Many agent harnesses. This one runs where your data cannot leave.
Titan is a deep agent harness: the loop, the tool contracts, the permission engine and the sandbox. It runs on your own hardware, against a model you host. Policy, audit and deny rules hold when you embed it in something else.
Single static binary · 20 providers · no egress by default
A real session
Ninety seconds, captured — not a mock-up.
A 26B model running locally, asked to add a function, write a table-driven test for it, and run the suite. Step through it; the explanation on the right follows the terminal.
Install
One static binary. No runtime to install.
# Go 1.26 or newer. Titan is a single binary with no runtime dependencies.
git clone https://github.com/yuvrajsingh/titan
cd titan
go build -o ~/.local/bin/titan ./cmd/titan
titan -version
go install path and no piped-shell installer,
because neither would work today and both are easy to check. Access is
by request — the form is at the bottom of this page.
# Build a signed bundle on a connected machine: ./scripts/build-bundle.sh # -> titan-bundle.tar.gz + .sha256 + .sig # Carry it in. On the target, with no internet route: ./scripts/verify-bundle.sh titan-bundle.tar.gz tar xzf titan-bundle.tar.gz && ./install.sh
# Titan does not ship a model. Point it at one you host: ollama serve ollama pull qwen3-coder:30b # Then, in the directory you want the agent to work in: titan init # writes .titan/config.json, detects a local endpoint titan doctor # check the endpoint before you rely on it Ready.
titan doctor is worth the ten seconds. It checks the
endpoint answers and that the model can emit a
structured tool call — a model that describes one in prose cannot drive
an agent, and finding that out mid-task wastes the run.
Full instructions, configuration and every tool contract are in the documentation.
The harness
Five ways to run it. One set of rules.
The same agent loop, the same policy engine, the same audit trail, whether you drive it from a terminal, a pipeline, another language, or your own Go service. A guarantee that held in the CLI and not in the server would not be a guarantee.
| Surface | What it is for |
|---|---|
titan |
Interactive. Line editor, slash commands, steer a run mid-flight. |
titan -p "…" |
Headless. One prompt, typed exit code, for CI and scripts. |
-output-format json |
One JSON event per line on stdout, streamed as it happens. |
titan rpc |
JSONL over stdio. Drive it as a subprocess from any language. |
titan serve |
REST, SSE and a web console. Multi-user, tenant-scoped. |
Embed it
Policy, audit and deny rules hold when embedded.
Your application supplies the approver and consumes the event stream — because a host usually has better ideas than a terminal prompt about how to ask a user for permission. Policy still decides what runs, every action is still recorded, and an extension still cannot permit what a deny rule forbids. No approver means refuse, never assume yes.
One guarantee that does not come with it: the SDK builds no sandbox. An embedded agent runs commands with the privileges of the process that embedded it, so the host is responsible for isolation — a container, a jail, a separate user — exactly as it would be for any other library that shells out.
a, err := titan.New(ctx, titan.Options{
Workspace: "/srv/work",
Provider: &titan.Provider{Type: "anthropic", Model: "claude-opus-4-5"},
Mode: "auto",
Deny: []string{"bash(rm -rf *)"},
// Your app decides. No approver means refuse — never assume yes.
Approve: func(ctx context.Context, tool string,
args json.RawMessage, d titan.Decision) (bool, error) {
return askYourUser(tool, args, d.Reason)
},
// Every action, as it happens.
OnEvent: func(ev titan.Event) { log.Println(ev.Type) },
})
defer a.Close()
answer, err := a.Run(ctx, "fix the failing tests")
Run · Continue ·
Steer (from another goroutine, mid-run) ·
Fork · Events ·
Usage · ExportHTML ·
SetModel. For anything not written in Go,
titan rpc is the same agent over JSONL.
Primitives
Extend it without forking it.
Extensions
Separate processes speaking JSONL, in any language, on seven live events — tool calls, results, context, compaction, agent start, tool listing and invocation. They may veto, never permit: an extension that could grant permission could also remove the proof of what was permitted.
Skills
A directory with a procedure in it. Only the name and description reach the prompt — about fifteen tokens each — and the body is fetched when the agent decides it applies. A skill may also declare a pipeline the harness executes rather than asks the model to follow.
MCP
Registered servers only, disabled until explicitly enabled, with an optional tool allowlist, and credentials read from the environment rather than a config file. Discovery does not imply trust.
Providers
Twenty of them over three wire formats, added from config without a rebuild. A sampling parameter the provider cannot honour fails at startup rather than being silently ignored.
