{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-12", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "talorys", "name": "Talorys", "vendor": "Roc Yu (rociiu) and contributors", "vendorUrl": "https://github.com/rociiu/talorys", "kind": "platform", "category": "personal-assistants", "summary": "Talorys is an open-source, single-user personal AI assistant that its owner deploys into their own Cloudflare account with one command. It chats, keeps editable memories, and manages tasks, notes, projects, reminders and scheduled routines.", "url": "https://www.anchorterminal.com/tools/talorys", "markdownUrl": "https://www.anchorterminal.com/tools/talorys.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/talorys.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/talorys.json", "repo": "https://github.com/rociiu/talorys", "license": "MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms.", "transports": [], "packages": [ { "registry": "npm", "name": "create-talorys" } ], "auth": "mixed", "authNotes": "The installer signs in to Cloudflare through Wrangler's OAuth flow, or uses an API token with Workers Scripts, Pages, Workers AI and Account Settings permissions. The owner password is hashed locally with PBKDF2-SHA256 and stored as a Worker secret. The web app uses an HttpOnly session cookie, and every non-GET request needs an x-talorys-request header and a same-origin Origin (https://github.com/rociiu/talorys/blob/main/docs/security.md). There is no API key, MCP server or signup.", "pricing": "free", "pricingNotes": "Free and MIT-licensed, designed to fit the Cloudflare Workers Free plan, including a daily Workers AI allocation. On a paid Cloudflare plan, use beyond the included amounts is billed by Cloudflare (https://github.com/rociiu/talorys#7-what-is-free-and-what-may-cost-money).", "priceSummary": "Free ยท OSS", "where": "local", "x402": { "level": "no", "evidence": "No payment protocol. Talorys has no billing of its own, checked 12 October 2026.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 978, "pypiWeekly": null, "asOf": "2026-10-12" }, "docsUrl": "https://github.com/rociiu/talorys/tree/main/docs", "capabilities": [ "assistant.memory", "assistant.self-hosted", "memory.user", "memory.search", "tasks.create", "tasks.update", "notify.in-app" ], "tags": [ "open-source", "self-hosted", "free", "typescript", "cloudflare" ], "lastRelease": "2026-10-12", "graded": true, "disclosure": "Talorys competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "localghost", "anchor": { "graded": true, "score": 28.9, "grade": "F", "agentReady": false, "rank": 976, "ranked": true, "rankOf": 993, "categoryRank": 19, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 0, "maintenance": 83, "payments": 60, "reliability": 41, "schema": 0, "security": 8, "transparency": 52 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 41, "points": 8.2, "reason": "Read with the local-software lines, as GRADER.md sets for Talorys and as the Goose and Aider dossiers read them. create-talorys on npm with Node.js 22 or later stated, deploying into the owner's Cloudflare account (20). The CI workflow runs lint, typecheck, build, unit tests, a pack test and Playwright end-to-end tests on pushes to main and on pull requests. GitHub refused our requests for run results, and the Goose dossier gave 18 for CI whose current state was unconfirmed (18 of 25). Open issues are unchecked. GitHub's issue pages and API refused our requests, and the clone shows only merged pull requests (12 of the 24 numbers used since 10 October), so the open reports couldn't be read. The brief scores an unchecked line as absent, and the repository may be fine on it (0, unchecked). Semver releases on npm (0.1.0 to 0.1.5) and two tags, with no changelog or breaking-change notes (3 of 15). 0.1.5, pre-1.0 (0)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 0, "points": 0, "reason": "Graded on the interface an outside agent can use, as GRADER.md asks. Talorys has none. Its /api routes are the web app's private backend, undocumented as an API, and need the owner's session cookie, an x-talorys-request header and a same-origin Origin, with no API key, MCP server or A2A endpoint. So the contract, description, typed-input and example lines score nothing (0 of 25, 0 of 20, 0 of 15, 0 of 15), which says nothing about the app for its owner. The docs are Markdown files in the repository with no llms.txt or served copies, which the Khoj and Aider dossiers scored 0 (0 of 10). The versioning and changelog line versions an agent interface, and with none there is nothing to version, so it scores nothing (0 of 15). We read it this way for every listing in this batch without an agent interface, and app release notes count under maintenance instead." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 0, "points": 0, "reason": "Graded on the interface an outside agent can use. Talorys has none, so context cost, pagination, errors, retries and defaults have nothing to score (0 on each line). This says nothing about the app for its owner. The reason is in the schema note." