A folder you own. An agent that works in it.
Your files. Your models. Every change logged, and undoable with one command.
Or run it entirely on your own machine — install the CLI, no account needed, nothing local locked.
The vault you keep
plain markdown · on your disk · nothing leaves
- A folder you can open in any other program, and delete Ferrow out of.
ferrow rememberwrites the durable facts as files you can read andferrow forgetdeletes one.- With the relay off, working with your vault makes no network call except to the model you connected.
the agent that acts in it
under a contract the executor enforces — not a prompt it can talk around
- A skill states which paths it may touch, and whether it may write, before it runs.
- It asked for the network and had not declared it, so it was refused.
ferrow log revert <id>takes any change back — and the revert is itself recorded.
Our app
Ferrow never asks for access to your YouTube or Google account. (For Google's reviewers: Ferrow — the product on this page, and the name on our Google consent screen — publishes our own finished videos to FerrowAI, the YouTube channel we own, and reads that same channel's listing and analytics back. It acts on our channel and no other. Details in our privacy policy.)
Watch it work
Type into it, or let it type itself. Either way it ends by taking the work back.
This is the whole product in four beats: a folder, a write, a log entry, and the one command none of the chat windows can offer you.
Click the terminal to type in it yourself. It runs nothing and sends nothing — it prints what the real command prints.
A short demonstration repeats here, in four steps. First a folder of three
notes — memory/clients.md, inbox/klein-invoice.md and
projects/klein/brief.md. Then an agent writes a line into the first of them:
"Klein — invoice Wednesdays, net 14." Then a log entry stamps in, reading "wrote 3 files,
logged". Then the command ferrow log revert chg_msryhd1g_299941 is typed, the written line
is struck out and removed, the log entry greys, and the folder returns to exactly what it
was.
What you get
A local vault
Plain Markdown in a folder you own. No background sync, no cloud copy, no telemetry — with the relay off, working with your vault makes no network call except to the model you connected.
Any model
Works with any AI you can get a key for — OpenAI, Anthropic (Claude), Google — or one running free on your own computer. Switching is one command.
Full undo
ferrow log lists every change an agent made.
ferrow log revert <id> takes any one of them back — and the
undo is itself recorded.
Why this one
Your notes stay plain Markdown files in a folder you own. Point any model at them — your API key, or one running on your own computer. Agents read and write that vault under rules you set, and every change they make is logged and can be undone with one command.
-
Any model, and you can change your mind
Any AI you can get a key for works — OpenAI, Anthropic (Claude), Google's Gemini, OpenRouter, xAI's Grok — and so do the ones that run free on your own computer: Ollama, LM Studio, Jan, llama.cpp, vLLM, GPT4All.
ferrow detectfinds what is already on your machine. Switching is one command, not a migration. -
Your files stay in your folder
The vault is a folder. There is no background sync, no cloud copy and no telemetry, and there is no copy of it on our servers — working with your vault makes no network call except to the model you connected. Keys go into your keychain and travel only to the provider they belong to. Turn the relay on and one note travels when one of your own paired devices asks to read it, sealed so the relay cannot read it — and that is the whole of it. Delete Ferrow tomorrow and your notes are still ordinary files in an ordinary folder.
-
Take it anywhere, end to end
ferrow hub startmakes this machine the one that thinks. Your phone and any browser reach it through a relay that carries sealed blobs it cannot read — the vault stays here, the model runs here, and the relay is a postbox, not a reader. -
A hard stop on spend
ferrow spendcap 50is a stop, not a warning. Ferrow stops before any call that would cross the number you set, andferrow spendcap statusshows the cap, what has been spent, and what is left. On your own keys there is nothing to cap — you already hold the account.
One day, end to end
The vault holds still. The agent moves, and leaves a receipt for each move.
Six events from the worked month in the fixture. Every one of them names what produced it — a command, a log id, or a refusal.
- 06:40 ferrow schedule fired the morning skill the hub was up; nothing running means nothing fires · $0.00
- 07:02 read three notes, wrote one — a diff of 6 lines chg_msryhd1g_299941 · ferrow log revert takes it back · $0.04
- 09:15 a skill asked for the network and had not declared it refused by the executor, not by a prompt · $0.00
- 13:20 routed a long document to a long-context model list price for the same run was higher; the meter counts what it spent · $0.31
- 18:05 an approval waited for you and nothing moved ferrow approvals · answered on this machine, never over the relay · $0.00
- 23:58 ferrow halt — the switch is a file, so it survived the reboot ferrow resume says what became allowed again · $0.00
Every row above is a record in site/fixtures/worked-month.json.
A figure on this page that is not in that file fails the build.
Stacks, not islands
It learns you. And you can open every page of it.
