Open Interpreter

All agent state is local under ~/.openinterpreter (relocatable via INTERPRETER_HOME) plus AGENTS.md and ~/.agents/skills, so it is available immediately, but there is no export/import command or documented round-trip procedure; restore on another machine means reinstalling, copying directories by hand and re-authenticating.

• Portability guide
• Sessions
• Migrate
• Home dir resolution

Config (TOML), session rollouts (JSONL), state/log/memory SQLite DBs, memories (Markdown), cron jobs, credentials (auth.json by default) and bundled skills all live in the owner's home directory; instructions and skills live in owner files (AGENTS.md, .agents/skills). Nothing that defines the agent is held by the provider, and API-key or local-model integrations re-link without any provider-registered client.

• Portability guide
• Rollout recorder
• SQLite state location
• Credential store default

The runtime is Apache-2.0 and runs locally with a user-configured provider (Ollama, LM Studio or any OpenAI-compatible endpoint); no licence check, account or Open Interpreter service is needed to start or act. Update checks (GitHub API) and analytics are best-effort calls whose failure does not stop the agent.

• LICENSE
• Authentication (local providers)
• Product URLs
• Update check

Local open-weight models are officially supported (--oss, Ollama, LM Studio, chat-completions wire) and shell, MCP, subagents, hooks and skills run over plain function calling, but several capabilities depend on OpenAI-hosted model features: hosted web search, image generation, realtime voice, and the apply_patch tool (enabled only by model metadata; unknown/non-OpenAI models get none). No formal minimum model contract is published.

• Tool spec plan
• Hosted tool spec
• Fallback model info
• Chat wire translation
• Models docs

State is local-first and always on the owner's device; nothing Open Interpreter operates holds it, so termination by the provider (or loss of a model-vendor account) cannot remove access to it.

• Portability guide
• Sessions

State is in open formats (TOML config with a published JSON Schema, plain JSONL rollouts, SQLite, Markdown memories) readable with general tools and no provider service, but the rollout JSONL and SQLite databases have no published schema and are defined only by source code.

• Config schema
• Rollout line format
• RolloutItem serializer
• Memories README

Settings are inspectable (/debug-config shows effective layered config, /status shows model, provider, sandbox), and rollouts record base instructions and developer messages. On the default OpenAI provider, compaction is done server-side and stored only as encrypted_content, so the compaction summary in context is not visible to the owner (one shortfall). Full request bodies can be captured only via undocumented TRACE logging, and not for the default WebSocket transport (G3 cap).

• Compaction item (encrypted_content)
• Remote compaction v2
• Provider compaction support
• Slash commands
• HTTP trace logging
• Configuration

A fresh release build sends usage metrics to OpenAI's Statsig endpoint and, on the preselected ChatGPT sign-in path, analytics events (model, provider, token counts, repo hash, thread and turn ids) to an Open Interpreter server (oi-new-api.fly.dev). Neither the retention period nor what is held is disclosed for the terminal agent, and the owner cannot view it.

• Analytics client
• Analytics events
• Statsig OTEL default
• Open Interpreter privacy policy

Source shows no paid placement. With the preselected ChatGPT sign-in, the apps, plugins and tool_suggest features are on by default and surface connectors and plugins from OpenAI's curated catalogue (github.com/openai/plugins). These can be switched off, but the docs state apps and plugins are off by default, and there is no binding no-steering commitment.

• Feature defaults
• Plugin startup sync
• Tool suggest connectors
• Config reference

Rollout JSONL records messages and tool calls with arguments and outputs, and is not pruned by default. However, hook executions and approval decisions are not persisted (HookStarted/HookCompleted and approval events are dropped by the rollout policy), and a failed rollout write is only logged with tracing::error! while the turn continues, without telling the owner. That is two shortfalls.

• Rollout persistence policy
• persist_rollout_items
• Rollout recorder

Rollout files carry no hash chain, signature or other integrity data, so edits or deletions leave no trace.

• Rollout line format
• Rollout recorder

Rollouts are written by the runtime process to ~/.openinterpreter/sessions, which the default workspace-write sandbox leaves read-only to agent commands. The home directory is not explicitly protected, though: when the workspace root contains it (for example, launching from $HOME), sandboxed commands can rewrite the record.

• Workspace permissions and protected paths
• Sandbox docs

All runtime source is Apache-2.0, and building from source is documented. The default install (a curl-piped script downloading GitHub release archives) checks SHA-256 digests taken from the release metadata only. It has no reproducible builds or third-party-verifiable provenance, cosign signs only individual Linux binaries, and macOS/Windows signing is optional.

• LICENSE
• Install script
• Release workflow
• Install docs

The agent has no identity of its own; it acts through the owner's shell, git and model-provider credentials (by default a ChatGPT account), and offers no owner-rooted agent key or verifiable attribution of its actions.