Governance
What the agent did, provable afterwards.
Most of what an agent harness offers can be added later as an extension. Two things cannot: a log you can replay, and an isolation boundary the database enforces. Both have to be in the core, which is where these are.
They are not on by default. Titan ships with an in-memory store, which keeps a single-machine trial simple and gives you none of what follows. The triggers and the row-level security are properties of the Postgres store — one config line — and a deployment that needs to prove anything to an auditor has to be running it.
The log is the session
Every action is an event in the store, and the conversation is derived from those events rather than described by them. That is what makes replay exact and forking from any earlier step cheap — nothing extra had to be stored to make either work.
Immutable by trigger Postgres
Recorded events cannot be updated or deleted. Not by convention and not in application code — by database triggers that reject the statement, so an audit trail cannot be quietly rewritten by whatever is holding the connection.
Tenants isolated in the database Postgres
Row-level security scopes every query, with FORCE
because a table's owner bypasses ordinary RLS — and the application
role usually owns the tables it created, which leaves the policy
silently inert. A test read another tenant's rows until
FORCE was added.
Deny is absolute
A deny rule holds in every permission mode, including bypass. An extension may veto a call and can never permit one, so no plugin, profile or mode can widen what an operator forbade.
What this is not. None of it is a compliance certification, and none of it substitutes for one. It is the mechanism an auditor would ask to see — who did what, under whose authority, and can it be shown afterwards — built where it cannot be turned off rather than asserted in a policy document.
Context engineering
Compaction is a capacity decision, not a quality knob.
The threshold is applied to used tokens plus headroom for the turn that is coming, not to what has already happened. Without that margin the check passes at 24,809 of a 32,768 window, the next tool result adds 8,000, and the call fails — having been told, correctly, that there was no need to compact.
What survives is chosen rather than truncated: the system prompt and memory file are re-injected whole, recent turns are kept verbatim and split at a tool-call boundary so the model never sees a result answering a call it cannot see. How many turns are kept is a preference rather than a promise — exchanges are dropped from the front until what remains actually fits, and compaction returns to half the window rather than to the threshold, because stopping at the threshold leaves the session one turn away from compacting again.
Subagents get a fresh context and a narrower tool set, and return a bounded summary — so the orchestrator grows by the summary rather than the transcript. Isolation is a compression ratio, not free: each spawn re-prefills its own prefix, and that spend counts against the parent's budget rather than multiplying invisibly.
Reference application
Titan Chat is one thing built on it.
A multi-user console — documents in and out, diagrams, live Kubernetes debugging, SSH to declared hosts, every write behind a human approval gate. It is a demonstration of the harness, not the product, and it is built on the same SDK anyone else would use.
It is running now at titan.zybuu.com — the sign-in page is public, and access is by invitation while it runs on our own infrastructure. Request one and we will get back to you.
Evidence
Numbers that survive a technical diligence call.
What is not true yet. Zybuu holds no SOC 2, ISO 27001 or HIPAA certification. There is no support SLA. A human red-team engagement remains outstanding and is not substitutable by the adversarial suite. Those are stated here rather than discovered later, because the buyers this is built for will ask — and an honest answer is worth more than a careful one.
Limitations
What Titan does not do.
Every row below is a constraint we would rather you knew before a trial than after one. Where there is a path forward it is stated; where the honest answer is "not yet", it says that.
| Constraint | What it means in practice |
|---|---|
| Vision needs a vision model | Titan reads images, but only on a model that can see. A local text-only model refuses the attachment by name rather than guessing at it. |
| Single node | Sessions live in one process. There is no horizontal scaling and no failover; a restart ends running turns. Accounts survive it. Transcripts survive it on the Postgres store — on the default in-memory store they do not. |
| Postgres only | The durable store is Postgres. Other databases are reachable through SSH and their own CLI, not a native driver. |
| Auth mode is restart-only | Switching between local accounts and an identity provider rebuilds the routing table, so it needs a restart. Everything else in settings applies live. |
| Prompt injection is contained, not solved | There is no complete defence, and we do not claim one. The architecture assumes injection sometimes succeeds and limits what it can reach: absolute deny rules, no egress by default, and every observation tagged untrusted at ingest. |
| No certifications | No SOC 2, ISO 27001, HIPAA or FedRAMP. Air-gap deployment, a full audit trail and row-level security are what we have instead — and they are not the same thing as an audit. |
Request access.
Titan is not publicly downloadable yet. Tell us what you would point it at and we will get back to you — with an invite to the hosted console, or a conversation about running it on your own infrastructure.