A private AI assistant that runs on your computer. No subscriptions, no cloud lock-in, no data leaving your machine without your say-so.

Fox in the Box bundles a full AI assistant — agent, chat UI, persistent memory, and secure remote access — into one app. Bring an OpenRouter API key, run the installer, and start chatting in minutes.

There are several good self-hosted AI assistants. Here's how Fox compares on the dimensions that matter most for a personal, private setup:

Fox's angle: a private assistant that just works — install it, paste a key, start talking. Semantic memory that carries across sessions, remote access without port forwarding, and a standard MIT license.

• Runs on your computer. Conversations, memory, and files stay on your machine.
• Remembers across sessions. Your assistant picks up where you left off. Memory is on by default for fresh installs, with embeddings computed entirely on-device — no extra API key needed.
• Reachable from anywhere. Optional secure HTTPS access from your phone or another laptop via Tailscale.
• Setup in the browser. No terminal needed for the desktop app. Paste your API key — or skip the wizard entirely if you already have a local model running.
• Local AI in one click. Got Ollama installed? Fox auto-detects it on first launch and lets you chat with a local model — no API key, no terminal.
• Open source. MIT licensed. You can read every line of what's running.

Fox in the Box runs a small private server on your computer inside something called a Docker container — think of it as a sealed box that keeps everything organized and separate from the rest of your system. The desktop app manages this box for you automatically.

When you send a message, the app forwards it to your chosen AI provider (like OpenRouter or Anthropic) over the internet, gets a response, and displays it in the chat. The only thing that leaves your computer is the message itself — your conversation history, files, and memory stay on your machine.

Memory is what makes Fox different from a plain chatbot. It remembers what you've talked about across sessions — your preferences, your projects, the context of previous conversations. This memory is stored locally in a small database on your computer, not in the cloud.

Remote access is optional. If you want to chat with your assistant from your phone or another computer, Fox can set up a secure private link using Tailscale (a free personal VPN). Only your own devices can reach it — nobody else can see or access your assistant.

Updates are simple: the desktop app pulls the latest version automatically. If you installed via the terminal script, run it again — it replaces the old version and keeps your data.

A practical tour of what's in the box. Most of this is wired up by the bundled Hermes Agent and Hermes WebUI; Fox in the Box adds the desktop wrapper, the Docker packaging, the onboarding wizard, Tailscale integration, and the auto-update channel.

• Streaming responses with live tool-call progress, markdown rendering, and syntax-highlighted code blocks
• 26 slash commands — including /new, /clear, /compress, /branch, /queue, /interrupt, /steer, /btw, /background, /reasoning, /yolo, /voice, /skills, /personality, /usage, /retry, /undo, /status
• Live steering — inject mid-stream guidance without canceling the current turn
• Branching — fork a conversation into a new session at any point and explore an alternate direction
• Background tasks — kick off long-running prompts and keep chatting; a badge tracks completion
• Session search — browse and search every prior conversation from the sidebar

• Persistent memory across sessions, stored locally in Qdrant (vector DB) + mem0 — on by default for fresh installs

• Embeddings computed entirely on-device by a bundled local model (nomic-embed-text-v1.5 via llama.cpp) — no extra API key, works with any provider; facts are extracted via your configured chat provider

• Memory state visible in Settings and on /readyz — active, off with a reason, or error. Fail-loud: memory is never a silent no-op.

• Existing installs opt in with one line (memory: provider: mem0_oss) — see docs/MEMORY.md

• Memory runs against the bundled Qdrant server by default, so the gateway and WebUI can both use it at once without the embedded store's file-lock contention. Existing memories migrate automatically, once, on the first boot after upgrade (the embedded store is kept for rollback). To stay on the embedded on-disk store instead, set MEM0_OSS_QDRANT_URL= (empty) in hermes.env. You can also point memory at an external Qdrant with these env vars (or the same keys in mem0_oss.json):

  Variable	Purpose
  MEM0_OSS_QDRANT_URL	Qdrant server URL (e.g. http://127.0.0.1:6333); empty = embedded
  MEM0_OSS_QDRANT_HOST	Qdrant hostname (alternative to URL)
  MEM0_OSS_QDRANT_PORT	Qdrant port for MEM0_OSS_QDRANT_HOST (default 6333)
  MEM0_OSS_QDRANT_API_KEY	API key for an authenticated Qdrant server (optional)

  See docs/MEMORY.md.

