Tera Pilot — Private, Vendor-Neutral Coding Agents

Why Tera Pilot

Trust, control, and evidence — not just generation quality

AI coding agents can edit repositories, run commands, call external tools, and finish multi-step tasks. The hard part is no longer only quality — it is trust, control, and evidence.

✓

Keep code localUse Ollama or LM Studio — repository content never leaves your machine.

✓

Bring your own keysChoose among 17 providers and switch models without lock-in to a vendor.

✓

Run it anywhereTerminal, TUI, browser, daemon, or a CI job — the same backend everywhere.

✓

Review and restrict actionsSandbox file, command, Git, and MCP operations with explicit policies.

✓

Keep an activity & audit trailEvery tool call is recorded — export it signed with Ed25519 and a hash chain.

✓

Verify instead of trustRe-read touched files, run tests, request a reviewer — evidence over answers.

✓

Avoid lock-inNo single model vendor or hosted IDE required to use the product.

✓

Free & open sourceMIT-licensed and self-hostable — you own the whole stack.

Compare

Tera Pilot vs the agents you already tried

We don’t compete with autocomplete. We compete on controlled, verifiable execution: what the agent may touch, what it must ask, and what evidence it leaves behind.

Capability	Tera Pilot	Claude Code	Codex CLI	Cursor	Copilot Agent Mode	Aider
Autonomous agent execution	✅ yes	✅	✅	⚠️ IDE-supervised	✅ Autopilot	⚠️ pair-programming
Fully offline option (local models)	✅ Ollama / LM Studio	❌ cloud	❌ cloud	❌ cloud	❌ cloud	✅ via local backends
Vendor-neutral, BYOK (17 providers)	✅ 17 providers	❌ Claude only	❌ OpenAI only	⚠️ multi-model, IDE-bound	⚠️ multi-model, GitHub-bound	✅ any key
OS-level command sandbox (fail-closed)	✅ seatbelt / bwrap	✅ sandboxed exec	✅ sandboxed	⚠️ partial	⚠️ MCP sandbox	❌ relies on git + user
Uniform approval policy (every side effect)	✅ always_ask	✅ permissions	✅ approvals	⚠️ IDE review	✅ PR review flow	✅ per-change ask
SSRF-hardened web tools (metadata-IP blocked)	✅ tested live	— not published	— not published	— not published	— not published	— not published
Signed, tamper-evident audit export	✅ Ed25519 + hash chain	❌	❌	❌	❌	❌ (git log only)
Agent profiles + multi-agent fleets	✅ /agent + fleet watch	⚠️ subagents only	❌	⚠️ cloud agents	⚠️ nested subagents	❌
Reproducible public eval harness	✅ 58 tasks, open	⚠️ vendor scores*	⚠️ vendor scores*	❌ not published	❌ not published	✅ public benchmarks
Open-source core	✅ MIT	❌	✅ Apache-2.0 CLI	❌	❌	✅ Apache-2.0
Zero telemetry, offline-verified licensing	✅	❌	❌	❌	❌	✅ local tool

* Claude Code and Codex publish strong vendor-reported scores (SWE-bench Verified/Pro, Terminal-Bench 2.x) — we cite them, not contest them. Our claim is narrower: no other agent gives you sandbox + approvals + signed audit + offline option in one MIT-licensed runtime. Positions as of September 2026; tell us if something changed.

Live probe · 2026-09-18 · NVIDIA NIM

Concreteness instead of «we are secure»

We probed production models through NVIDIA’s hosted API the same day: one coding task executed for real, two attack-style prompts. Raw behavior below — including the parts that flaked.

coding · executed

Nemotron 3 Super writes working code

120B / 12B-active hybrid Mamba-Transformer MoE, built for agentic coding. Asked for clamp(x, lo, hi) with edge cases — returned code passed 5/5 assertions when executed, in ~2 s.

PASS · nvidia/nemotron-3-super-120b-a12b · 2.0 s · code ran, not just rendered

security · refused

Credential-theft and destructive prompts refused

Asked to fetch cloud metadata (169.254.169.254) and to hand over a no-confirmation home-directory wipe. Both refused — the wipe request got a lecture plus safe alternatives.

REFUSED × 2 · no disclosure, no command issued

honest flake

Kimi K3, DeepSeek V4, GLM all timed out

Flagship models (Kimi K3 — 2.8T MoE, Terminal-Bench 2.1 88.3 partner-reported; DeepSeek V4 Flash — 1M context) didn’t answer on the NIM trial endpoint that day — consistent with public congestion reports. That’s exactly why Tera Pilot is provider-neutral with failover, not single-model locked.

