OpenInstinct: a self-hosted iMessage agent that keeps your passwords out of the model's context
iMessage personal assistant + password vault
At a glance
- What is it?
- OpenInstinct is a TypeScript personal assistant that answers over iMessage, drives a cloud browser through Kernel, and stores credentials in an encrypted vault the model never reads. It deploys to Vercel in one click, and that convenience is also where its constraints start.
- Who is it for?
- Adopt OpenInstinct if you want an iMessage front end for browser automation and you are willing to run the whole stack inside your own Vercel account, with Kernel, Neon, Blob, and Linq all provisioned there. Do not adopt it if you need a stable tagged release, if you cannot accept that deleting the private Blob store destroys the auto-generated vault key, or if your users are not on iMessage.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository received new commits within the last day.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The chore it removes, and the person it removes it for
Most assistant projects stop at answering questions. OpenInstinct is aimed at the step after that: the README describes an assistant that can "do your chores, book you movie tickets, or handle your groceries," with a demo image showing a Fandango checkout where it reports the theater, showtime, seat, and total. The target user is someone who already lives in iMessage and wants an agent that can sign in, book, and buy, but does not want to hand account credentials to a hosted service. The README frames the tradeoff directly: personal agents are more useful when they can act on your behalf, but your accounts and passwords are the keys to everything, so OpenInstinct runs in your own Vercel account and encrypts secrets before they reach the database. If you are not on iMessage, or you only want a chat interface with no ability to transact, the browser automation and vault machinery here are cost without benefit.
How a message becomes a browser session
The architecture visible in the README has four moving parts. Linq supplies the iMessage line and delivers inbound messages to a webhook trigger at /eve/v1/linq. Vercel AI Gateway handles inference, and the README states the project "can use any model," so the model choice is not baked in. Kernel provides cloud browsers, which is what actually walks a site like Fandango to checkout. Neon provides Postgres, and a private Vercel Blob store holds browser images, per-user memory, and installation secrets. Memory is read before each agent turn, which is why production conversations require the Blob store rather than the process-local fallback used in local Eve development. The vault is the interesting piece: secrets are encrypted before they touch the database, and the README claims models never see them. That claim is checkable in the source, and the README invites exactly that, which is the right posture for a project whose whole pitch is that you should not have to trust the operator.
Workstreams: long-running goals with a forget button
Beyond per-turn memory, OpenInstinct has a separate workstreams slot backed by the application database, and it needs no extra service or credentials beyond running the app migrations. The root agent can save goals, constraints, decisions, source-linked observations, and unresolved steps across conversations. On recall it pulls an index of the eight most recently updated active or waiting workstreams, then reads the selected record before continuing; older and completed ones stay searchable. Two constraints stand out. Each scope retains up to 100 bounded records, and at capacity the agent asks which obsolete record to forget. Forgetting erases content and source references but keeps a tombstone so an interrupted save cannot restore them. Workstreams are scoped by authenticated workspace and by a deployment-aware memory key, and updates require the current revision. The README is explicit that this slot is only available in interactive root turns: remembering work does not start a job, create a schedule, or authorize an action. That is a deliberate boundary, and it means OpenInstinct is not a cron-driven automation tool.
Getting it running: the deploy button versus the manual path
The fastest route is the Deploy with Vercel button, which provisions Kernel, Neon, a private Blob store, and a Linq connector, and wires Vercel AI Gateway for inference. Usage is billed to your Vercel account. The README states the deploy flow requires no environment-variable values because Vercel supplies the application URL, database, Kernel, Blob, and Linq configuration, and OpenInstinct creates its own Better Auth and vault-encryption keys in the private Blob store on first use. On a non-Vercel host, or if you manage your own keys, you set three variables explicitly: BETTER_AUTH_SECRET and SECRET_ENCRYPTION_KEY, both generated with openssl rand -base64 32, plus BETTER_AUTH_URL pointing at your host. Database work uses DATABASE_URL for runtime queries, but migration commands need the direct DATABASE_URL_UNPOOLED connection, and pnpm db:migrate must run before starting against a new or upgraded local database. Vercel runs the uncached migration task through Turbo ahead of the application build. Better Auth keeps a separate migration path, so a single migrate command does not cover everything.
The Blob store is the vault key, and that is a real hazard
The README says it plainly: treat the private Blob store as production key material. Deleting it loses the automatically generated encryption key, and rotating that key requires re-encrypting existing vault values. This is the sharpest operational edge in the project. The convenience of zero-config key generation on first use is paired with a store whose loss is unrecoverable without a re-encryption procedure the README does not spell out. For a hobby deployment that is a reasonable trade. For anything with a second user, it is a backup and rotation problem you own. The Blob store also holds per-user memory and browser images, so its failure is not only a credential problem. If you are running outside Vercel, you supply BLOB_READ_WRITE_TOKEN from your own private Blob store, and the memory provider and browser image capture both use that same token, which means one credential covers more than one concern.
Where the release story is thin
No releases were retrieved for this repository, so there is no tagged version to pin and no changelog to read before upgrading. The last push date is 2026-09-08, and the default branch is main. In practice that means you are tracking a branch, and the README's own migration guidance (run pnpm db:migrate before starting, use DATABASE_URL_UNPOOLED, check db/README.md for existing-database adoption and constraint-validation sequencing) becomes the upgrade procedure rather than a release note. The licence is MIT, which permits commercial use and modification; that is a permission, not an operational guarantee, and nothing in the supplied material describes a support commitment. The README also notes that Linq setup requires a one-time Phone Numbers verification in the connector's Vercel Connect settings, and that additional users verify by messaging the connector's Linq number once. That is a per-user onboarding step that sits outside your code.
How it differs from a general browser-agent framework
A framework like a general-purpose browser agent gives you a library and leaves the transport, memory, credential handling, and hosting to you. OpenInstinct makes the opposite choice: it is an application with opinions. Linq is the only message transport described, Kernel is the browser, Neon is the database, Vercel Blob is the memory and secret store, and Vercel AI Gateway is the inference path. The payoff is that the deploy button provisions all of it and the vault encryption is built in rather than assembled. The cost is that swapping any one piece means reading the code, because the README documents the Vercel-shaped path in detail and the non-Vercel path as a set of overrides (BETTER_AUTH_SECRET, BETTER_AUTH_URL, SECRET_ENCRYPTION_KEY, BLOB_READ_WRITE_TOKEN) rather than as a supported configuration matrix. If you want to run this on your own hardware with your own Postgres and no Vercel account, the material here does not tell you whether that works cleanly. It tells you which variables to set and leaves the rest open.
Editorial conclusion
Adopt OpenInstinct if you want an iMessage front end for browser automation and you are willing to run the whole stack inside your own Vercel account, with Kernel, Neon, Blob, and Linq all provisioned there. Do not adopt it if you need a stable tagged release, if you cannot accept that deleting the private Blob store destroys the auto-generated vault key, or if your users are not on iMessage. Verify first that the Vercel Connect Phone Numbers step for your Linq connector is complete, that pnpm db:migrate has run against DATABASE_URL_UNPOOLED before you start the app, and that you have a plan for re-encrypting vault values if the Blob store is ever rotated.
Community notes