Cortex is a self-hosted desktop app for driving multiple AI coding agents from one window. Instead of juggling separate terminals for Claude, Codex, Gemini and friends, you type a task once and Cortex routes it to a model that can do it, runs the work locally, and records what happened. Windows, Linux and macOS. It runs entirely on your machine, with no telemetry.
Cortex is a personal homelab project maintained by one developer. It works, and it is used daily, but expect rough edges.
Unsigned until a code-signing certificate is provisioned, so SmartScreen and Gatekeeper warn on first launch.
Metrics are computed from local run history only. The dashboard cannot see retries that happen inside a gateway, and cost figures are estimates. The UI labels them as such.
You pick the endpoint’s model in the composer. Automatic local-first routing is planned but not built.
The Linux AppImage self-update verifies an ed25519 signature before it swaps a binary in. On Windows and macOS you update by re-installing the latest release.
Cortex on your phone, paired with a QR code and pushed to without a third party — on top of 3.4’s work on knowing what needs you and starting fast.
Chat, approvals, projects and per-file diffs, checkpoints, routines, run replay and usage — from an Android APK or an installable web app on iPhone, over Tailscale or your LAN. The phone is a client only: the models, the agent CLIs and your files stay on your machine.
Settings → Mobile shows a QR and a six-digit code, good for ten minutes and single use. Each paired phone holds its own bearer token, stored hashed, and you can list and revoke devices. Anything that is not the local machine — including a reverse proxy — has to present one.
Encryption and signing are built from crates already in the tree, so the only egress is to the browser vendor’s own push service. It fires when a run needs approval, finishes or fails, or a quota passes 90%, and the notification opens the screen it is about.
A pending approval raises a toast with an Open action, a desktop notification when the window is hidden, an inbox row and an amber count on the thread. Today opens with what is waiting: approvals, running threads with Stop, recent failures. Ctrl + Shift + A jumps to the oldest one.
Ctrl/Cmd + K fuzzy-searches actions, panels, threads, sessions, settings sections, projects, profiles and slash commands, with recents first and > @ # / prefixes to narrow. A settings hit opens the right tab and highlights the card.
Forty-one panels load on demand, streaming merges token fragments every 16 ms instead of re-rendering the shell per token, the dashboards got SQLite indexes, and twelve polling loops pause while the window is hidden. Startup timings are recorded on every push, per OS.
Every capability is a node. Drag to orbit · scroll to zoom · click any node to dive in — or read them all as a list. Here they all are, cluster by cluster.
A glassmorphic look at the real Cortex desktop — activity groups down the side, a model picker and reasoning dial up top, @-mention context, live workers, and a cost HUD that tracks projected spend against your budget. Move your cursor over it.
Cortex spawns each maker’s own CLI headless on your machine and lets it authenticate with its own login — the same Claude Max, ChatGPT/Codex, Gemini or Qwen plan you already pay for. No key is ever handed to Cortex, nothing routes through a middleman, and a live dashboard shows your real rate-limit windows.
An embedded terminal runs claude /login, codex login, gemini — no secret crosses the app boundary.
Poll your Claude Max and ChatGPT/Codex windows so you always know what’s left — surfaced right in the cockpit.
A new provider CLI is one *_spec.rs + one catalog row — data-driven onboarding, not a rewrite.
Import your Claude.ai and ChatGPT data export — every old conversation becomes resumable and full-text searchable inside Cortex.
Every capability below is real and code-backed — orchestration, the model surfaces, safety, knowledge, and the Cortex Gateway for full tool and code work.
A lead model decomposes each task and routes every subtask to the cheapest model that can actually do it — local and free where it can, a flagship only where it matters — then synthesizes and verifies one result against a live budget.
Drives each maker’s own CLI headless on your box — Claude, Codex, Gemini, Qwen, Grok, aider, Mistral Vibe — signed in with the plan you already pay for. No key ever crosses Cortex.
Fan one goal across every connected model at once, each in its own parallel git worktree, then let an AI synthesizer merge the strongest result. Many attempts, one best answer.
Bring your existing Claude.ai and ChatGPT conversations into Cortex via their official data export — every imported chat becomes resumable and full-text searchable beside your new ones.
