Everything Kazma does.

Web chat with streaming answers, a step-by-step activity view per answer, and approvals inline

Telegram, Discord and Slack: text, photos and documents, voice notes transcribed, approve/deny buttons, per-platform allowed-user lists

Native Telegram command menus and Discord/Slack /kazma commands

external application registration is required; private continuation credentials expire on restart

Each chat app's Test diagnoses the connection: the token, the chat or channel Kazma delivers to, direct messages, allowed users, and what became of the last message a person sent

Finalized chat replies delivered without gateway tone rewriting, with one terminal persistence owner

Tables in an answer are rewritten as lines for Telegram, Discord and Slack, so they read on a phone

Explicit English/Arabic one-paragraph prose and verbatim supplied-JSON output safeguards

conservative prose layout and literal JSON copies only; no general format guarantee

Terminal UI, including a file editor

Command line: one-shot questions (kazma ask), and the Agent Client Protocol for editors (kazma acp)

An MCP server: other agents can use Kazma's tools, with the same approval gate (kazma mcp)

Spoken replies (text-to-speech) and speech input; click-to-play in web chat

Live two-way voice in the browser through LiveKit

LIVEKIT_URL and keys

English and Arabic interface, full right-to-left layout; your words, the model's replies, names and server diagnostics are shown as written, each paragraph in its own language's direction (English left to right, Arabic right to left) in either interface

20 provider presets: OpenAI, DeepSeek, Groq, xAI, OpenRouter, Mistral, Together, Fireworks, Perplexity, Cohere, AI21, NVIDIA and Z.AI (OpenAI-compatible); native Anthropic, Google Gemini (incl. Vertex), Azure OpenAI and AWS Bedrock; and any custom OpenAI-compatible endpoint

Local models through Ollama and LM Studio

A provider's Test sends a real completion, not just a ping

Best model per task for multi-agent workers; image questions go to a vision-capable model

When a model fails over to another, you are told (page + banner)

Token and cost per answer; a cost breaker that halts runaway spending

Dangerous actions wait for your approval — on chat, multi-agent and pipeline paths alike; unclassified tools are gated by default

Durable mutation receipts and keyed IDE retries that hold uncertain outcomes for inspection

shared graph, IDE and swarm executors; external or custom effects are not atomic

Plans checked against memory before they act: a reminder date is anchored to what you said, not what the model guessed; catastrophic shell commands are refused before the approval card

Web pages, search results, documents and recalled memory are fenced as untrusted data; the effect is measured on a public benchmark

Secrets in an encrypted vault (AES-256-GCM); never passed to programs a tool starts; masked on every screen and API

Protections against server-side request forgery, cross-site requests, and request floods

Login by secret, local users or OIDC single sign-on; admin, operator and viewer roles

Several users or teams on one install

built for one trusted operator; multi-user separation is enforced for memory and chats, not audited end to end

Code the agent runs in an isolated container

Docker (KAZMA_CODE_EXEC_DOCKER=force) or E2B

Remembers conversations and the facts in them, across chats, with when each fact became true

Recall by evidence: a memory is used only when it matches the question well enough — nothing when nothing does

Every answer shows which memories it used

"About me": a short text you write, read at the start of every reply

Weekly topic summaries of long threads

Forget one memory or a whole chat, from the page or by asking in chat ("forget everything that mentions X" reaches every memory holding it); keep a chat out of memory; export everything

Works in Arabic and English, Gulf dialect included

Nothing lost by accident: archiving never erases a memory's text

Shared memory between installs through Postgres

memories and facts mirror; each install keeps its own vectors and graph

Knowledge Library: add files, web pages or whole sites; search by keywords and by meaning; Arabic-aware

Documents: upload into quarantine with file-type checks; macro-enabled Office files and PDFs with scripts, outside actions, attachments or links to files and network shares are refused; text from PDF, Word, Excel, PowerPoint, HTML, Markdown, CSV and plain text, Arabic included (legacy .doc/.xls/.ppt through LibreOffice)

OCR of scanned PDFs and images, Arabic and Arabic-Indic digits included; ruled tables on a scanned page read cell by cell

Arabic is read by the neural engine (ONNX Runtime; its models installed by scripts/ocr_models.py install, and built into the document worker image); without them Tesseract reads, and it does not read Arabic-Indic digits. Every OCR case of Kazma's measured corpus qualifies with the neural engine; it is measured on one real scan so far

Virus scanning of uploads

needs ClamAV installed; with KAZMA_PRODUCTION=1 an upload is refused until a scan can run

Convert, split, merge and redact documents; generate reports as Word, PDF or HTML in one house style, with correct Arabic typography and each paragraph and table in its own language's direction

full-quality Arabic PDFs need LibreOffice; without it a limited fallback, with a warning

Untrusted documents parsed in a separate worker with memory and CPU limits; optionally one container per job, with no network and no mounts

the default worker does not confine files or network and is not qualified for hostile documents; the container profile is a Settings choice that needs Docker, and the guard runs its broker