Three pillars, six records, and not one of them is anywhere you cannot reach: they are files in your own folder. Each names where it came from and who reads it.
- invoices go out Wednesdays, net 14 you typed it — ferrow remember · read by every agent, before it starts
- prefers a diff over a summary corrected twice, then kept · read by every agent, before it starts
- klein — brief lives in projects/klein/ a note you wrote · read by the klein project only
- release checklist has 14 steps a skill wrote it back after a run · read by the release skill
- spend cap $50 — a stop, not a warning ferrow spendcap 50 · read by the model bus, before every call
- no skill may touch the network unless it declared it the executor, from SKILL.md frontmatter · read on every skill run
ferrow recall searches all of it and ferrow forget
deletes a record — the file, not a flag on a row in someone else's database.
Your rules
Your rules bind it. Always — and they are stops, not warnings.
$50
Under $50, work runs and the ledger records what it spent. At $50 it stops — Ferrow refuses the call that would cross the number rather than making it and telling you afterwards.
ferrow spendcap 50 · ferrow spendcap status
✓ binds every managed call, before it is
made
✓ on your own keys there is nothing to cap —
you already hold the account
ferrow halt
Refuses to start anything new — schedules, workflows, skill runs, MCP servers, the hub, chat requests. Work already running finishes. The switch is a file, so it survives a reboot and a crash, and it does not need this page, an account or a network to hold.
ferrow halt · ferrow resume
✓ survives a reboot, because it is a file
and not a process
✓ ferrow resume says what
became allowed again
What it does
The vault
A folder you can open in any other program, and delete Ferrow out of.
remember / recall / forget — the
durable facts every agent reads before it starts, so who you are never has to be
re-typed. They are Markdown files in your vault: you can read everything it believes
about you, and forget deletes the file.ferrow project switch and every command follows it. Your
personal memory is read by all of them.ferrow ui opens the same vault in your browser, bound to
127.0.0.1 — your machine and only your machine.Agents, as contracts
A skill states what it may touch before it runs, and the executor holds it to that. This is the part a prompt cannot talk its way around.
SKILL.md. Its frontmatter
states which paths it may touch, whether it may write, whether it needs the shell or
the network. The executor enforces that frontmatter — a skill that
never declared write access cannot write, however it is prompted.
ferrow skills lists them, valid and broken.ferrow skill sign and ferrow skill verify
check a skill byte for byte. Anything that did not come off your own disk runs only
if a key you named with ferrow skill trust signed it, and editing the
contract breaks the signature. Deny by default.ferrow schedule add runs skills on a cadence on this
machine, while ferrow hub start is up — the hub is the timer, and it
checks every minute for anything due. Nothing running means nothing fires. On a
Managed plan, --hosted runs that schedule on Ferrow so it keeps going
with your computer off — model only, no vault access, and results come home through
the changelog.Reach
What an agent can touch beyond the folder, and the grant it needs each time.
ferrow mcp add registers a server this vault may reach, and
ferrow mcp tools lists what it offers. Configuring one grants nothing: a
skill reaches a tool only if its SKILL.md declares that exact
server and tool.ferrow browser install gives agents a headless browser — one
with no window that it drives for you — with
its own profile: never your Chrome and never your logged-in sessions. A skill drives
a page only if it declared the domains and whether it may interact. Watch a live
session from the Browser station in ferrow ui.ferrow hub start makes this machine the one that thinks;
ferrow hub pair is a one-time code. The relay carries sealed blobs it
cannot read — a postbox, not a reader.Control
Three ways to find out what happened, and to make it stop.
ferrow log lists every change an agent made, newest first.
ferrow log revert <id> undoes any one of them — and the revert is
itself recorded.ferrow approvals is what is waiting on your decision;
ferrow approve <id> answers it. Answering happens on this machine
and never over the relay.ferrow halt refuses to start anything new — schedules,
workflows, skill runs, MCP servers, the hub, chat requests. Work already running
finishes. The switch is a file, so it survives a reboot and a crash, and
ferrow resume says what became allowed again.The meter
It counts the penny. And it refuses to guess.
$21.36
saved across 1,204 routed tasks — the same work billed at each model's list price came to $34.52, and routing it cost $13.16. Starter is $15 a month with that month's credits included, so this month's routed work fits inside it.
one month, worked in full, from the fixture — not an average, and not a customer's
Ferrow refuses to estimate what it did not measure. The unknown row is excluded from every total on this page.
Open the source: the numbers are in the markup, and the totals above are sums of the rows above them.
Start
One free program first: Node.
