How to use Aarmos

A local runtime and protocol-agnostic gateway. It runs on your machine — this web application, the aarmos command line, or both — and connects your LLM key to the servers, APIs, and connectors you configure. No Aarmos server sits in the execution path: policy evaluation, receipt signing, and key custody all happen locally.

Registry ships a starter gallery — Web researcher, PR review helper, API endpoint tester, Prod-DB explainer, Log grepper, and more. One tap installs a pre-scoped agent (connectors, system prompt, and trust suffix already wired) into local storage. Edit or uninstall anytime; nothing syncs server-side.

Connectors is the connector catalog — web search, weather, news, time, units, generic REST (http), read-only Postgres, scoped filesystem, and more. Third-party APIs (GitHub, Slack, Notion, Google) go through the generic REST connector plus a bearer token in the vault, or a custom OpenAPI spec.

Four overlapping governance surfaces. Reach for the narrowest one that solves the problem.

Every choice is recorded to your signed trace ledger — reversible and exportable.

You supply the LLM key and connector credentials; they stay in the on-device vault. Provider costs, rate limits, and terms are between you and the provider — Aarmos is not a reseller and does not proxy the traffic.

Don't use Aarmos to:

• Break applicable law or harm people.
• Abuse, scrape, or overload third-party services.
• Process medical, financial, or otherwise regulated data unless every provider in the chain permits that specific use.

Agents perform real work — send messages, mutate data, spend money. Every governed tool call surfaces a consent prompt (allow, ask, block) and can be scoped, capped, or hard-denied anytime. You remain accountable for what the agents you enable do.

Aarmos talks to LLM providers and external APIs using your credentials. Their availability, accuracy, security posture, and terms are their own. Aarmos does not endorse or underwrite them.

Provided as-is, no warranties. Models hallucinate. Auto-discovered tools can change shape without notice. Verify high-stakes results before acting on them.

The device password stays on this device — Aarmos cannot recover it. The recovery code is a second unlock path; anyone with it can open the vault, so store it in a password manager or a hardware security key. Lose both and the encrypted data is unrecoverable.

Keys, connector credentials, agents, and chats live on this device. Clearing the browser profile or losing the machine means losing them unless you exported an encrypted backup first. On Team and Enterprise you can opt in to relaying receipts to your workspace so evidence survives a lost device — that relay carries evidence only, never your keys or prompts, and it ages out on the window you set. See Limits.

A decision is the smallest governable business action — "approve this refund", "publish this change". Aarmos records which participants had to weigh in, which inputs they consumed, how each one responded, and the verdict that was composed, then seals all of it into the receipt. Decision identities are permanent, so you can replay a decision later and see exactly what would differ. Aarmos orchestrates the evaluation and records the outcome — it doesn't invent your business rules.

A local record of runs, tool calls, and cost so you can review what your agents did. Auto-purges on the schedule set in Storage. Change windows, export, or wipe anytime.

Evidence is append-only: receipts are never edited or silently removed, they only age out under your retention policy. Operational content is disposable. Agents are archived and restored rather than deleted — both transitions are receipted — and clearing a conversation removes the prompt and reply while the run row survives as evidence. Review it all under Operations.

Sliding-window call caps (per-minute and per-day) on every tool and agent, plus a daily USD spend ceiling on LLM turns. Warning at 70% of budget; 100% engages the kill switch. Every trip is receipted. Tune defaults in Settings.

Scope: caps run in this device's runtime — great against accidents and runaway loops, but a modified build can bypass them. For tamper-resistant limits, also set them at the provider (e.g. OpenAI org limits).

Tool arguments are size- and shape-checked before the consent prompt. Bearer tokens, sk-* keys, and JWTs are redacted from prompts, logs, and ledger entries. Add regex rules for custom token formats on Audit. The same scrubber runs on knowledge-base output. Reduces accidental leakage; not a substitute for keeping secrets out of prompts.

The signed ledger is tamper-evident on this device. To make evidence third-party-verifiable, export an anchor receipt — a small JSON with the chain head, counts, and device public key. Email it, drop it in an S3 object-lock bucket, or POST it to your webhook. Later tampering fails to reproduce the head in your anchor. Aarmos does not receive the destination.

Export the signed trace ledger anytime from Audit; optional auto-export writes a local bundle after batches of settings changes. To stop everything fast, press Esc three times in under a second — engages the global kill switch with a 10-second Undo toast. Ignored while typing in a text field.

Run aarmos observe and the runtime opens a read-only stream on your machine — loopback only, port 7682 by default and changeable with --port. The terminal prints a single-use eight-digit code; enter it in this app to join the same stream from a browser. The session is short-lived, read-only, and can't change a policy, approve an action, or write evidence. Nothing about it leaves the machine.

Analytics run only if you tap Allow on the consent banner, and never include message content, keys, or tokens. Withdraw consent from Settings anytime.

Three plans — Evaluation, Team, and Enterprise. See Pricing. Any price shown at checkout is what you pay — nothing gets charged silently.