Chat, approvals, projects and diffs, checkpoints and usage from your phone, over Tailscale or your LAN. Paired by QR code; notified by Web Push with no third party.
A userspace Tailscale ships inside the app — reach your home gateway, local models and memory from any network. Prefers your system Tailscale if you run one.
A manager model plus specialist workers — coder, tester, reviewer — that plan and execute concurrently.
Run the same task across N providers at once, each in its own isolated git worktree. Diff, then merge the winner.
Put 2–4 models head-to-head on real rubrics, vote verdicts, and track who wins over time on a persistent ELO board.
A real stdio JSON-RPC client plus a curated catalog of well-known servers — add tools for every model in one click.
Auto-snapshots as agents work (gzipped tarballs, keep last 10). See a pre-restore diff before anything is touched — every edit is reversible.
Approval prompts and a trust matrix gate risky actions; a sandbox and safe-command list constrain shell work.
A per-prompt dial — minimal · low · med · high — tunes how hard a model thinks before it acts.
Maker CLIs on your plan, any OpenAI-compatible API (Groq, Together, Fireworks, DeepSeek, Mistral, xAI, Perplexity, OpenRouter, Qwen, Kimi, Cohere, Gemini, Llama), and local runtimes (Ollama, LM Studio, vLLM, llama.cpp, TabbyAPI, Text-Gen-WebUI) — one adapter trait.
A real terminal in the app — run CLIs, sign providers in, watch lanes work, all in-cockpit.
An editor with inline completion sits beside chat, so you can read and refine what the agents write.
Stage, commit, browse history, and diff — version control woven through every run.
A graph of your project knowledge that agents draw on for grounded, connected context.
Fan-out web research synthesized into a cited report.
Reusable Skills plus Workflows and Routines that chain steps into repeatable automation.
Local tracing across every model call and lane — see exactly where time and tokens went.
An Obsidian-style knowledge brain with [[wikilinks]] that persists context across sessions.
Dictate to the cockpit. The browser’s speech recognition handles most cases; a local whisper-cli is the fallback when it is installed. Only the whisper path is fully on-device.
Poll your Claude Max and ChatGPT/Plus rate windows so you always know what’s left.
Fifteen built-in themes, including the Coral Dark flagship this site mirrors.
A refined, accessible UI across Windows, macOS and Linux — drive everything from a Ctrl+K command palette and a polished approval flow.
The cloud orchestration gateway that powers full tool and code work — worktree isolation, shell exec, and approval gates behind every Lane.
Your keys live in the OS keychain, on your box. Cortex only talks to the providers you configure.
Capability-gated before price-gated — a chat-only model never touches your shell. Scroll to watch a task move through the orchestrator: decomposed, routed to the cheapest model that can actually do each subtask, dispatched across providers in isolated Lanes, then synthesized and verified against a live budget.
Lead model plans typed subtasks as strict JSON.
Cheapest model that can actually do each one.
Lanes run in parallel, worktree-isolated.
One verified result merged from every lane.
Projected spend tracked against your cap.
decompose — the lead model breaks your request into typed subtasks.
Cortex unifies maker CLIs on your own plan, any OpenAI-compatible API, and local runtimes behind one adapter trait, then routes each chat to whatever serves it. Hover any chip to light up its node in the constellation above.
Cortex 3.5 puts the cockpit on your phone: an Android APK, or an installable web app on iPhone, that talks to your desktop over Tailscale or your LAN. Pair it by scanning a QR code; approvals and finished runs arrive by Web Push with no third party in between. A userspace Tailscale ships inside the desktop app, so it joins your tailnet without admin rights — and it prefers your system Tailscale if you already run one.
Chat, approvals, projects and per-file diffs, checkpoints, routines, run replay and usage. The phone is a client only: the models, the agent CLIs and your files stay on your machine.
The userspace tailnet ships inside the app — reach your home gateway, local models and memory from any network. It defers to your system Tailscale when one is present.
Settings → Mobile shows a single-use QR code; each phone gets its own revocable token. Risky actions land in the approvals inbox and as a Web Push notification — sign them off, or hold them, from wherever you are.
