$local_first=truecloud_calls=0telemetry=off
ai agents shouldshow their work.
Saturn is a terminal agent that runs on your hardware. Every plan, tool call, and decision is written to the screen as it happens — and when it wants to touch your system, it asks first.
$ curl -fsSL saturdayai.org/install.sh | sh01::a real run
watch it work.
» in one paragraph, give your honest take: what should people not trust an ai agent to do on its own?
People should never fully trust an AI agent to autonomously execute high-stakes decisions involving human safety, legal accountability, financial security, or deeply personal values without explicit human oversight. While AI excels at pattern recognition, data synthesis, and routine automation, it fundamentally lacks genuine understanding, moral reasoning, and real-world contextual awareness, meaning its outputs are probabilistic approximations rather than grounded truths. Entrusting an AI independently with tasks like medical diagnoses, legal judgments, critical infrastructure management, or sensitive communications risks compounding hidden biases, hallucinating crucial details, or optimizing for flawed metrics at the expense of human well-being. Because an AI cannot truly comprehend consequences or take responsibility for its actions, any task with irreversible outcomes, ethical weight, or significant personal impact must always remain under direct human verification and control.
ctx 1.7k · 69.2 tok/s · 35.45s total · run #156 · qwen3.6:27b · saturn 0.1.0
declared up front
model, tools, and context are stated before the first token.
execution trace
every pipeline node is timed as it runs — plan, execute, rectify, synthesize.
confidence on screen
the answer carries its own token probabilities; hedged spans wear the ramp.
your move
the prompt returns to you. side effects wait at the gate — see 02.
02::the gate
it asks first.
» create a file named hello.txt containing the word hi
I did not create `hello.txt` because the file-writing action was declined during execution. Consequently, the file was never written to the workspace. Let me know if there is anything else I can help you with!
gates prompted 1 · approved 0 · run #155 · qwen3.6:27b
Every side-effecting tool call stops at the gate. In the TUI you approve, deny, or read the diff first — and an always-allow answer lasts for the turn, not forever. Headless runs deny by default — --yolo opens the gate, and that choice is on the record too.
03::the policy file
policy,not promises.
# saturn.policy
6 rules · read-only
1
local_first = true
Models, context, and data stay on your machine. No API key anywhere, no telemetry, and the only exits are a search query, a page fetch, and the MCP servers you configured.
2
show_work = always
Plans, tool calls, and reasoning are written to the screen as they happen — not summarized after the fact — and every run replays offline from its export record.
3
side_effects = gated
Approval gates sit in front of every write, command, and remote call, showing the real diff or the full command. Enter rejects. Grants expire with the turn.
4
answers = traced
Every cited source resolves to the tool call or document behind it; every figure is traced back to a gathered result or disclosed as untraceable. Uncertain spans wear their probability.
5
egress = recorded
Every byte that leaves is logged by host and channel and printed under the answer. Air-gap the whole thing with one command; untrusted content is quarantined against injection.
6
trust_settings = explicit
A loosened posture — an open gate, a lifted air gap, a relaxed tier — is session-only unless you say --save. Nothing weaker is ever written to disk silently.
04::capabilities
what it does.
llm
qwen3.6:27b · loaded · cloud 0
local llm support
Open models through Ollama on your own hardware. Five roles, one tier line to swap them all; no API key anywhere in the product.
plan
✓ 1 web_search · ▸ 2 web_extract · 3 calculate
plans you can edit
Press Esc to pause at a step boundary and drop, reorder, or retarget steps — or type a correction and steer the running turn. A step you remove has its effect revoked, not just its wording. /draft runs a plan you wrote yourself.
gates
write_file → gated · y / N / s / a / e
tool approval gates
Every side effect stops with the real diff or the full command on screen. Enter rejects. An always-allow answer lasts for the turn, not forever, and shell prefix grants screen their argument tail every time.
answers
figures 4/4 traced · [1][2] · 0 uncertain
answers you can check
Inline citations that resolve to the exact tool call or document, per-token confidence marks calibrated per model, and every figure traced back to a gathered result — or disclosed as untraceable.
trust
⇅ 2 sends · 18 kB → duckduckgo.com
egress ledger & air gap
Every byte that leaves is recorded by host and channel and printed under the answer; /privacy airgap seals the boundary. Web pages and remote results are quarantined against prompt injection.
rag
indexed 128 files → 12.4k chunks · local
documents & memory
Ingest PDFs, markdown, HTML, CSV, and docx into a local knowledge base; durable facts persist across sessions; SATURDAY.md carries your standing instructions.
mcp
mcp_github_* · 12 tools · destructive
mcp servers
Connect any Model Context Protocol server from config.yaml. Its tools face the same gate as everything else and never self-declare their risk tier.
trace
run_156.json → --replay · offline
replayable runs
Every run drills down to its plan, reasoning, tool I/O, model inputs, and gate decisions. Export it as JSON and replay it anywhere with saturn --replay — no database needed.
cli
saturn -q "…" · gate deny · exported ✓
headless & pipes
-p and -q run one turn for scripts and pipes; gated tools deny by default; --json for machines; the run auto-exports so the receipt names a command that replays it.
$
man saturn
the full tool and workflow reference lives in the docs →
05::get started
run an agentyou can actually see.
One command. Under a minute. Everything on your hardware.
$ curl -fsSL saturdayai.org/install.sh | shworks on macos · linux · wsl2 · windows — no account, no cloud