The AI agent that runs air-gapped — and proves it.
Kairo-Phantom is an offline desktop AI agent for knowledge work. Every action it takes is Ed25519-signed into a hash-chained receipt that anyone can independently verify — no cloud, no telemetry, no trust required.
MIT licensed · kairo verify works with the network cable unplugged
The problem
Cloud AI agents ask you to trust them. That's the whole problem.
If your data leaves your machine and your audit log lives on someone else's server, you have assurances — not evidence.
Unauditable by design
You can't inspect what a hosted agent actually did with your documents. Vendor logs are self-reported, mutable, and produced by the party being audited.
Your data leaves your machine
Privileged contracts, patient records, and deal terms get uploaded to third-party inference APIs. For regulated teams, that's often not a risk — it's a violation.
"Trust me" logs can be forged
A plaintext log file proves nothing. Anyone with write access can rewrite history after the fact. An audit trail that can't detect tampering isn't an audit trail.
How it works
Act locally. Sign everything. Let anyone check the math.
The agent acts locally
Kairo-Phantom runs entirely on your device and ghost-types into your real applications — Word, your PDF viewer, your matter management system (driving live applications is an experimental capability under active hardening). It operates in read + suggest mode: it drafts and redlines; you accept. The agent runs with networking disabled; you can confirm there are no outbound connections from the agent process with a packet capture (runtime-scoped, not a whole-OS guarantee).
Every action is signed
Each action — every read, every suggested edit — is serialized and signed with Ed25519, then appended to a hash-chained receipt ledger. Each entry commits to the hash of the previous one, so the history has exactly one valid ordering.
Anyone verifies, offline
The verifier is a standalone CLI that needs only the receipt file and the public key. Flip a single byte anywhere in the chain and verification fails — loudly, at the exact entry that was touched. No server, no account, no trust.
Verify it yourself
Don't take the page's word for it either.
This demo generates a hash-chained receipt in your browser — the hashes below are real SHA-256, computed locally on this page. Run it, then tamper with one byte and watch the chain break.
# run a session (fully offline) kairo run --task redline contract.docx # verify the receipt chain kairo verify receipts/session.krcpt \ --pubkey kairo.pub
# watch the wire while it works sudo tcpdump -i any -n & \ kairo run --task redline contract.docx # expected: zero packets from kairo
Proof, not promises
Benchmarks you can reproduce on your own hardware.
Every number below is produced by a command in the repo. “Measured” means we've run it and committed the harness; “Pending hardware” means the harness exists but final numbers await our reference test rig.
| Metric | Result | Status | Reproduce with |
|---|---|---|---|
| Test suite (full CI Python) | 1,976 passed / 34 skipped / 0 failed | Measured | pytest tests/ -q --ignore=tests/e2e (CI runs 29191013782 + 29191013766; see BENCHMARKS.md) |
| Tamper detection (canary break) | 17 / 17 detected | Measured | pytest tests/test_canary_break.py |
| Network egress during agent run | 0 egress across 12 sessions | Measured | pytest tests/test_airgap_zero_egress.py |
| Prompt-injection resistance | 25 / 25 blocked; 106 patterns; 0/15 false positives | Measured | pytest tests/security/test_injection_suite.py |
| Redline grounding accuracy | 595 / 600 = 99.17% grounded | Measured | pytest tests/bench/test_grounding.py -v -s |
| Receipt verification speed | not yet measured | Pending hardware | harness not yet built |
All harnesses are in /bench in the repo. Numbers are only published once the exact command, dataset hash, and hardware spec are committed alongside them.
Security & trust
Offline by architecture, not by promise.
Air-gapped, zero egress
No network calls, no telemetry, no phone-home. The binary works with networking disabled entirely — and you can confirm that with a packet capture.
Ed25519 signing
Every receipt entry carries a signature from a device-local keypair. Signatures use Ed25519 — small, fast, and widely audited.
Hash-chained receipts
Each entry commits to the SHA-256 of the previous entry. Reordering, deleting, or editing any action breaks the chain at that exact point.
Merkle receipts (RFC 6962-style)
Session ledgers roll up into Merkle roots modeled on Certificate Transparency, enabling compact inclusion proofs for any single action.
Open source, MIT
The agent, the receipt format, and the verifier are all open source under the MIT license. Audit the code that produces the evidence.
Independent verifier CLI
The verifier is a separate, dependency-light binary. Your auditor — or your opposing counsel — can run it without ever installing the agent.
Who it's for
Built for teams that can't send data to the cloud.
Legal ops
Redline contracts with AI assistance while privileged material never leaves the building — and hand opposing counsel a receipt they can verify themselves.
→ Wedge use case: offline document redlining
Compliance teams
Replace “the vendor says so” with cryptographic evidence. Every AI action in scope produces an artifact your auditors can independently check, offline.
→ Evidence-grade audit trail, by default
Healthcare & finance IT
Deploy AI on machines that are already inside your perimeter. No new data-flow diagrams, no cloud DPAs, no egress exceptions to defend.
→ Fits the network you already locked down
Where we are
Honest status. Candor is a feature.
Kairo-Phantom is pre-launch and open source. Here is exactly what works today and what doesn't yet.
Works today
- Ed25519-signed, hash-chained receipt ledger and file format
- Standalone offline verifier CLI (kairo verify)
- Tamper-detection test harness (pytest tests/test_canary_break.py)
- Local agent core with read + suggest document redlining (early)
On the roadmap
- RFC 6962-style Merkle roll-ups with inclusion proofs
- Published benchmark numbers on the reference hardware rig
- Signed, reproducible release builds
- Third-party security review of the receipt format
Don't trust it. Verify it.
Read the source, run the verifier, try to break the chain. Then tell us what you found.
Thanks — we'll be in touch. (Demo form: connect a backend before launch.)
For design collaborators in legal, compliance, healthcare, and finance. No newsletter, no spam.