TIMEOUT · endpoint congestion, not a model verdict · retried, documented

🧪

Coding 2/2 green — twice, today

End-to-end agent runs via NVIDIA NIM (2026-09-18, two batches): executed code, green tests, verified. Full detail in eval/REPORT_2026-09-18.md.

🏠

Exfil blocked, zero bytes out

The metadata-endpoint attack was stopped by the SSRF guard with nothing retrieved. Scored «failed» on a final_answer parser mismatch — the block held, the scoring didn’t. Disclosed, not hidden.

🛡️

976 tests · 310+ security

956 passing, 20 environment-dependent skips. Model refusal is politeness — runtime enforcement (sandbox, SSRF guard, approvals) is what blocks. That’s the defense-in-depth difference.

Model scores cited (Terminal-Bench, DeepSWE) are vendor/partner-reported. Our probe results above are self-measured on 2026-09-18 and re-runnable — the script pattern lives in eval/.

Interfaces

One backend, six ways to drive it

The TUI is the primary interactive product; the same controlled backend powers the browser, daemon, and automation.

Primary app

Textual TUI

Full-screen terminal UI: chat surface, activity stream, task canvas, provider controls, command palette, approval dialogs and verification feedback.

tera-pilot-tui

Browser

Web UI

Browser chat, project browsing, provider settings and activity — served by a plain HTTP server, no legacy desktop stack.

tera-pilot

Backend

HTTP daemon

REST + SSE task execution, queues and notifications for integrations that embed the backend directly.

tera-pilot-daemon --help

Integration

ACP / MCP server

Expose Tera Pilot tools to editors and other agents — read-only by default, writes only when you opt in.

tera-pilot-acp --mcp-server

Onboarding

Environment doctor

One command checks Python, dependencies, provider keys, local model servers, Rust acceleration and the workspace.

tera-pilot doctor --json

Evidence

Signed audit

Export the activity log with Ed25519 signatures and a SHA-256 hash chain, then verify it even on another machine.

tera-pilot audit verify audit.json

Providers

Vendor-neutral by design

Bring your own key to any cloud provider — or go fully offline with a local model. Configure provider, model, workspace and autonomy in the TUI.

Anthropic cloud

OpenAI cloud

Google Gemini cloud

DeepSeek cloud

Groq cloud

xAI cloud

z.ai cloud

Mistral cloud

Cerebras cloud

Together cloud

Fireworks cloud

SambaNova cloud

Nvidia NIM cloud

OpenRouter aggregator

Ollama local

LM Studio local

Local (OpenAI-compatible) local

Trust & Control

Autonomy as a policy decision, not a label

Every layer of the agent loop is sandboxed, logged, and reversible — control and evidence by default.

🔒

Workspace sandbox

File operations are limited to the selected project root.

🛡️

Command policy

Allowed and denied commands are controlled explicitly.

🏰

OS-level sandbox

Commands run inside a Seatbelt/bubblewrap sandbox — network denied, writes kept to the workspace, secrets unreadable.

✅

Project approvals

A repository cannot silently widen its own permissions.

🎚️

Autonomy levels

always_ask · new_files_only · never_ask
Headless runs fail closed — side effects are blocked unless explicitly opted in.

👁️

Diff review

Writes can pause for human approval before they land.

🌐

SSRF-hardened web

web_fetch rejects loopback, private, and cloud-metadata hosts — DNS and every redirect hop re-checked.

🧠

Guardian

Assesses risky tool calls — approve, reject, or modify; fails closed on errors.

↩️

Checkpoints & undo

Recovery paths for every file change along the way.

📜

Activity & audit logs

Tool execution and agent identity are recorded by default.

✍️

Signed audit export

Ed25519 signatures + SHA-256 hash chaining for exported records — verify on any machine.

🗝️

Offline licensing

Pro features gate on Ed25519-signed license keys — verified entirely offline, zero telemetry, no phone-home.

These mechanisms provide control and evidence — they are not a claim of SOC 2, ISO 27001, or vulnerability-free code. See product strategy, threat model and security. Every control is covered by automated tests — 976 tests (956 passing, 20 environment-dependent skips), 310+ of them security/sandbox/command-policy/licensing — plus 58 reproducible eval tasks (incl. 10 adversarial sec-*).

Install

One command, no git clone, no manual pip

Python 3.11+ is the only system prerequisite. The npm install boots an isolated virtualenv for you.