• mem0's telemetry is disabled (MEM0_TELEMETRY=False)

• Read, edit, and prune entries from the Memory panel

• Per-profile personality (SOUL.md) — give your assistant a different voice in different profiles

• Separate Hermes environments with isolated config, sessions, and memory
• Switch profiles without restarting; create one for work, one for personal, one for experiments

• Skills — bundled and user-authored. Browse, search, and edit from the Skills panel. Each skill can register its own slash command.
• MCP integrations — Brave Search included out of the box. Add more in hermes.yaml.
• Built-in tools — file I/O, terminal execution, web browsing (Chrome DevTools Protocol), vision, TTS, transcription, image generation
• Scheduled tasks — cron-style job builder; trigger a skill at a fixed cadence (every weekday at 9am, hourly, custom cron)

• Browser-based onboarding — paste your OpenRouter key, click Open Fox, you're in. No terminal.
• Switch providers from the chat — Settings → Providers → key → Save. Live in seconds (no restart).
• Auto-update — desktop app pulls new releases via electron-updater; install-script users re-run the same one-liner to upgrade in place
• Backup-friendly data layout — everything in ~/.foxinthebox; reset by deleting the folder
• Built-in log viewer + diagnostics — Settings → System

• Local-first — the only outbound traffic is the LLM API call when you send a message. Memory, sessions, and files never leave your machine.
• Tailscale integration — optional secure remote access from your phone or another laptop on your tailnet, with automatic HTTPS via Tailscale Serve
• MIT licensed — every line of Fox is readable on GitHub

Advanced — messaging gateways. Hermes Agent ships with Slack, Discord, Telegram, and WhatsApp gateway adapters. They're available inside the container but currently driven via the hermes CLI rather than the WebUI. Setup is more involved than provider key entry; see the Hermes Agent docs if you need them today, and watch the Roadmap for in-app gateway management.

Download fox-in-the-box-setup-x64.exe from the latest release. Run the installer and follow the prompts. Docker Desktop is installed automatically if missing.

Download the matching DMG from the latest release:

• Apple Silicon (M1/M2/M3/M4): fox-in-the-box-arm64-mac.dmg
• Intel Mac: fox-in-the-box-x64-mac.dmg

Open the DMG and drag Fox in the Box to your Applications folder. The DMG is signed and notarized by Apple.

curl -fsSL https://raw.githubusercontent.com/fox-in-the-box-ai/fox-in-the-box/main/packages/scripts/install.sh | bash

Installs Docker if needed, pulls the container image, asks how you want to access it (port, Tailscale, or both), prompts for a friendly Tailscale hostname, and sets up systemd (Linux) or launchd (macOS) so the assistant comes back after reboot.

docker run -d \
  --name fox-in-the-box \
  --restart unless-stopped \
  --add-host=host.docker.internal:host-gateway \
  --cap-add=NET_ADMIN \
  --device /dev/net/tun \
  --sysctl net.ipv4.ip_forward=1 \
  -p 127.0.0.1:8787:8787 \
  -v ~/.foxinthebox:/data \
  ghcr.io/fox-in-the-box-ai/cloud:stable

Then open http://localhost:8787 and follow the setup wizard.

git submodule update --init --recursive
pnpm install
pnpm build:docker          # build the container with the version in /VERSION
docker run -d --name fitb \
  --cap-add=NET_ADMIN --device /dev/net/tun --sysctl net.ipv4.ip_forward=1 \
  -p 127.0.0.1:8787:8787 -v ~/.foxinthebox:/data \
  fox-in-the-box:$(cat VERSION)

For local iteration on the bundled hermes-agent / hermes-webui submodules, see docs/DEV_MODE.md. For releases, see docs/RELEASE_WORKFLOW.md.

Operating system

• Windows 10 or later (Windows 11 recommended).
• macOS 13 (Ventura) or later — Apple Silicon or Intel. (Electron 44 dropped macOS 12; v0.7.60 and earlier still run on Monterey.)
• Linux with Docker Engine 20.10 or later.

Docker — required

• Docker Desktop on Windows and macOS; Docker Engine on Linux. Fox auto-installs Docker Desktop on Windows if it isn't present and walks you through the install + reboot.
• Windows: Linux-containers mode is required (Docker Desktop's default). If you've previously switched to Windows-containers mode, Fox detects it and exits with an actionable error — right-click the Docker Desktop tray icon → Switch to Linux containers... and relaunch Fox.
• Windows: the WSL 2 backend is required. Docker Desktop's installer enables it for you. In Docker Desktop settings make sure General → "Use the WSL 2 based engine" is checked. If WSL2 isn't installed when Fox launches, it'll attempt the repair automatically (may require a reboot).

