Wirken

Wirken is the enterprise gateway for autonomous agents: the switchboard between your team's messaging channels and the AI agents working on their behalf. Your people reach it from a browser or the chat platforms they already use, like Slack and Teams, and the agent on the other end reads files, calls APIs, and runs tools for them. Each channel gets its own line.

Wirken is built for the security team that has to answer for what those agents do. It assumes any agent can be turned against you, and boxes in what a compromised one can reach.

It ships as a single static Rust binary, so it runs wherever your controls require: a locked-down workstation, a server inside your network, or an air-gapped host. Its model connection is provider-agnostic: frontier APIs like OpenAI, Anthropic, and Gemini, local weights through Ollama, TEEs for encrypted processing, or Infomaniak's Swiss-hosted Apertus, all interchangeable. Each agent runs the model you assign it, capped by a per-agent spend budget with usage reporting. Frontier or local, on your hardware or a remote host, the data boundary is yours to draw. MIT licensed.

How it works

Wirken sits between your people and the agent. A message comes in on a channel, Wirken wakes an agent to handle it, and every file it reads, API it calls, and tool it runs passes through Wirken's controls first.

• The agent is untrusted. Wirken assumes any agent can be turned against you, whether by a prompt-injection payload hidden in a file or web page or by drift over a long session. The guarantees below do not depend on the model behaving.
• Credentials never reach the model. Tokens and keys stay in an encrypted vault. Wirken supplies them at the edge when it talks to a channel or an MCP tool; the agent and the LLM never see them.
• Every action is logged before it runs, and attributed. Each step is written to a signed, hash-chained audit log as a typed event, tagged with the person who triggered it, before it executes. The log streams to your SIEM.
• Least privilege by default. Each agent runs under a three-tier permission model, and any sub-agent it spawns is boxed by limits you set: which tools, which tier, how many rounds, how long.
• Shell commands run in a sandbox. Anything the agent executes runs in an ephemeral container with no network, with gVisor as an option. A channel can be granted bounded egress through a policed proxy, but never gets unrestricted reach. If the sandbox is unavailable, execution is refused rather than run on the host.

Install and run

Prerequisites

• A supported OS: Linux (x86_64 or aarch64), macOS (Intel or Apple Silicon), or Windows 11 (x86_64). On Windows the gateway and channels run normally; sandbox egress is the exception, because its decision broker needs a Unix socket. A channel set to allowlist or open refuses exec there rather than running it unproxied, so Windows deployments leave sandbox egress at none.
• At least one model to talk to. Wirken connects to any of:
  • Ollama (any local model it serves)
  • Any OpenAI-compatible endpoint
  • OpenAI
  • Anthropic
  • Google Gemini
  • AWS Bedrock
  • NVIDIA NIM (local or cloud)
  • Tinfoil (TEE, encrypted processing)
  • Privatemode (TEE, encrypted processing)
  • Infomaniak (Swiss-hosted, including Apertus)
  • Hetzner (EU-hosted)
• Docker, if you want shell commands sandboxed (the default). Without it the agent simply cannot run shell commands; nothing else is affected. Granting a channel sandbox egress runs a per-exec sidecar proxy container alongside the sandbox; if it cannot start, exec is refused rather than run unproxied.

Download the latest release binary:

curl -fsSL https://raw.githubusercontent.com/gebruder/wirken/main/install.sh | sh

wirken setup
wirken run

Pin the installer before piping. The committed install.sh has this SHA-256:

73e678196ea073608e902c8ab11a01ede07e0d37fddccaa20c43fa5d62bd52f5

Verify it yourself:

curl -fsSL https://raw.githubusercontent.com/gebruder/wirken/main/install.sh | sha256sum

The installer then fetches checksums.sha256 and checksums.sha256.sig from the release, verifies the signature with ssh-keygen -Y verify against a signing key embedded in the script, and verifies the binary's SHA-256 against the signed checksums. Every failure path is fail-closed: missing signature, missing checksum, mismatched digest, or a machine without sha256sum/shasum aborts install. The only override is WIRKEN_ALLOW_UNVERIFIED=1, which warns on stderr and is documented in docs/release-signing.md.