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 8, "points": 1.4, "reason": "Graded on the interface an outside agent can use. With none for Talorys, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15), whatever the app does for its owner. The security programme line doesn't need an interface and is scored. For the record, docs/security.md documents a PBKDF2-hashed owner password, HMAC-stored session tokens, login lockouts with Retry-After, CSRF checks, a Worker with no public URL, destructive tools that need confirmation in the owner's latest message, read-only tools for scheduled runs, imported automations paused, and no shell or outbound HTTP tools. Security programme. SECURITY.md asks for private GitHub reports, aims to acknowledge within 3 business days and fix within 30, sets a scope that includes prompt injection causing unconfirmed writes, and docs/security.md sets out a threat model. An esbuild dev-dependency advisory was overridden on 11 October. No security.txt (there's no site), bug bounty, certification or published advisories (8 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Read with the self-hosted rule, as the Khoj, Goose and Aider dossiers read it. No payment protocol (0). Free and MIT-licensed with nothing to buy, so 20, 20 and 20 on the last three lines. The README says it fits Cloudflare's Workers Free plan, and use beyond the included amounts on a paid Cloudflare plan is billed by Cloudflare, not Talorys." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "create-talorys 0.1.5 published to npm on 12 October 2026 (30). Five releases since 10 October, 0.1.0 to 0.1.5 (20). Pull requests from outside contributors (at least five authors besides the maintainer) and Dependabot were merged on 11 and 12 October, the earliest within about two hours of their last commit. Issue replies couldn't be read. The Marmot dossier gave 15 where activity was visible and reply times weren't (15 of 25). Read as current official builds, as the Open WebUI and Goose dossiers read this line for local software. The npm installer tracks main and deploys the agent, with no other packages (12 of 15). A lockfile, current dependencies (TypeScript 6, Vitest 4), Dependabot security pull requests and an esbuild override for an advisory, with no dependabot.yml or audit workflow and CI results unseen, below Goose's 8 for a fuller toolchain (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 52, "points": 4.55, "note": "editorial 77, provenance 27", "reason": "MIT (30). There's no vendor service, so no terms or privacy policy of its own. The README says Talorys has no telemetry, analytics or tracking and sends nothing to its developers, that data lives in a Durable Object in the owner's Cloudflare account, and that Cloudflare processes it, Workers AI inference on messages and memories included. The source makes no outbound calls beyond Cloudflare bindings and the installer turns Wrangler's metrics off, which agrees. Sessions expire after 30 days or 14 of inactivity, and retention at Cloudflare follows Cloudflare's terms (22 of 30). SECURITY.md says only the latest version gets fixes and migrations are append-only, with no deprecation policy (5 of 20). No telemetry, stated in the README and consistent with the code, so there's nothing to opt out of (20)." } ], "assessment": { "date": "2026-10-12", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the interface an outside agent can use. Talorys has none, so context cost, pagination, errors, retries and defaults have nothing to score (0 on each line). This says nothing about the app for its owner. The reason is in the schema note.", "maintenance": "create-talorys 0.1.5 published to npm on 12 October 2026 (30). Five releases since 10 October, 0.1.0 to 0.1.5 (20). Pull requests from outside contributors (at least five authors besides the maintainer) and Dependabot were merged on 11 and 12 October, the earliest within about two hours of their last commit. Issue replies couldn't be read. The Marmot dossier gave 15 where activity was visible and reply times weren't (15 of 25). Read as current official builds, as the Open WebUI and Goose dossiers read this line for local software. The npm installer tracks main and deploys the agent, with no other packages (12 of 15). A lockfile, current dependencies (TypeScript 6, Vitest 4), Dependabot security pull requests and an esbuild override for an advisory, with no dependabot.yml or audit workflow and CI results unseen, below Goose's 8 for a fuller toolchain (6 of 10).", "payments": "Read with the self-hosted rule, as the Khoj, Goose and Aider dossiers read it. No payment protocol (0). Free and MIT-licensed with nothing to buy, so 20, 20 and 20 on the last three lines. The README says it fits Cloudflare's Workers Free plan, and use beyond the included amounts on a paid Cloudflare plan is billed by Cloudflare, not Talorys.", "reliability": "Read with the local-software lines, as GRADER.md sets for Talorys and as the Goose and Aider dossiers read them. create-talorys on npm with Node.js 22 or later stated, deploying into the owner's Cloudflare account (20). The CI workflow runs lint, typecheck, build, unit tests, a pack test and Playwright end-to-end tests on pushes to main and on pull requests. GitHub refused our requests for run results, and the Goose dossier gave 18 for CI whose current state was unconfirmed (18 of 25). Open issues are unchecked. GitHub's issue pages and API refused our requests, and the clone shows only merged pull requests (12 of the 24 numbers used since 10 October), so the open reports couldn't be read. The brief scores an unchecked line as absent, and the repository may be fine on it (0, unchecked). Semver releases on npm (0.1.0 to 0.1.5) and two tags, with no changelog or breaking-change notes (3 of 15). 