CPU virtualization (Windows only)

• Hardware virtualization must be enabled in BIOS/UEFI — VT-x on Intel CPUs, AMD-V / SVM Mode on AMD CPUs. Required by both Docker Desktop and WSL2.
• Most consumer PCs ship with it enabled. If Docker reports "WSL2 backend not running" or "virtualization disabled," reboot into BIOS, look for Intel Virtualization Technology / SVM Mode / VT-x, enable it, save, reboot.
• Apple Silicon and Intel Macs have virtualization on by default — nothing to configure.

Provider API key (at least one)

• An OpenRouter API key (recommended — one key gives you hundreds of models, no per-provider setup).
• Or any other supported provider — Anthropic, OpenAI, Google Gemini, DeepSeek, Mistral, etc. Configurable in Settings after install. See Supported providers below.

Ollama (optional — only if you want local models)

• To run local AI models, install Ollama separately on your host machine — Ollama runs on your computer, not inside the Fox container.
• Fox auto-detects a running Ollama daemon via host.docker.internal:11434 and surfaces every installed model in Settings → Providers → Local Ollama with one-click switching.
• Pull at least one model first (ollama pull phi4-mini, ollama pull llama3.2:3b, etc.) — or use Fox's one-click pull from the recommended set inside the app.
• Ollama is not required if you only use cloud providers.

The setup wizard runs once. After that the app handles itself — but a few things are worth knowing.

Add or switch providers. OpenRouter is configured during onboarding. To add Anthropic, OpenAI, Google Gemini, DeepSeek, Mistral, or any other supported provider: open Fox, click the gear icon in the top bar → Settings → Providers → paste the API key → Save. The new provider is live within seconds — no restart, no terminal. Overwrite a key to rotate it; click Remove to clear it.

Use a local model. If you have Ollama running on your computer, Fox finds it automatically. Settings → Providers → Local Ollama lists every model on your machine and lets you switch to one with a single click. Keyless, on-device, private. If you don't have any models yet, Fox shows a recommended set with one-click install — no terminal needed. You can pull more, switch active model, and delete unused ones, all from inside the chat. Total disk usage is shown so you know what you're carrying.

Pick a model. The model picker in the chat lists every model your configured providers offer. Switch any time; the conversation thread is preserved.

Name your Fox on Tailscale. If you're using Tailscale for remote access, Settings → System → Device name (Tailscale) lets you pick a friendly hostname (e.g. fox-clever) — it shows up on your tailnet and in the HTTPS URL Tailscale Serve publishes. Defaults to a fox-<adjective> if you leave it blank.

Enable HTTPS for the tailnet URL. Tailscale Serve needs HTTPS to be enabled on your tailnet — a one-time toggle in the Tailscale admin console → DNS → Enable HTTPS. Once enabled, Fox publishes its chat UI at https://fox-<your-name>.<your-tailnet>.ts.net/. The first time you visit, Chrome / Safari may show a brief HTTPS warning while Tailscale provisions the cert — refresh after a minute. Without HTTPS enabled on the tailnet, the chat UI is still reachable via the device's tailnet IP (e.g. http://100.x.x.x:8787); only the friendly HTTPS URL requires the toggle.

Update the app. The desktop app pulls new versions automatically. For the install script, re-run the same curl … | bash line; it replaces the running container without touching your data.

Memory. Conversation memory persists automatically across sessions (on by default for fresh installs). Memory status is visible in Settings and on /readyz — active, off with a reason, or error. Some keyless / OAuth-only provider setups show memory off; you can override which provider handles memory fact extraction. See docs/MEMORY.md for defaults, provider requirements, and migration. To wipe memory (start fresh, troubleshoot, or hand off the install) see docs/RESET.md.

Most users start with OpenRouter — one key, hundreds of models. Add more from Settings → Providers when you need direct access or specific pricing.

Developer tools. The forks/figma-mcp submodule is a Figma MCP server fork used for design-to-code workflows during development. It is not part of the runtime — it's a developer tool for extracting Figma context into code. Initialize it separately if needed: git submodule update --init forks/figma-mcp.

Container vs. data: the published Docker image bundles Hermes agent and webui source (from forks/ submodules) at build time. The container's /data volume holds your config, databases, logs, and Tailscale state. Updating Hermes for end users means pulling a newer image, not re-cloning at runtime.

Tech stack: Electron 43 (desktop wrapper) · Python 3.11 (Hermes Agent + WebUI) · Qdrant (vector DB) · mem0 (memory layer) · llama.cpp (local embeddings) · supervisord (process management) · Tailscale (remote access) · Docker (packaging). Hermes WebUI is intentionally vanilla — Python http.server + plain JavaScript, no SPA framework — so the chat UI loads instantly on any device.