Every project is untrusted until you say otherwise, agents fail closed, and your keys never leave your machine. Self-hosted means the security model is yours — no phone-home.
API keys live in an AES-256-GCM-encrypted vault. The 32-byte master key is stored in the OS keychain — never beside the keys it unlocks. Keys never leave your machine and are re-read per run; nothing routes through a middleman.
Every project is untrusted until you trust it. An untrusted repo is forced to the read-only sandbox tier, and never inherits your auto-approve toggles or the repo’s own guardrail file. Codex is launched with --sandbox read-only so the tier is enforced before it runs; for the other CLIs the tier is applied to their tool calls as Cortex sees them, and blocked calls are rewritten into errors.
A per-action trust matrix (reads, edits, safe commands) skips the prompt for repos you trust. The invariant is hard: an untrusted repo never inherits your toggles — even "approve all commands" turned on globally still prompts there. Deny-biased, re-gated against the sandbox tier on every use.
A tool call that embeds a live credential — Bearer sk-… in a curl, a key in a file write — is redacted to [REDACTED] before the approval prompt renders and before the trace store persists it. The gates still judge the original; only what you see and what's stored is scrubbed.
A Codex-style allowlist (ls, cat, git status, grep…) lets agents inspect an untrusted repo but never write. It fails closed: not on the list, not allowed.
Mobile access rides your tailnet — no public ports and no inbound exposure. The bundled Tailscale sidecar gives the desktop outbound reach; serving the phone app uses your system Tailscale. Your phone talks only to your machine, encrypted end-to-end over your tailnet — encrypted, never the open internet.
The Linux AppImage self-update verifies an ed25519 signature before it swaps a binary in; on Windows and macOS you update by re-installing the latest release. If the signature doesn't check out, nothing installs — a trojan build can't slip in. Verification fails closed, every time.
The mobile server’s WebSocket and the /mcp endpoint reject cross-site requests, so a page in your browser cannot reach either one.
Built in the open, steered by a standing competitive scan of the whole multi-model desktop space — Cherry Studio, Jan, LibreChat, Kilo Code, Chorus and friends. These are the next moves, tracked in the repo.
The Jan-2026 MCP extension lets a tool answer with an interactive UI — forms, tables, dashboards — rendered in-chat. Cortex's MCP host already preflights runtimes (npx/uvx missing? you're told at add-time, with the install command); sandboxed ui:// widget rendering is the next slice.
Every orchestrated run already ends in a synthesis pass; next it returns a structured verdict — pass/fail, score, per-check evidence — with one-click repair rounds for what failed.
Attach what you're looking at: one keystroke captures the screen and hands it to a vision-capable model through the existing attachment pipeline.
Kilo-style allow / ask / deny patterns — "git push*": ask, "src/**": allow-edit — layered under the trust matrix. Deny always wins, and a rule can only ever narrow what the sandbox tier already permits, never widen it.
A polished, self-contained cross-platform app. Install without admin on Windows, drag-and-drop on macOS, run a single AppImage on Linux, or build it yourself — then bring your own keys. Once it’s running, pair your phone from Settings → Mobile.
| Platform | File |
|---|---|
| Windows 10/11 | Cortex_<version>_x64-setup.exe per-user, no admin required |
| Debian / Ubuntu | Cortex_<version>_amd64.deb |
| Fedora / RHEL | Cortex-<version>-1.x86_64.rpm |
| Linux (universal) | Cortex_<version>_amd64.AppImage chmod +x, then run |
| macOS (Apple Silicon / Intel) | Cortex_<version>_aarch64.dmg Cortex_<version>_x64.dmg |
Clone the repo and build the Tauri 2 app yourself. Needs Node 20+ with pnpm, a Rust toolchain, and Go 1.26+ for the Tailscale sidecar.
git clone …
cd cortex
pnpm install
bash scripts/build-tsnet-sidecar.sh
pnpm tauri buildYour keys in the OS keychain, your box, no phone-home. Cortex only talks to the providers you configure — runs real work fully offline with local Ollama and the local Claude CLI, brings your old Claude.ai & ChatGPT chats along, and follows you to your phone over Tailscale.
Description