Durable document jobs: limits answered before an upload is read, outages retried, interrupted uploads rolled back after a crash, a Postgres document store backed up as one point in time

a 48-hour soak passed on the default process profile with SQLite stores, with no errors; not soaked on the container profile or on Postgres, and multi-replica is not qualified. An independent security review found one issue, fixed and confirmed by the reviewer

A hard PDF sent to a third-party parser (LlamaParse, Reducto) when local extraction is weak

off by default; every upload is audited first

Deep web research with sources: search, read, crawl, summarize

Web search through SearXNG (self-hosted metasearch, in the Docker setup)

PDFs on the web (theses, articles, reports) read as their text layer by the sandboxed document worker, in chat and in research

up to 20 MB, no OCR on a web read (a scan is refused); Knowledge crawls leave PDFs out

Search falls back to Bing, then Wikipedia's full-text search, when an engine answers with nothing or with results not about the query

an answer counts only when at least half its results hold a word of the query

Local HTTP extraction with optional local Chromium; hosted Firecrawl/Jina recovery requires explicit consent

local-only default; strict Chromium needs Linux network/cgroup controls; Windows strict rendering refuses launch and compatibility endurance is unqualified

Durable research and crawl journals with explicit recovery after interruption

finite job/history/report allowances; uncertain effects are not automatically replayed

Persistent research/crawl completion alerts linking to saved results, with stall, recovery and distinct terminal-outcome warnings

monitoring and completion alerts default on; external delivery requires configured ops routes

Saved acquisition errors, reported usage, request reservations and cached provider balances in Web, chat, CLI and TUI

unsupported balances and charges stay unknown; balance refresh is explicit and permitted by policy

Automated crawl/KB/research robots checks and shared origin limits/cooldowns

failed checks refuse crawling; explicit robots opt-out is visible

Scraping through a rotating residential proxy

acquisition mode + proxy allowlist permission + Settings

Image generation (Pollinations with no key; DALL-E, Stability, Flux with keys) and image understanding

Web IDE: browse, edit, patch, run, git — every write through the approval gate

Clone and switch repositories; the agent always works in the active one

GitHub: branches, commits, pull requests and issues, through a GitHub App or a token; read-only history and diffs (git_log, git_diff) need no approval

Code search across the repository (ripgrep plus symbols)

Steer a running task (/steer), abort it, plan first (/plan), long missions (/long)

Rewind or branch a conversation from any earlier step

Six ways to run workers: dispatch, broadcast, pipeline (with approval checkpoints), fan-out with voting, consult, conditional

Workers created on demand from templates — none need registering first

Circuit breakers, retries, timeouts and output checks per worker

Durable multi-step runs through Temporal

Reminders and scheduled tasks, delivered to the chat you asked from

X (Twitter): drafts, schedule, post through the official API, reply to mentions

X subject setup, scoped Support/Against, reply language and optional profanity; previews and model compatibility tests

X posts drafted from your brief and up to three reference documents you name (for example the page describing Kazma), in X Studio or by asking in chat; each draft is fact-checked against them and saved for review, never sent; posts have their own length setting

Email (Gmail, Outlook) and calendar (Google, Microsoft)

More than one mail account (several Gmail, Outlook or IMAP), each with its own calendar, named in chat by name or address

Skills from the open agentskills.io ecosystem: search, install from GitHub, signed and verified

MCP tools from any MCP server (stdio, SSE, streamable HTTP)

A supervisor that restarts on real failure, reloads gracefully and pages you over Telegram

One status card per restart: how long Kazma was down and whether each chat app connected (start and stop messages are optional)

Backups of everything every 6 hours, snapshotted locally and offsite (restic), checked daily, with a weekly restore rehearsal of the database; a zip copy to a cloud provider that keeps only the newest N copies

Move an install to another machine or OS in one bundle

Back up your settings to a file and restore them: you see what will change first, the keys you have are never replaced, a lost key comes back from the vault without typing it, and the restore can be undone

Health checks that make a real round trip; alerts to Telegram, Discord or Slack; a daily digest and a weekly resilience report

Old chat step history pruned on a schedule you set

Every task Kazma runs is watched (chat turns, swarm tasks, scheduled jobs, documents, research and crawls, X posts, memory, maintenance): when one stalls, gets stuck or fails, a card in the chat it started from offers Retry, Cancel, Dismiss or Ask Kazma to diagnose; one optional automatic first step

Postgres for settings, chats, tasks and checkpoints; SQLite with no setup

Admin answer-quality signals without storing answer text in the signal record

Prometheus metrics; OpenTelemetry and Langfuse traces

Updates in one command: on a supervised install it waits for the chats to go quiet, stops Kazma, installs and starts it again

Active-passive recovery preparation with one active runtime owner, fencing and paired backups

target-cluster drills are required; shared Postgres alone does not qualify concurrent runtimes

Fault injection to test retries and failover: slow or failing model calls, tool calls and reply saves (other targets have no injection point yet); off unless enabled