0.1.5, pre-1.0 (0).", "schema": "Graded on the interface an outside agent can use, as GRADER.md asks. Talorys has none. Its /api routes are the web app's private backend, undocumented as an API, and need the owner's session cookie, an x-talorys-request header and a same-origin Origin, with no API key, MCP server or A2A endpoint. So the contract, description, typed-input and example lines score nothing (0 of 25, 0 of 20, 0 of 15, 0 of 15), which says nothing about the app for its owner. The docs are Markdown files in the repository with no llms.txt or served copies, which the Khoj and Aider dossiers scored 0 (0 of 10). The versioning and changelog line versions an agent interface, and with none there is nothing to version, so it scores nothing (0 of 15). We read it this way for every listing in this batch without an agent interface, and app release notes count under maintenance instead.", "security": "Graded on the interface an outside agent can use. With none for Talorys, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15), whatever the app does for its owner. The security programme line doesn't need an interface and is scored. For the record, docs/security.md documents a PBKDF2-hashed owner password, HMAC-stored session tokens, login lockouts with Retry-After, CSRF checks, a Worker with no public URL, destructive tools that need confirmation in the owner's latest message, read-only tools for scheduled runs, imported automations paused, and no shell or outbound HTTP tools. Security programme. SECURITY.md asks for private GitHub reports, aims to acknowledge within 3 business days and fix within 30, sets a scope that includes prompt injection causing unconfirmed writes, and docs/security.md sets out a threat model. An esbuild dev-dependency advisory was overridden on 11 October. No security.txt (there's no site), bug bounty, certification or published advisories (8 of 20).", "transparency": "MIT (30). There's no vendor service, so no terms or privacy policy of its own. The README says Talorys has no telemetry, analytics or tracking and sends nothing to its developers, that data lives in a Durable Object in the owner's Cloudflare account, and that Cloudflare processes it, Workers AI inference on messages and memories included. The source makes no outbound calls beyond Cloudflare bindings and the installer turns Wrangler's metrics off, which agrees. Sessions expire after 30 days or 14 of inactivity, and retention at Cloudflare follows Cloudflare's terms (22 of 30). SECURITY.md says only the latest version gets fixes and migrations are append-only, with no deprecation policy (5 of 20). No telemetry, stated in the README and consistent with the code, so there's nothing to opt out of (20)." }, "sources": [ { "what": "repository at 980331b (README, docs, SECURITY.md, CI workflow, source)", "url": "https://github.com/rociiu/talorys", "seen": "2026-10-12" }, { "what": "CI workflow", "url": "https://github.com/rociiu/talorys/blob/main/.github/workflows/ci.yml", "seen": "2026-10-12" }, { "what": "security policy", "url": "https://github.com/rociiu/talorys/blob/main/SECURITY.md", "seen": "2026-10-12" }, { "what": "security model", "url": "https://github.com/rociiu/talorys/blob/main/docs/security.md", "seen": "2026-10-12" }, { "what": "npm versions", "url": "https://registry.npmjs.org/create-talorys", "seen": "2026-10-12" }, { "what": "licence", "url": "https://github.com/rociiu/talorys/blob/main/LICENSE", "seen": "2026-10-12" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/create-talorys", "seen": "2026-10-12" }, { "what": "git history (shallow clone, 12 October)", "url": "https://github.com/rociiu/talorys/commits/main", "seen": "2026-10-12" } ], "openQuestions": [ "unchecked: open issues and reply times, since GitHub's issue pages and API refused our requests. The reliability open-issues line scores 0 for that reason only.", "unchecked: whether CI passes on main, for the same reason.", "unchecked: GitHub star count." ] }, "negative": 0, "verdict": "Talorys is an MIT-licensed assistant its owner deploys to their own Cloudflare account, with no telemetry, a documented threat model and code-enforced confirmation for destructive tools. It is two days old at version 0.1.5, has no mail, calendar or payment connections, and no interface for an outside agent.", "bestFor": "A single person who wants a private assistant for memory, tasks, notes and reminders on their own Cloudflare account.", "disclosure": "Talorys competes with LocalGhost, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "MIT licence, and no telemetry, analytics or tracking, stated in the README and confirmed in the code.", "Destructive tools need confirmation in the owner's latest message, enforced in code, and scheduled runs get read-only tools.", "SECURITY.md with private reporting, a 3-business-day acknowledgement target and a threat model.", "Designed to fit Cloudflare's Workers Free plan, with nothing to buy from Talorys." ], "weaknesses": [ "No API key, MCP server or A2A endpoint, and the /api routes need the owner's browser session.", "First released on 10 October 2026 and still pre-1.0 at 0.1.5.", "No changelog or breaking-change notes.", "No mail, calendar, booking, payment or messaging connections in the code." ], "agentNotes": [ "Run `npx create-talorys@latest` with Node.js 22 or later and a Cloudflare login or an API token with Workers, Pages and Workers AI permissions.", "Don't script the /api routes. They need the owner's session cookie and CSRF header and aren't documented for other callers.", "Update with `npx create-talorys@latest update`. Only the latest version gets security fixes." ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 28.9 } ], "editorialScores": { "ergonomics": 0, "maintenance": 83, "payments": 60, "reliability": 41, "schema": 0, "security": 8, "transparency": 77 }, "provenanceScore": 27 }, "connect": { "install": "npx create-talorys@latest # Node.js 22+, signs in to Cloudflare and deploys into your account" }, "letme": { "capability": "https://letme.dev/assistant.memory", "tool": "https://letme.dev/talorys" }, "sameCompany": [ "github-mcp-server", "github-copilot-cli" ], "notable": [ "The installer, npx create-talorys@latest, deploys a private Worker with a SQLite Durable Object and a Cloudflare Pages front end joined by a service binding, so the Worker has no public URL (https://github.com/rociiu/talorys)", "Chat runs on Workers AI with @cf/zai-org/glm-4.7-flash. Tasks, notes, memories and reminders keep working when the AI allocation runs out (https://github.com/rociiu/talorys)", "The agent's tools cover memories, notes, tasks, reminders and a search across them. No mail, calendar, booking, payment or messaging tools are in the code (https://github.com/rociiu/talorys/tree/main/apps/agent/src/tools)", "Reminders, daily digests and optional AI routines run on Durable Object alarms and arrive in an in-app notification centre (https://github.com/rociiu/talorys)", "The README says Talorys has no telemetry, analytics or tracking and sends nothing to its developers. Cloudflare processes the data, including Workers AI inference on messages and the memories sent with them (https://github.com/rociiu/talorys#6-where-your-data-lives)", "SECURITY.md asks for private reports through GitHub's vulnerability reporting and aims to acknowledge within 3 business days and fix within 30 days (https://github.com/rociiu/talorys/blob/main/SECURITY.md)", "The repository's first commit is dated 10 October 2026, and create-talorys went from 0.1.0 on 10 October to 0.1.5 on 12 October 2026 on npm, with 978 downloads in the week to 11 October (https://www.npmjs.com/package/create-talorys)" ], "area": "frameworks", "details": [ { "label": "Surface listed", "value": "The Talorys repository at commit 980331b (12 October 2026) and the create-talorys npm package 0.1.5. Read from the README, docs, SECURITY.md, LICENSE and source on 12 October 2026. Nothing was deployed." }, { "label": "Where it runs", "value": "In the owner's Cloudflare account on Pages, Workers, a SQLite Durable Object and Workers AI. It does not provision R2, D1, KV, Vectorize or other paid services (https://github.com/rociiu/talorys#3-cloudflare-services-used)." }, { "label": "What it acts on", "value": "Its own store of conversations, memories, tasks, notes, projects and automations. It does not connect to mail, calendars, bookings, payments or messaging apps." }, { "label": "Outside agent access", "value": "None. The HTTP API behind /api serves the web app and requires the owner's session cookie and CSRF header. No MCP server, API key or A2A endpoint exists in the code." }, { "label": "Memory", "value": "Memories can be viewed, edited and deleted. Optional semantic recall and a memory history that keeps past facts and queues unclear conflicts for review (https://github.com/rociiu/talorys/blob/main/docs/memory-history.md)." }, { "label": "Backups", "value": "Settings exports talorys-backup.json without sessions or credentials. Imports are treated as untrusted, so imported automations arrive paused (https://github.com/rociiu/talorys#9-back-up-your-data)." }, { "label": "Maintainer", "value": "Created and maintained by Roc Yu (@rociiu on GitHub), with six other credited contributors in the README." } ], "provenance": { "legalEntity": "", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/rociiu/talorys/commits/main", "securityTxt": "none", "checked": "2026-10-12", "notes": [ "No company, terms of service or privacy policy. The MIT licence names The Talorys contributors, and Cloudflare's terms and privacy policy cover the hosting.", "Security reports go through GitHub private vulnerability reporting per SECURITY.md. There is no security.txt.", "There is no hosted endpoint. Each install answers on the owner's own pages.dev address.", "GitHub star count was not checked because the GitHub API was not available to us." ], "score": 27, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "github.com, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the MIT (Copyright 2026 The Talorys contributors). It runs on the owner's Cloudflare account under Cloudflare's own terms. licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/talorys.json", "live": { "slug": "talorys", "versions": [ { "registry": "npm", "name": "create-talorys", "version": "0.1.5", "seenAt": "2026-10-12T22:32:28.340613655Z" } ], "githubStars": 892, "npmWeekly": 978, "updatedAt": "2026-10-12T22:32:29.267294141Z" } } }