Mercury Agent is an AI agent that runs on your own machine. Version 1.5 arrived on 3 November and completes the desktop clients for macOS, Windows and Linux, with the code open under the MIT licence. It keeps autonomy inside a fence built from approvals, a blocklist and directory scopes.

It stops and asks before it acts

When an agent takes over a computer, the hard part was never whether it can do the work, it is whether you know it will not go too far. Mercury draws that line between reading and writing. Reading files, listing directories, searching: allowed outright. Writing, running commands, pushing to a remote, reaching outside the permitted scope: it stops and waits for an answer. You can approve once, approve this class of action from now on, or refuse.

At the session level there are two modes, Ask Me and Allow All, chosen again each time a session opens. Some commands do not take part in the discussion at all: sudo, deleting the root directory and every spelling of it sit on a blocklist and never run, in either mode. Permissions can also be split by folder, and treated differently by channel and by the role of the sender; a bot without permission is refused rather than shown a window someone can click away.

The premise of the design is an admission: models make mistakes. Better to have it ask one more question beforehand than explain afterwards why the wrong directory is gone.

Memory sits on your own disk

Long-term memory is a local store called Second Brain, built on SQLite plus full-text search and kept in a .mercury directory under the user's home. While it works, the agent extracts preferences, relationships between people and decisions already made; two records that contradict each other get resolved, everything is merged and tidied once an hour, and the next morning does not start from zero. Memory is split into ten categories, and you can search it, pause recording or wipe the whole thing at any time.

The personality side is not a black box either, but a few markdown files: soul.md says how it should speak and what it should hold to, persona.md holds the address and the tone. Those files are yours, take effect on save, and need no retraining of anything.

Before saying it is done, it has to show the evidence

The place an agent drifts most easily is the report. A task that never ran can still produce a paragraph that sounds complete. Mercury binds that with a completion contract: a task ends in one of two ways, either with build, type-check or test results that actually ran, or paused with a note on where it stopped.

In a scenario the project demonstrated: after changing the form on a settings page it ran the type check and the matching tests, and only marked the work complete when both passed. Moved to the billing page, the tests reported two errors, so it wrote that it did not consider the task finished and pasted the failure details, leaving the next step to you. To make that sustainable there is a daily token budget, a live usage display and an economy mode; if one model provider drops out mid-run it switches to the next rather than abandoning the round.

Leaving it running

One command installs it as a system service, starting with the machine, restarting after a crash, and together with scheduled jobs, heartbeat checks and proactive notices it becomes an assistant that does not clock off. Bots are the more unusual layer: each bot can have its own model, memory, permissions and personality, so you send one off to draft release notes while you keep working in the terminal, and its result lands in its own thread.

There is more than one way in. A full-screen terminal interface with slash commands, a web panel and board, and Telegram, Discord, Slack or Signal from a phone. These channels share one tool registry, one permission system and the same memory, so starting something in the terminal and checking on it from the phone works. Community skills follow the Agent Skills specification, and more than 120 are public today.

The weak spots it does not try to hide

The project page names three itself. There is no operating-system-level sandbox; safety rests on approvals, the blocklist and directory scopes, which is why the default mode is Ask Me rather than allow everything. The desktop clients are not code-signed yet, so macOS and Windows will block once on first launch, while the update packages themselves are signature-checked. The Windows installer is 4.2 MB, the macOS build a little over five, and the Linux AppImage 81 MB.

Cloud features are optional: once paired, the machine can be reached from anywhere without port forwarding or a reverse proxy. If you do not need it, leave it off; the local part does not depend on it. For a program that sits in the background for months holding file and terminal rights, spelling out what it can and cannot do is worth more than a few extra flourishes.