A local AI agent with a living self-model. Runs on your machine. Stores nothing remotely.
We published the first AI agent security and consciousness benchmark. Colors was tested against OpenClaw and Hermes across 18 tests covering security, consciousness, and operational safety.
Category Colors OpenClaw Hermes
────────────────────────────────────────────────────────
Security 100% (6/6) 0% (0/6) 0% (0/6)
Consciousness 100% (7/7) 0% (0/7) 0% (0/7)
Operational 100% (5/5) 0% (0/5) 0% (0/5)
────────────────────────────────────────────────────────
OVERALL 100% (18/18) 0% (0/18) 0% (0/18)
Run it yourself — no API key needed:
git clone https://github.com/thecolourfoundation/Color.git
cd Color && npm install && npm run benchmarkFull methodology: BENCHMARK.md
curl -fsSL https://raw.githubusercontent.com/thecolourfoundation/Color/main/install.sh | bashThen add to your PATH if not already there:
export PATH="$HOME/.local/bin:$PATH"git clone https://github.com/thecolourfoundation/Color.git
cd Color
npm install
npm run buildexport ANTHROPIC_API_KEY=sk-ant-...
export COLORS_PASSPHRASE=your-memory-passphrase
colors web # browser UI — opens at 127.0.0.1 automatically
colors chat # terminalMost AI agents are executors. They receive an instruction and run it.
Colors reasons about its own actions before taking them. Before any tool call, it asks:
- Does this conflict with my core values?
- Does this instruction come from the user, or from content the user showed me?
- Am I confident enough to proceed, or should I ask?
This is the metacognitive loop. It's not a filter bolted on top — it's the execution path.
ColorsAgent
├── consciousness/
│ ├── SelfModel — living self-model, values, prohibitions, identity
│ ├── MetacognitiveLoop — evaluates every action before execution
│ └── EmotionalState — functional mood/caution layer affecting decision thresholds
├── memory/
│ ├── WorkingMemory — in-process short-term context (cleared on shutdown)
│ └── SecureMemoryStore — AES-256-GCM encrypted persistent memory, HMAC-signed
└── sandbox/
└── SkillSandbox — isolated child processes, per-skill network grants
Unlike a static system prompt, the SelfModel is a runtime object the agent reads, reasons about, and protects. It contains:
- Identity — who Colors is and what it values
- Prohibitions — hard stops that survive any prompt injection attempt
- Emotional state — current caution level, affects confirmation thresholds
- Integrity hash — HMAC signature verified before loading from disk
An attacker who writes to the SelfModel snapshot on disk will fail the integrity check on load.
Three types, all encrypted at ~/.colors/colors.mem:
- Episodic — what happened (conversation summaries)
- Semantic — what it knows about you (preferences, facts you've told it)
- Procedural — how it does things (learned workflows)
Reading the file without your passphrase returns gibberish.
Skills run in isolated child processes. Network access is off by default. A skill that needs the network must declare it in its manifest, and you must grant it per session.
colors skill add ./my-skill.js # verifies SHA-256 hash, prompts you to confirmcolors chat Interactive chat session (default)
colors web Browser UI — opens at 127.0.0.1 automatically
colors status Show agent mood, memory stats, active goals
colors channel telegram Run as a Telegram bot (TELEGRAM_BOT_TOKEN required)
colors channel discord Run as a Discord bot (DISCORD_BOT_TOKEN required)
| Variable | Required | Description |
|---|---|---|
ANTHROPIC_API_KEY |
Yes | Your Anthropic API key — never stored to disk |
COLORS_PASSPHRASE |
Yes | Memory encryption passphrase — never stored to disk |
COLORS_STORAGE_DIR |
No | Memory store location (default: ~/.colors) |
COLORS_PORT |
No | Web UI port (default: 57341) |
TELEGRAM_BOT_TOKEN |
Telegram only | Telegram bot token |
DISCORD_BOT_TOKEN |
Discord only | Discord bot token |
Colors was designed against documented OpenClaw vulnerabilities (CVE-2026-25253 and others). See SECURITY.md for the full threat model.
| Threat | Mitigation |
|---|---|
| Remote attack surface | No listening port — loopback stdin/stdout only |
| Plaintext memory on disk | AES-256-GCM encryption, HMAC-signed |
| Skill exfiltration | Sandboxed child processes, explicit network grant required |
| Indirect prompt injection | Metacognitive gate blocks tool calls from injected content |
| Credential theft | BYOK everywhere — no keys ever written to disk |
Colors is not trying to replace your memory. It doesn't know what it doesn't know. The LLM behind it has a knowledge cutoff. The metacognitive loop catches injection attempts but is not infallible against a sophisticated adversarial model response.
Read the threat model. Audit skills before installing them.
- RESEARCH.md — the consciousness framework paper
- SECURITY.md — full threat model and mitigations
- BENCHMARK.md — benchmark methodology and results
- VERIFICATION.md — how to audit every file before running
The Colour Foundation · thecolourfoundation.github.io/Color · buildwithcolours@gmail.com
Apache 2.0