See docs/RESET.md for the full reset procedure (Windows and macOS).

• CHANGELOG.md — release history
• CODE_OF_CONDUCT.md — community standards
• CONTRIBUTING.md — how to contribute
• SECURITY.md — vulnerability reporting
• docs/DEV_MODE.md — local development with bind-mounted submodules
• docs/MEMORY.md — long-term memory: defaults, provider requirements, migration and reset
• docs/RELEASE_WORKFLOW.md — how releases are cut
• docs/RESET.md — full reset / clean install
• qa/SMOKE_CHECKLIST.md — pre-release verification gate

Is it really private? Yes. The app runs on your computer. The only outbound traffic is the API call to your AI provider when you send a message. Conversations, memory, and files never leave your machine.

Do I need to know how to code? No. Download the desktop app, run it, and follow the setup wizard in your browser. No terminal, no commands, no config files.

What's an API key and where do I get one? An API key is a token that lets the app talk to an AI service. Create a free account at openrouter.ai and generate a key — the setup wizard asks you to paste it in. Top up a few dollars of credit there to send messages.

Can I use it on my phone? Yes. Choose the Tailscale option during setup; you'll get an HTTPS URL you can open from any device on your tailnet — phone, tablet, another laptop.

How much does it cost? The app itself is free and open source. You only pay for AI usage at your provider (typically a few cents per conversation, depending on the model).

What we're working on next. No promises on dates — this is a small team — but this is the direction.

Recently shipped

• Memory on the bundled Qdrant server — memory now defaults to the in-container Qdrant server, ending gateway/WebUI lock contention and migrating existing memories automatically on upgrade; /readyz reports real Qdrant health (v0.7.63–v0.7.64)
• Electron 44.4.3 + security remediation — desktop framework bump plus a js-yaml HIGH advisory fix (v0.7.62)
• Long-term memory on by default — fresh installs get persistent memory out of the box: local nomic-embed-text-v1.5 embedder (llama.cpp), self-hosted mem0 + embedded Qdrant, memory state in Settings and /readyz (v0.7.60)
• Fox branding, Bedrock credentials card, ssh + rsync in the image — canonical app icons and favicons, AWS Bedrock credentials in Settings (v0.7.60); the openssh-client/rsync image bake merged just after the v0.7.60 tag — container users have it via :stable, and it ships tagged with the next release
• Upstream bumps — container-only Option B pin advances ship continuously; the live pinned pair is in packages/fox-overlay/versions.toml
• Security alert triage — resolved 24 supply-chain alerts via npm overrides + Dockerfile upgrade (v0.7.55–v0.7.57)
• Apt repository — .deb packages publish to the apt repo bucket on every release (v0.7.59+); public availability at apt.foxinthebox.io awaits DNS delegation — until then use the .deb assets on GitHub Releases
• Playwright smoke specs — automated E2E tests for critical Fox surfaces (v0.7.55)
• CI quality gates — test coverage threshold (45% minimum) and container startup time regression gate (v0.7.54)
• Custom provider UI — add, edit, test, and delete OpenAI-compatible providers (llama.cpp, LM Studio, vLLM) from Settings → Providers (v0.7.53)
• Electron 42 + supply-chain hardening — Electron 28→42, Python dependency lock, unsigned artifact labeling (v0.7.52)
• Upstream separation — Fox overlays cleanly separated from upstream Hermes codebase (v0.6.0)

v0.8.0 — ships when these criteria are met:

• Playwright E2E covers all critical user paths (provider setup, chat, model switching, failover)
• Zero open P0 bugs
• Container image passes clean Trivy scan
• On-device smoke checklist fully green for two consecutive releases

Beyond v0.8.0

• Network isolation mode for enterprise — air-gapped Docker deployment
• Routines — teach Fox multi-step workflows via conversation, runs on a schedule
• Knowledge RAG — batch-ingest document collections for semantic retrieval
• Content-safety classifier and guardrail plugins — opt-in safety layer

Track progress on the issue board or open a discussion.

Open an issue or start a discussion.

Fox in the Box stands on the shoulders of:

• Hermes Agent by NousResearch — the agent core.
• Hermes WebUI by nesquena — the browser chat interface.
• Qdrant — vector database powering memory.
• mem0 — memory layer.
• Tailscale — secure remote access and HTTPS.
• Electron — desktop app framework.
• Brave Search — web search via MCP.

MIT — see LICENSE. The name "Fox in the Box" and the fox logo are trademarks of Vulpy Inc. (operating as Fox in the Box) — see TRADEMARK.md.