# Armorer One-Pager

## Working Title
**Armorer** is an Ollama-like installer and control plane for personal AI agents, built to make self-hosted agents easy to adopt without accepting default-insecure deployments.

## The Problem
Personal agents are becoming easier to discover and harder to trust.

Projects like OpenClaw, OpenHands, AutoGPT, LibreChat, and similar agentic applications promise powerful local workflows, but the installation and runtime experience is still fragmented:

- Users clone random repos, run unknown setup scripts, and hope Docker Compose works.
- Security decisions are pushed onto the user at the worst possible time, usually through raw config files and unclear environment variables.
- Agents often need sensitive credentials, filesystem access, network access, and long-lived runtime state, but most projects do not ship with principled guardrails.
- Once running, these agents are rarely monitored. If they leak secrets, expose unsafe endpoints, or operate outside their intended scope, the user typically finds out too late.

In practice, there is a gap in the market:

**Ollama made local model adoption simple. Armorer aims to do the same for personal agents, but with adaptable security controls out of the box and minimal user configuration.**

## The Armorer Thesis
Armorer treats agent installation as a security and operations problem, not just a packaging problem.

Instead of giving users a pile of repos, YAML, and setup instructions, Armorer provides a single workflow that:

1. Installs known and unknown agent projects through a guided CLI.
2. Applies a risk-aware security profile before the agent is launched.
3. Hardens Docker and runtime defaults automatically.
4. Manages credentials through a vault/keyring flow instead of plain-text sprawl.
5. Keeps a persistent oversight layer watching installed agents after deployment.

The result is a product that feels operationally simple like an app installer, while behaving more like a lightweight security control plane for personal agents.

## What Armorer Offers

### 1. One command to install an agent
Armorer exposes a simple flow:

```bash
armorer configure
armorer install openclaw
armorer run openclaw
```

Behind that flow, the codebase already supports:

- Known-agent catalog and playbooks for projects like OpenClaw, OpenHands, AutoGPT, LibreChat, AnythingLLM, and Open WebUI.
- Dynamic installation for unknown repositories.
- Guided run commands and startup surfaces for CLI and service-style agents.

### 2. Adaptable security controls with minimum configuration
Armorer does not assume every agent should get full trust.

It defines runtime risk through explicit policy layers:

- **Network policies**: `NONE`, `WHITELIST`, `OPEN`
- **Filesystem policies**: `NONE`, `ISOLATED`, `SCOPED`, `HOME`, `ROOT`
- **Human-in-the-loop controls** for higher-risk actions

This is the core product idea: users should answer a small number of intent questions, and Armorer should translate those answers into safe defaults automatically.

### 3. Secure-by-default deployment hardening
Armorer’s installer does more than generate or reuse `docker-compose.yml`.

It actively hardens deployments by:

- rejecting or flagging mutable, unpinned images
- enforcing `no-new-privileges`
- dropping Linux capabilities with `cap_drop: ALL`
- disabling `privileged` mode
- forcing read-only filesystems where possible
- removing unsafe mounts such as `docker.sock` unless explicitly allowed
- constraining network access based on the selected profile

This is important strategically: Armorer is not just a convenience wrapper around Docker. It is a policy-enforcing installer.

### 4. Pre-install scanning and runtime oversight
Armorer addresses both phases of risk:

- **Before install**: repository scanning for code and dependency risks
- **During runtime**: a persistent Core service monitors installed agents, audits tasks, verifies signatures, supports confirmation gates, and can redact secrets from runtime history

The architecture creates a deliberate asymmetry:

- the agent runs in its own sandbox
- Armorer Core can observe and intervene
- the agent cannot see or directly control the Core

That is a differentiated position versus most self-hosted agent setups, which stop caring once the container starts.

### 5. Credential vault and reusable skills
Armorer reduces operator burden in two places that usually create friction:

- **Credential Vault**: secrets are stored in keyring/vault flows instead of living in `.env` forever
- **Skill Armory**: MCP-style skills can be defined once and injected into supported agents

This matters because agent adoption breaks down when users are repeatedly asked to hunt down keys, edit configs, and manually wire tools.

## How the Solution Works

### Product flow
1. The user selects an agent or repo to install.
2. Armorer scans the repo and identifies config surfaces.
3. Armorer asks a small security interview to infer the correct risk profile.
4. The installer graph maps the repo, plans a deployment, reviews it for hardening, provisions it, and validates runtime health.
5. If deployment fails, Armorer enters an autonomous repair loop with logs, knowledge retrieval, verification, and fix application.
6. Once installed, the agent is registered and monitored by Armorer Core.

### Architectural model
Armorer is not only a CLI. It is a service-oriented system with:

- a CLI and chat interface
- a persistent Core container
- isolated runtime containers for each installed agent
- an app registry, vault, audit logs, and OTEL/file-based monitoring feeds

This gives the product two modes at once:

- a user-facing installer experience
- a background governance layer for personal agents

## Why Now
There is a growing mismatch between how quickly people can install agent software and how little protection exists once they do.

Today, most users fall into one of two bad options:

- raw DIY setup with almost no security posture
- enterprise security tooling that is too heavy for personal or prosumer agent use

Armorer can occupy the middle:

**consumer-simple adoption with operator-grade controls**

That positioning is especially strong for:

- security-conscious developers
- prosumers running local or self-hosted agents
- small teams experimenting with agentic infrastructure
- future marketplaces for installable personal agents and skills

## Differentiation

### Compared with a raw GitHub install
Armorer adds:

- guided installation
- safer defaults
- credential handling
- runtime monitoring
- repair automation
- consistent UX across many agent projects

### Compared with Ollama
Ollama made models easy to pull and run.

Armorer extends that mental model from models to agents:

- installable personal agents
- opinionated runtime setup
- standardized control surfaces
- adaptable security profiles
- post-install oversight

The analogy is useful:

**If Ollama is the easy runtime for local models, Armorer is the secure installer and lifecycle manager for personal agents.**

## What Makes Armorer Credible
This repo already contains the backbone of that story:

- installer graph orchestration for deterministic deployment
- dynamic and playbook-based installs
- policy guards for command, path, and network controls
- compose hardening logic
- vulnerability scanning
- vault-backed secret handling
- MCP skill management
- messaging gateways with confirmations, rate limits, and task signing
- OTEL-aware runtime monitoring and guard flows

This is not a concept-only positioning exercise. The product thesis is visible in the implementation.

## Proposed Positioning Statement
**Armorer is an Ollama-like installer for personal AI agents that makes self-hosted agent adoption simple, while enforcing adaptable security controls, safer runtime defaults, and ongoing oversight with minimal user configuration.**

## Short PR/Launch Summary
Armorer packages the messy reality of personal agent deployment into one opinionated workflow: discover, install, harden, run, and monitor. It solves the main blocker in agent adoption today, which is not model quality alone, but the unsafe and inconsistent way agents are installed and operated. By combining installer simplicity with built-in security controls, Armorer can become the default entry point for running personal agents safely.