Prebuilt binaries are available for Linux (x86_64, aarch64), macOS (x86_64, Apple Silicon), and Windows 11 (x86_64). The Linux binaries are statically linked against musl with no glibc dependency. Windows users: the bash installer above does not apply; see docs/windows.md for the Windows install path and the feature-set differences (Signal adapter, orchestrator-push, service installer, and cron presets are Linux/macOS only).

wirken setup walks you through six steps:

  wirken setup
  ────────────

  Wirken is the switchboard between your messaging channels and an
  AI agent you control. Credentials never reach the LLM. Every
  action is logged in a signed, hash-chained audit log.

  Setup walks through six steps: provider, channels, credentials,
  service, sandbox, audit. About a minute.

  Continue [Y/n]: y

  ... (six interactive steps) ...

  Setup complete!

  Provider: anthropic (claude-sonnet-4-6)
  Channels: Telegram

  Next steps:
    wirken channel add <channel>      Add another messaging channel
    wirken credentials add <name>     Add or rotate a key
    wirken doctor                     Verify the install
    wirken sessions list              See active conversations

  WebChat: http://localhost:18790

  Start wirken: wirken run

wirken run starts wirken. It spawns adapter processes, accepts authenticated connections, routes messages to the agent, and serves a WebChat UI at http://localhost:18790:

  wirken v1.19.0
  ──────

  Provider: ollama/llama3.2
  Ollama version: 0.19.0
  Route: Telegram -> agent:default
  WebChat: http://localhost:18790

  Wirken running. Press Ctrl+C to stop.

All local services bind to 127.0.0.1. Wirken never instructs you to bind inference servers, WebChat, or any local endpoint to 0.0.0.0.

Install as a system service so wirken starts on login:

wirken setup --install-service

Running modes

• Interactive. wirken run starts the gateway in the foreground, spawns the channel adapters, and serves WebChat. Ctrl+C stops it.
• Browser. That same wirken run serves WebChat at http://localhost:18790, bound to localhost, so your team can use Wirken without installing a chat app.
• As a service. wirken setup --install-service installs a systemd user unit on Linux or a launchd agent on macOS, so the gateway starts on login and runs headless. wirken setup --uninstall-service removes it.
• Scheduled. Preset agents run on a cron schedule with no human in the loop, under the same permission and audit controls, via wirken preset schedule <name> (and unschedule). Service and scheduled modes are Linux and macOS only.

Uninstall

Removing the data directory is irreversible and destroys the signed, hash-chained audit log along with it. If any retention or compliance need applies, export the audit chain before you delete anything:

wirken audit log --format json > wirken-audit-export.json   # one-shot JSON snapshot
cp ~/.wirken/audit.db wirken-audit-backup.db                 # or copy the raw hash-chained DB

Then uninstall in order. The service and cron steps call the wirken binary, so run them before removing it:

# 1. Stop and remove the system service. Removes the systemd user unit
#    ~/.config/systemd/user/wirken.service on Linux, or the launchd agent
#    ~/Library/LaunchAgents/app.ottenheimer.wirken.plist on macOS.
wirken setup --uninstall-service

# 2. Remove any scheduled preset cron entries (leaves your own cron lines
#    intact). Repeat per installed preset, e.g. zirkel:
wirken preset unschedule zirkel

# 3. Remove the binary.
rm "${WIRKEN_INSTALL_DIR:-$HOME/.local/bin}/wirken"

# 4. Remove the data directory. Deletes the credential vault, the age-file
#    device key, and the audit chain. Irreversible.
rm -rf ~/.wirken

Residue the steps above do not touch:

• Shell profile: if you exported WIRKEN_VAULT_PASSPHRASE in ~/.bashrc, ~/.zshrc, or a similar file, delete that line.
• OS keychain: the default release build keeps the vault device key in the age-file keychain under ~/.wirken/keychain/, which step 4 removes. Only a build with the keychain-macos or keychain-linux feature stores it in the OS keychain instead. In that case remove it by hand. On macOS, the generic-password items under service dev.wirken.vault (account device-key, plus one aux entry per auxiliary key, for example alarm-log-hmac). On Linux, the Secret Service items with attribute application=wirken (the device key is labeled wirken-device-key).
• Platform-side registrations: local deletion does not touch state you created at each messaging platform. Remove or revoke it there:
  • iMessage (BlueBubbles): the adapter registers a callback webhook on your BlueBubbles server (POST <bluebubbles_url>/api/v1/server/webhooks)