Meet CHIMERA. Run agent teams with limits you can prove

It joins agents on a canvas, gives each one only the tools its job needs, and runs them. Every model call and every tool call passes a governor that can refuse it.

Local-first · no account
Governed & fully traced

Works with the models you already pay for

Run work you can actually leave running

Join agents on a canvas

governor.refuse — http.request
host not on this role's list

Every decision written down

01 2 3

Nothing irreversible
happens unasked.

Approval gates stop a run before anything it cannot undo — sending, deleting, paying — and wait for a person.

agent → gmail.send governor.hold  irreversible run paused · 214 recipients queued waiting for you → approve / reject
agent → sheets.batchDelete governor.hold  no undo path diff shown before anything runs nothing happens until you say so

Why CHIMERA checks the work

Read more
run.trace
agent.reply  11 fields verify.challenge order_id  not in response customer  not in response total     not in response → sent round again

Asked to report the fields of a record it had fetched, a model invented an eleven-field order for a customer who does not exist, wrote “values copied exactly as they appeared in the response”, and then checked its own arithmetic to confirm the total was consistent. All of it was coherent. None of it was in the response.

Nothing in a loop made of one model can disagree with that. So the verify step is mechanical — an answer citing none of the identifiers its tools returned is challenged and sent round again.

Bring any model, keep every limit

Provider differences live in adapters and nowhere above them, so changing model is a dropdown rather than a rewrite — and no route reaches a provider without crossing the Governor first. That rule is a lint check: a direct call fails the build.

0models, one connection
0agents built in
0layers before wording
0local, no account
Learn more

Everything it does, it does on your machine

No CHIMERA account. No CHIMERA server. Workflows, runs, traces and keys live in one folder you control.

competitor-brief.workflow
10:24:02 run.start
10:24:02 allow search.web
10:24:07 tool.ok 6 hits
10:24:09 allow browser
10:24:18 verify.challenge
10:24:22 refuse http
  host not on list
10:24:22 awaiting you

Your gateway to agents that stop

Ten roles ship with CHIMERA, each holding only the tools its job needs. A Reviewer that cannot edit. An Assistant that writes notes but never rewrites memory. You can change all of them, and write your own.

How a run actually goes

Plan

Decides its next move from the brief and what it already knows.

memory.recallnotebook.list

Act

Calls a tool it was granted — through the Governor, never around it.

search.webshell.exec

The Governor

Allowlists, spend and step caps, egress rules and approval gates. Every decision written down, refusals included.

governor.allowgovernor.refuseapproval.waitcap.spend

Observe, then verify

Reads what came back as data, never as instructions — then checks whether the job is genuinely done. An answer citing none of the identifiers its tools returned is challenged and sent round again.

Ask a crowd, not a model

Put a question to a population with different starting positions, give them a few rounds, and read where they landed — including who changed their mind and what changed it.

Connected to what you already use

providers
OmniRoute1,200+ models
Composio1,000+ apps
Ollamalocal · free
Import catalogue

Figures published by OmniRoute and Composio, not our own measurements. Both are optional — CHIMERA works with neither installed.

One gateway, and about 1.51 billion free tokens a month

OmniRoute is a separate open-source gateway you run on your own machine. CHIMERA finds it and imports the whole thing in one step.

0
free tokens a month, across 0 free tiers
351 providers one connection
1

Run OmniRoute

MIT-licensed and self-hostable. It sits on your machine, not ours.

2

CHIMERA finds it

Detected on localhost:20128. Not installed is a normal answer, and gets install guidance rather than an error.

3

Import once

1,200+ models arrive as a single connection, with prices, context windows and health. No restart.

4

Pick a model

Any agent, any tier, from a dropdown. Free tiers are labelled, so you can build a workflow that costs nothing.

351 providers, 1,200+ models, 90+ free tiers and ~1.51B free tokens per month are OmniRoute's own published figures, not our measurements. Health status also comes from OmniRoute's reporting rather than a second opinion of ours, so one gateway is never judged by two systems that can disagree.

Over a thousand applications, scoped one agent at a time

Composio handles OAuth, token refresh and lifecycle upstream, so an App operator gets a live connection to your real account rather than a key you pasted into a box.

1

Search the directory

In-app. Gmail, Slack, Sheets, Notion, Linear, and a thousand more.

2

Press connect

You approve it in your browser, on the real provider's page.

3

Grant it to an agent

Each App operator holds specific apps and reaches nothing else.

4

Run it

Several agents can run in one automation with different grants.

Mailbox agent
Reporting agent
Triage agent

That boundary is enforced on CHIMERA's side deliberately. The upstream toolkit filter is a ranking hint rather than a filter — which we measured — and a hint is not a boundary.

1,000+ integrations, 100k free tool calls a month, SOC 2 and ISO 27001:2022 are Composio's published figures, not our measurements.

Drive sites that have no API

A real browser in a profile of its own. It fills forms, clicks through and reads what came back — and never touches the session you are logged into, because an agent inside your bank tab is one prompt injection from using it.

supplier-portal.example.com/rfq
Part no.  CH-4471-B Quantity  250 units Request quote isolated profile — not your session

Read the documents you already have

Spreadsheets, Word, PDF, slides and archives — converted and read inside a child process with a time limit, because a parser reading a stranger's file is somebody else's code running on your machine.

Q3-orders.xlsx
terms.pdf
brief.docx
extracted · 4 fields order_idCH-4471 quantity250 net_total£18,400 due2026-04-12
read in a sandboxed child process

One line. No admin rights.

CHIMERA bundles its own runtime, database and browser engine. Nothing to install first, nothing outside your home directory.

LINUX

glibc 2.31+ · x86-64 or arm64
Ubuntu 20.04+, Fedora 34+, Debian 11+
Two libraries first.

MACOS

11 Big Sur or newer
Apple silicon and Intel
Nothing to install first.

WINDOWS

10 (1809) or newer · x64
 
Nothing to install first.

Designed to scale, without locking you in.

Early access

Everything that exists today, on your own machine, with your own keys.

$0 / month

Free while CHIMERA is in early access

Install CHIMERA

Includes

    Commercial licence

    For running CHIMERA inside a company, or building a product on top of it.

    Not yet available. Intended licence is BUSL 1.1.

    Follow the repo

    What is honest today

      Frequently asked questions

      How is this different from LangChain or CrewAI?

      Those are libraries you write code against. CHIMERA is an application you run. The canvas, the governor, the traces, the approvals, the credential handling, the injection defences and the cost accounting already exist — what you build is a workflow, not a program.

      Is CHIMERA a cloud service?

      No. No CHIMERA account, no CHIMERA server. Workflows, runs, traces and keys live on your machine. The only outbound traffic is the model and tool calls you configure.

      What stops an agent doing something dangerous?

      It holds only the tools its role needs; it reaches only hosts on its allowlist; anything irreversible stops for a person; every loop declares a bound the editor enforces at save time; and spend caps end a run that overruns. Prompt wording is the last layer, not the first.

      Can I run it entirely with local models?

      Yes. Point it at Ollama or LM Studio and no traffic reaches a model vendor. A local-only workspace mode enforces this rather than relying on you to remember.

      Is my API key safe?

      It goes into your OS credential store and is never written to the database, the logs, the traces or an error message. Agents are handed a handle rather than a value.

      Which operating systems?

      Linux, macOS (Apple silicon and Intel) and Windows. Every release is built and smoke-tested on all three.

      Put a team of agents on it, and read exactly what they did.