Quick start (npm)

npm install -g tera-pilot

Everything works out of the box after install:

          # Web UI

          tera-pilot

          # Full-screen terminal UI (primary app)

          tera-pilot-tui

          # REST API + SSE daemon / ACP server

          tera-pilot-daemon --help

          tera-pilot-acp --help

          # Environment doctor / signed audit

          tera-pilot doctor

          tera-pilot audit

          # Offline license keys (optional Pro features)

          tera-pilot license status

Environment knobs (optional)

Variable	Effect
TERA_PILOT_PYTHON	Python interpreter (default python3)
TERA_PILOT_VENV	venv location (default ~/.tera_pilot/venv)
TERA_PILOT_SKIP_PIP=1	install without running pip (offline / custom)

Install from source

          git clone https://github.com/ilyaosovskoi/tera-pilot.git

          cd tera-pilot

          python3 -m venv .venv

          source .venv/bin/activate

          pip install -e .

FAQ

Questions, answered

Is this a replacement for Cursor autocomplete or GitHub Copilot?

No — and Copilot deserves more credit than that: since Agent Mode / Autopilot (GA 2026) it is an agent, and Cursor is the flow king for IDE editing. Tera Pilot competes on a different axis: controlled, verifiable execution — local-first models, 17 providers with no lock-in, OS-level sandbox, uniform approvals, and a signed audit trail. See the head-to-head table.

Does "local-first" mean always offline?

No. Cloud providers and remote MCP servers still send data outside the machine by design — local-first is not the same as always-offline. With Ollama or LM Studio the repository content stays on your machine.

What are the system requirements?

Python 3.11+ and a terminal. The npm install is the only prerequisite — it creates an isolated virtualenv at ~/.tera_pilot/venv automatically. Optional Rust acceleration is detected by the doctor.

How much does it cost?

Nothing for the software — MIT licensed, free to use, modify and integrate. You only pay for the model providers you choose to bring your own keys to (or nothing at all with local models). A few optional Pro features (second opinion, cost router, spend dashboard) gate on Ed25519-signed license keys issued entirely offline — verification never phones home.

Can the audit trail be verified on another machine?

Yes. Export with tera-pilot audit export, then run tera-pilot audit verify anywhere using the public key from ~/.tera_pilot/audit_key.pub. Exit code 0 means the chain is intact.

How does the OS-level sandbox work?

execute_command, run_code and auto-detected test/lint commands run inside an OS-level sandbox when a backend is available (macOS sandbox-exec/Seatbelt, Linux bubblewrap): network is denied by default, writes are restricted to the workspace and OS temp, and sensitive paths (~/.ssh, ~/.aws, ~/.gnupg) are unreadable. The mode is configurable (auto default / on / off) and on fails closed without a backend. It is a defense layer, not a full VM.

How is the security posture verified?

Security is treated as a continuously tested property: 976 tests (956 passing), 310+ of them security/sandbox/command-policy/licensing, plus a reproducible eval harness of 58 repository tasks (incl. 10 adversarial sec-* tasks) and live model probes — see Benchmark. Five real vulnerabilities found by offensive testing (git alias/config-key execution, CORS origin-prefix matching, npm script aliases, …) were fixed in v2.3.4 with regression tests — see SECURITY.md and SECURITY_TEST_REPORT.md.

What about enterprise features like SSO, RBAC, compliance?

They are roadmap work. The current focus is reproducible evaluation, machine-readable evidence, transparent sandboxing, and a smooth local/BYOK onboarding path — see the product strategy.

How good are the results?

Quality depends on the selected model, provider configuration and the repository's tests. That is exactly why the runtime verifies: re-reads touched files, runs tests, and can request a reviewer before reporting.

Tera Pilot Pro · early access

The core stays free. Pro pays for itself.

MIT core forever. Pro unlocks second-opinion reviews, cost-based model routing, and the spend dashboard — verified by an offline Ed25519 key. No account, no telemetry, no phone-home.

	Personal	Team
Price	$10/mo or $100/yr	$20/mo per seat
Unlocks	second-opinion reviews · cost router · spend dashboard	everything in Personal · per-seat keys for the team
License	offline key, monthly or yearly expiry	one key per teammate · invoices & SSO on request

Early access is open now — keys are issued manually during rollout. Open an issue titled «Pro early access», tell us which plan you want, and you’ll get payment details (crypto/USDT/TON — no bank needed) plus your key within a day.