Node is the program Ferrow runs on — free, from nodejs.org (the button marked LTS), version 20 or newer — and it is the only requirement. There is no account to create to use Ferrow on your own machine, and nothing is uploaded. An optional account — an email and a password — exists only for billing and to find your own devices from a browser. Connect a model, make the vault, write something down.
npm install -g @ferrow/ferrow
ferrow detect
ferrow vault init
ferrow note inbox/today.md "the thing I just learned"ferrow detect looks for a model already running on this
machine — Ollama, LM Studio, Jan, llama.cpp, vLLM or GPT4All. If it answers
“No local model runtimes detected”, nothing is broken: it means there is
none running, and the next line is ferrow connect openai, which asks for a
provider key and tells you where to get one. The name is scoped — @ferrow/ferrow
— but the
command it installs is just ferrow. All the ways
in, including a checkable tarball — a downloadable archive — and the
macOS, Windows and Linux builds, each with a sha256 (a checksum to confirm the download
arrived intact).
Never used a terminal on purpose? The five-minute walkthrough shows every screen Ferrow prints back, so you can tell whether it worked.
Where it runs
Honestly, as of today.
Ferrow is pre-1.0. This list is the whole truth about what exists; if something is not on it, assume it does not exist yet.
ferrow ui — the vault and the
change log as a page, with revert behind every row.What leaves
The short list of things that go anywhere.
Your prompt, to the model provider you chose. That is the whole point of connecting one.
A subscription id and an email, to Stripe. Billing is the one hosted piece. That path never sees a vault.
Sealed blobs, to the relay — only if you turn it on. It carries encrypted payloads between your own devices. It does not carry your vault, your notes, or your keys, and it cannot read what it carries.
An email and a password hash, to Ferrow's billing service — only if you create an account. The account exists for billing and for finding your own devices. It never sees a vault or a key.
Your notes. Your API keys. Any analytics. Ferrow has no account you must create to use it locally, and no server that holds your vault.
Before consumer launch
Ten founding seats. Named here, permanently, when they are filled.
Ferrow goes to ten people before it goes to everybody. A founding seat is not a discount and not a waiting list — it is a working relationship with the product for the stretch where the product is still being decided.
- You run your own lane. Your vault, your keys, your machine, your real work — not a sandbox and not a scripted trial.
- Your name and your date go on this page. Permanently, and with your say-so. This section is where they go, which is why it is not a table of blanks today.
- You are read directly. What you find lands in the changelog under a version number, or it lands in an issue with a reason it did not.
- The software is already free. A seat buys you no feature, because there is no feature to buy — every command runs the same way for everybody.
Install it, run it against something you actually care about for a week, and tell us what broke. That is the whole application, and it is the only one that tells us anything.
There is no form, no email capture and no queue. ferrow
doctor prints what your machine looks like, and /support
is where it goes.
Two apps. One face.
Two apps, one mark, zero asterisks. And the free one is not a demo.
The lite app is the way in: the whole command surface, on your own machine, on your own keys, for nothing. The full app is the same product with the models billed through us. Nothing is locked behind the difference — the only question is who pays the model provider.
No asterisks appear on this invoice, or anywhere on this page. The software is free and it is not a trial: there is no licence check, no entitlement call and no plan-keyed feature flag anywhere before the dispatcher. Paid plans start at $15 a month and add models billed through us with that month's credits included — or skip the plan and top up when you need it. Pricing names all four plans and what each one includes.
Once you are in
The selling is over at the door. After it, the only thing that matters is how easily it runs all day.
Everything above is the argument. This is the room:
ferrow ui opens your vault and your change log in your browser, bound to
127.0.0.1 — your machine and only your machine, no account, no round trip
to us.
Every row in the change log has a revert behind it, every waiting approval is answered on this machine, and the Browser station shows a live agent session as it happens.
It is served by your own machine, so it works with the network off.
ferrow halt stops it from starting anything new, and the switch is a file.
The full 24/7 panel — lanes, sessions, settings and its own empty states — is a build of its own and it is not drawn here. A picture of a product that does not exist yet is the thing this page has spent nine bands refusing to be.
Our channel
What the Ferrow app does on YouTube.
Ferrow is the knowledge vault above — a program you install, holding a folder of your own Markdown files. Ferrow also publishes short videos about itself, and one small piece of our tooling handles that: it uploads our own finished videos to FerrowAI, the YouTube channel we own, and reads that same channel's own listing and figures back. That is the entire purpose of the Google application named Ferrow.
It acts on our channel and no other. Ferrow has no sign-in with Google, asks no visitor or customer for access to their YouTube account, and reads, stores and shares nobody else's YouTube data. Surface 6 of the privacy policy names the three permissions it requests, what is kept, the YouTube and Google terms it runs under, and how access is revoked.