It joins agents on a canvas, gives each one only the tools its job needs, and runs them. Every model call and every tool call passes a governor that can refuse it.
Works with the models you already pay for
Approval gates stop a run before anything it cannot undo — sending, deleting, paying — and wait for a person.
Asked to report the fields of a record it had fetched, a model invented an eleven-field order for a customer who does not exist, wrote “values copied exactly as they appeared in the response”, and then checked its own arithmetic to confirm the total was consistent. All of it was coherent. None of it was in the response.
Nothing in a loop made of one model can disagree with that. So the verify step is mechanical — an answer citing none of the identifiers its tools returned is challenged and sent round again.
Provider differences live in adapters and nowhere above them, so changing model is a dropdown rather than a rewrite — and no route reaches a provider without crossing the Governor first. That rule is a lint check: a direct call fails the build.
No CHIMERA account. No CHIMERA server. Workflows, runs, traces and keys live in one folder you control.
Ten roles ship with CHIMERA, each holding only the tools its job needs. A Reviewer that cannot edit. An Assistant that writes notes but never rewrites memory. You can change all of them, and write your own.
Decides its next move from the brief and what it already knows.
Calls a tool it was granted — through the Governor, never around it.
Allowlists, spend and step caps, egress rules and approval gates. Every decision written down, refusals included.
Reads what came back as data, never as instructions — then checks whether the job is genuinely done. An answer citing none of the identifiers its tools returned is challenged and sent round again.
Put a question to a population with different starting positions, give them a few rounds, and read where they landed — including who changed their mind and what changed it.
Figures published by OmniRoute and Composio, not our own measurements. Both are optional — CHIMERA works with neither installed.
OmniRoute is a separate open-source gateway you run on your own machine. CHIMERA finds it and imports the whole thing in one step.
MIT-licensed and self-hostable. It sits on your machine, not ours.
Detected on localhost:20128. Not installed is a normal answer, and gets install guidance rather than an error.
1,200+ models arrive as a single connection, with prices, context windows and health. No restart.
Any agent, any tier, from a dropdown. Free tiers are labelled, so you can build a workflow that costs nothing.
351 providers, 1,200+ models, 90+ free tiers and ~1.51B free tokens per month are OmniRoute's own published figures, not our measurements. Health status also comes from OmniRoute's reporting rather than a second opinion of ours, so one gateway is never judged by two systems that can disagree.
Composio handles OAuth, token refresh and lifecycle upstream, so an App operator gets a live connection to your real account rather than a key you pasted into a box.
In-app. Gmail, Slack, Sheets, Notion, Linear, and a thousand more.
You approve it in your browser, on the real provider's page.
Each App operator holds specific apps and reaches nothing else.
Several agents can run in one automation with different grants.
That boundary is enforced on CHIMERA's side deliberately. The upstream toolkit filter is a ranking hint rather than a filter — which we measured — and a hint is not a boundary.
1,000+ integrations, 100k free tool calls a month, SOC 2 and ISO 27001:2022 are Composio's published figures, not our measurements.
A real browser in a profile of its own. It fills forms, clicks through and reads what came back — and never touches the session you are logged into, because an agent inside your bank tab is one prompt injection from using it.
Spreadsheets, Word, PDF, slides and archives — converted and read inside a child process with a time limit, because a parser reading a stranger's file is somebody else's code running on your machine.
CHIMERA bundles its own runtime, database and browser engine. Nothing to install first, nothing outside your home directory.
glibc 2.31+ · x86-64 or arm64
Ubuntu 20.04+, Fedora 34+, Debian 11+
Two libraries first.
11 Big Sur or newer
Apple silicon and Intel
Nothing to install first.
10 (1809) or newer · x64
Nothing to install first.
Everything that exists today, on your own machine, with your own keys.
$0 / month
Free while CHIMERA is in early access
Install CHIMERAFor running CHIMERA inside a company, or building a product on top of it.
—
Not yet available. Intended licence is BUSL 1.1.
Follow the repoThose are libraries you write code against. CHIMERA is an application you run. The canvas, the governor, the traces, the approvals, the credential handling, the injection defences and the cost accounting already exist — what you build is a workflow, not a program.
No. No CHIMERA account, no CHIMERA server. Workflows, runs, traces and keys live on your machine. The only outbound traffic is the model and tool calls you configure.
It holds only the tools its role needs; it reaches only hosts on its allowlist; anything irreversible stops for a person; every loop declares a bound the editor enforces at save time; and spend caps end a run that overruns. Prompt wording is the last layer, not the first.
Yes. Point it at Ollama or LM Studio and no traffic reaches a model vendor. A local-only workspace mode enforces this rather than relying on you to remember.
It goes into your OS credential store and is never written to the database, the logs, the traces or an error message. Agents are handed a handle rather than a value.
Linux, macOS (Apple silicon and Intel) and Windows. Every release is built and smoke-tested on all three.