Urfael

What’s solid, and what’s lightly tested

Honesty is one of our promises, so this page exists on purpose. Here is the maturity line for the Urfael assistant, drawn down the middle.

Solid, and verifiable yourself

  • The security posture is a command, not a claim. npm run security boots the real daemon and dashboard and attacks them in ways modelled on attacks reported against self-hosted agents in 2026; its source defines 11 groups and 128 checks (source counts, not a verified passing result). npm run e2e runs selected integration scenarios against a live daemon, with npm run fuzz and npm run redteam on top.
  • A unit-test suite, including adversarial security regressions frozen from real findings, so a fixed hole cannot quietly reopen.
  • The architecture is the moat. The daemon opens no network port (a 0600 unix socket; the optional dashboard, API and webhook listeners bind to loopback only), fail-closed allowlists on every channel, read-only sandboxed remote turns, and a credential-deny boundary that holds even in Full mode. These are permission profiles inside the harness, not operating-system isolation.
  • It can prove what it did. A hash-chained Ledger of Record makes tampering detectable, and an ed25519 Sovereign Seal signs the chain head. Run urfael attest for one report a reviewer can keep.

Lightly tested, on purpose

  • The Matrix, Signal and WhatsApp bridges, the QQ, SimpleX and PSTN phone bridges, the eight native webhook channels (Mattermost, Google Chat, SMS, DingTalk, Home Assistant, BlueBubbles, Feishu, WeCom), Discord voice channels, and the Android/Termux host are code-complete and reviewed, their parsing, verification, and allowlist logic unit-tested and frozen as benchmark checks, but not yet certified against live accounts or a real device. Treat them that way. The certified core, exercised against real accounts, is Telegram, Discord, Slack, iMessage and Email.
  • A2UI canvas ships as a protocol and a validator (unit-tested, benchmark-frozen as XSS-proof); live rendering of A2UI blocks in the dashboard and Console is the next increment, not yet built.
  • Linux runs the full stack but is newer than macOS and has less mileage, and native Windows support is beta; both need more hardware and operational testing. Real-world scale is small, because this is a personal tool and we say so; the desktop GUI is unsigned until the signing certificates are in place.
  • Experimental features, including the Council, the native engines and the optional learning and verification loops, need supervision.
  • No independent security audit is documented. The tests and the benchmark are self-authored regression checks, and a second model’s review is not an independent audit.

If you want twenty channels and every model under the sun, OpenClaw and Hermes are excellent at breadth. If you want the smallest possible blast radius, a flat bill within your plan’s limits, local voice, and a tool that is straight with you about its limits, stay.

See how that trade looks side by side: the honest comparison