
Every permission decision and execution outcome outside the workspace is written to a
JSONL ledger naming the session and the actor — primary, or
agent:<profile>. A write failure is counted and declared as a gap in the
file, never silently dropped.
web_search and web_fetch enforce a non-configurable
public-internet-only address guard: loopback, private, link-local, cloud-metadata, and
reserved ranges are rejected at connect time, proxies are ignored, URL credentials are
stripped, and no cookies are kept.
MCP results, fetched pages, and search results are wrapped with provenance so they arrive as data rather than as trusted instructions. Injection resistance is part of the offline evaluation suite, not an assumption.
Delegated profiles can narrow model, tools, skills, iterations, budget, and write scope — and only narrow. Agents with disjoint write scopes may run concurrently; overlapping ones are serialized.
Delegated and orchestrated work never commits, merges, pushes, or deletes worktrees on its own. Candidates are verified in place and wait for your review.
Built-in tools, integrations, and session controls share Collo's permission and lifecycle policies. Command sandboxing applies to shell execution; provider and MCP connections have separate controls.
git_commit and git_branch — neither pushes/review against uncommitted work or any ref/verify discovers and runs build, lint, and testNO_COLOR support and a color-independent theme@ file selection and image inputcollo run --jsonl versioned event streamcollo schema eventscollo --web embedded loopback browser terminalBoth installers verify the download's SHA-256 checksum and its reported version before replacing anything already installed.
Installs to $HOME/.local/bin. Doesn't use sudo or modify your PATH.
curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.sh | sh
AMD64 and ARM64. No elevation and no execution-policy change; open a new terminal afterward.
irm https://raw.githubusercontent.com/robert-mcdermott/collomia/main/install.ps1 | iex
collo setup
collo for development or collo --mode work for general tasks. If no provider is configured, interactive startup opens setup automatically.
collo --cwd /path/to/your-folder --mode work
doctor inspects build, platform, merged
configuration, repository trust, Git, credentials, MCP definitions, and sandbox
availability; capabilities prints the generated implementation matrix.
collo doctor && collo capabilities
Prefer to build it yourself? go build -o collo ./cmd/collo against the Go version
declared in go.mod. Release artifacts ship with checksums, CycloneDX SBOMs, and
Sigstore/GitHub attestations —
version pinning, provenance verification, rollback, and uninstall
are all documented.
Collomia is a technical beta, and its documentation is deliberate about the edges of each control. A few that are worth knowing before you point it at something valuable:
auto sandboxing is fail-visible, not fail-closed. Deployments that require strict containment should set require.The full accounting lives in the security model and beta status, and the generated capability matrix is the canonical word on what is implemented today.
No Collomia account or subscription. Sessions and configuration stay on your machine. Hosted model providers may charge for usage and receive the content sent to them; choose a local model when you want local inference.