• Authentication
• Onboarding auth

The undo/ghost-commit feature is marked Removed, and there is no change log or restore for config, instructions or permissions. Per-turn TurnContext entries exist only inside raw rollout files, and the memories git baseline is internal, so the product offers no owner-facing view of what changed, by whom, or a rollback.

• Feature defaults (undo Removed)
• Memories README

The base prompt can be replaced (model_instructions_file / instructions), developer instructions added, the local compaction prompt replaced, and bundled skills disabled or shadowed. Injected permission, environment and app blocks can only be switched off, not rewritten, except by supplying a whole model_catalog_json. On the default OpenAI provider, compaction runs server-side and ignores compact_prompt.

• Config TOML keys
• Compaction task
• Skills docs
• Skills config

Memories are off by default. When enabled, they are Markdown files (MEMORY.md, memory_summary.md, raw_memories.md, rollout_summaries/) that can be edited or reset from /memories. Stage-1 outputs are kept in memories_1.sqlite with no editing interface, and the per-item /memory-drop and /memory-update commands are stubs.

• Memories docs
• Memories README
• Memory control

Owner tools can be added without review through MCP servers, local plugins and hooks. Most built-ins can be switched off by feature flags (shell_tool, view_image, multi_agent, image_generation, web_search=disabled), but apply_patch has no switch and can be removed only by replacing the whole model catalogue.

• MCP docs
• Feature defaults
• Tool spec plan

The owner can disable the sandbox and approvals (danger-full-access, --dangerously-bypass-approvals-and-sandbox), bypass hook trust, and override the only built-in heuristic (forced rm) with an allow rule. No content filter is imposed by the runtime.

• Shared CLI options
• Exec policy
• Dangerous command heuristic
• Sandbox docs

The runtime only notifies of updates, with a dismissible, owner-initiated update, and releases can be pinned via the installer. The model, instructions and provider can be pinned in config, or the owner can use a local model, which avoids the ChatGPT-login remote /models catalogue that can change instruction templates server-side. The optional daemon auto-updates hourly by default, but the daemon is off unless started and the updater can be disabled.

• Update check
• Daemon update loop
• Daemon settings
• Models manager
• Install script

Filesystem limits are per-path (permission profiles), MCP tools can be allow/deny-listed, and network is off by default, but per-domain network limits require the Experimental network_proxy feature. More importantly, the project's .openinterpreter/ directory is not among the protected workspace paths, so in the default workspace-write mode the agent can write project config.toml or rules/*.rules (for example an allow rule that bypasses the sandbox), which take effect in a later session. That is two shortfalls.

• Protected metadata paths
• Project config folder
• Exec policy rule loading
• Feature defaults (network_proxy)
• Permissions docs

The owner can gate shell commands by prefix rules (prompt/forbidden), MCP tools per tool (approval_mode), apply_patch and escalations, and PreToolUse hooks can gate most tools; the model cannot self-approve. However, write_stdin to a running process skips PreToolUse hooks, so one path bypasses hook-based gates.

• Exec policy
• MCP approval modes
• Tool registry hooks
• Hooks docs

Esc/Ctrl+C interrupts the active turn and clears pending approvals. Background terminals need a separate /stop, spawned subagents are interrupted separately, and when connected to the daemon, Ctrl+C offers to keep the task running in the background.

• Task abort
• Session handlers
• Slash commands

Non-content telemetry is on by default. OTEL metrics go to OpenAI's Statsig (ab.chatgpt.com) in every release build, and analytics events go to oi-new-api.fly.dev on the default ChatGPT sign-in path. Both can be disabled ([analytics] enabled = false, [otel] metrics_exporter), but neither flow is disclosed in the Open Interpreter docs. The website privacy policy describes opt-in telemetry for the desktop app and applies policy changes on notice, not consent. Prompt content is not sent.

• Statsig OTEL default
• OTEL config default
• Analytics client
• TUI analytics default
• Open Interpreter privacy policy

Credentials are visible (auth.json file by default, MCP OAuth in the keyring), and /logout revokes and deletes them. However, the analytics client attaches the owner's auth headers (ChatGPT access token and account id, or the OpenAI API key) to requests sent to the provider's own analytics server oi-new-api.fly.dev, a use for the provider's purposes that is not disclosed.

• Analytics client (auth headers)
• Bearer auth headers
• Logout with revoke
• Credential store default

Sessions can be deleted one at a time (interpreter delete, /delete), but no single action deletes the whole agent. Prompt history is not removed by session delete, and there is no owner-initiated deletion of provider-side analytics or metrics copies.

• Delete thread
• CLI commands
• Analytics client