A self-hosted agent harness that logs what it did.

# the jar and its bill of materials are release assets
java -jar penstock-0.5.3.jar
# or as the agent inside an editor that speaks ACP, over stdio
java -jar penstock-0.5.3.jar --acp
# or as a memory server for Claude Code or Claude Desktop, over stdio
java -jar penstock-0.5.3.jar --mcp
# or the multi-architecture image, bound to loopback
docker run --rm -p 127.0.0.1:8080:8080 \
  ghcr.io/enrichmeai/penstock:0.5.3

Since v0.2.0 the published image requires a login by default: set AGENT_AUTH_PASSWORD, read the generated one from the container logs, or opt out deliberately with AGENT_AUTH_ENABLED=false. Exact coordinates, configuration and the model options are in the release notes and the shipped docs: v0.5.3 →.

projects:
  oss-lib:    { audience: public }
  platform:   { audience: private, uses: [oss-lib] }
  standalone: { audience: private, personal: none, uses: [oss-lib] }

An explicit personal: all loads every personal card, so leave it off a public project. A root without a projects: block behaves as it did in v0.4.0. The rules are in the shipped docs.

Today

Open source: five surfaces (web, REST, streaming, the editor over ACP and the memory server over MCP), pluggable models including a local one, and, with database storage, an audit log of every model and tool call, attributed to the authenticated user and readable from the app itself. live

Release

v0.5.3: a jar, a bill of materials and a multi-architecture image. The memory block now asks the model to cite the cards it uses and to propose episodes rather than write facts. It builds on v0.5.1's security fixes and v0.5.0's project audiences and MCP mode. live

Governed access

The pod tool has shipped. Penstock asks a Cistern pod for a file over plain HTTPS as its own principal, is refused outside its grant, and what it read is receipted on the owner's side. That is application-level consent: the receipt names the application, not the person who asked it. Per-user credentials are available by configuration for deployments that want attribution per person. live

In your IDE

Penstock speaks the Agent Client Protocol. Launched with --acp it runs as a selectable agent inside an editor that speaks ACP, over stdio. The read-only tools and pod reads run unprompted; write_file, edit_file, shell, git and pod writes each go through the editor's own permission prompt first. Registration steps for both editors are in the shipped docs. v0.3.0

Memory

Recall at the start of each turn from a memory root you own, with each loaded card logged, and on the audit log with database storage (v0.4.0). Project audiences decide which cards each project may load, and --mcp serves the same memory to Claude Code and Claude Desktop (v0.5.0). The block asks the model to cite each card it relies on, or to mark an assumption, and to propose an episode rather than write a fact (v0.5.2). v0.5.0

Planned

Not in a release, and named here so the gap is visible. Hosted sessions and Claude Cowork reading the memory from a pod (#89). A memory browser and a review inbox in the web UI (#107, #108). Falling back to a local model when no key is set (#106). A Gemini provider and a Perplexity search tool (#114, #115). The move to Spring Boot 4, for the three Spring criticals the scan still lists (ADR 0004, #128). planned

Later

The stranger test: deploy and use it from the published artifacts alone, following only the shipped docs. Cistern is held to it. Penstock v0.5.3 went through it on 17 October 2026 from the published jar and docs: nothing blocked, two documentation faults are being fixed (penstock#171), and the image was not tested. Until those are done this page says to run it locally. in progress

Licence

Apache 2.0, free for any use including commercial.