Open Interpreter

Not restorable in one action: everything sits in documented local locations, but there is no export or import command, so config, sessions and credentials in ~/.openinterpreter or the OS keyring must be copied by hand, and the docs advise re-authenticating. AGENTS.md and .agents/skills carry over in place.

• Portability guide (repo docs)
• Migrate (repo docs)

Configuration, instructions, skills, memories, session history and credentials all sit in documented local locations (~/.openinterpreter or the OS keyring, AGENTS.md and .agents/skills), and nothing that defines the agent is held by the project. Gathering them is a manual step.

• Portability guide (repo docs)
• Sessions (repo docs)

The Apache-2.0 runtime runs on the owner's machine and can use local providers such as Ollama or LM Studio (`--oss`), so model traffic stays local. No Open Interpreter account is required.

• Authentication: Local Providers (repo docs)
• LICENSE

Counterparts cannot verify that a migrated agent is the same one. The inherited agent-identity crate registers ed25519 keys with the upstream ChatGPT backend for task authorization, so that identity depends on the backend rather than traveling with the agent.

• codex-rs/agent-identity source

No license checks or remote enable flags were found in the runtime; it is open source and runs with local models without an account. Updates come as releases from the GitHub repository, and existing builds keep working.

• Fork branding and release identity
• Project license (repo docs)

Shell execution, file editing, MCP tools, skills, hooks, subagents and memories run in the local runtime and work with any configured provider. Web search is available only 'when the active provider and policy allow it', so switching to a local model can remove that capability.

• Web Search (repo docs)
• README: Features

Config is TOML, session rollouts are JSONL (older rollouts are compressed with standard zstd), and runtime state uses a SQLite database (state_5.sqlite). All of these can be read without Open Interpreter.

• codex-rs/rollout (JSONL recorder, zstd compression)
• Config reference (repo docs)

The base prompts and harness-emulation prompts are open source in the repository, and injected context such as AGENTS.md and environment context is recorded in the local rollout files. The base instructions can be replaced through config.

• Harness docs
• codex-rs/prompts

Agent state is local, but analytics events (usage and tool or plugin metadata) are sent by default to a project-operated endpoint (oi-new-api.fly.dev) when a login or API-key session exists. Whether that data is retained or used to build profiles is not publicly documented.

• codex-rs/analytics/src/client.rs

Each session is recorded locally as a rollout file with messages, tool calls, tool outputs and turn context, which moves with ~/.openinterpreter. The owner can switch persistence off (`history.persistence = "none"`).

• Sessions (repo docs)
• codex-rs/rollout/src/policy.rs

Skills are SKILL.md folders in .agents/skills, hooks and rules are plain config or scripts, and the runtime itself is published as Rust and TypeScript source.

• Skills (repo docs)
• Hooks (repo docs)

No advertising, sponsored-content or partner ranking mechanism was found in the runtime or docs. The context contains only the owner's instructions, project files, configured tools and model outputs.

• Open Interpreter maintained Codex delta

Each session's tool calls and outputs are recorded durably in rollout files, but recording is best-effort: nothing holds back a command when its record cannot be written.

• codex-rs/rollout/src/recorder.rs

Rollout JSONL files carry no integrity data, so an edit or deletion would go unnoticed.

• codex-rs/rollout

In the read-only and workspace-write sandbox modes, agent commands can write only inside workspace roots, which normally excludes ~/.openinterpreter. In danger-full-access or `--yolo` mode, nothing stops the agent from modifying its own rollout files.

• Sandbox & Approvals (repo docs)
• Permissions (repo docs)

Session history is JSONL, optionally zstd-compressed, and can be read with jq, zstd and a text editor.

• codex-rs/rollout/src/compression.rs

Messages between agents are logged as InterAgentCommunication items carrying an item ID and the author and recipient agent paths, so the two sides' records can be matched. Only agents inside the runtime exchange messages this way.

• codex-rs/protocol/src/protocol.rs
• Subagents (repo docs)

The runtime is open source under Apache-2.0 and builds with Bazel and a Nix flake, but the project does not claim or document reproducible release builds.

• LICENSE
• flake.nix

Config comes from readable TOML files, and `/status` and `/permissions` show the active posture. The effective config also depends on CLI `-c` overrides, profiles, environment variables and provider model catalogs, and there is no documented dump of the fully resolved config.

• Config (repo docs)
• Sandbox & Approvals (repo docs)

Recipients cannot verify that a message or action came from this agent under its owner's authority. The only agent keys are registered with the upstream ChatGPT backend, not held by the owner.

• codex-rs/agent-identity source

The rollout files carry no integrity data, so no tool can check that the record is intact.

• codex-rs/rollout

All state is in local TOML, JSONL and SQLite files under ~/.openinterpreter, so the owner can copy it at two points in time and compare the copies with open tools such as diff, zstd and sqldiff.

• Portability guide (repo docs)
• codex-rs/rollout

Project and personal instructions are editable AGENTS.md files, and the base harness and instructions can be switched or overridden through `/harness` and config.

• AGENTS.md (repo docs)
• Harness docs

Memories are optional and off by default. When enabled they are stored locally, can be inspected with `/memories`, and generation and use can be switched off in config. Session history can be deleted or disabled.

• Memories (repo docs)
• Sessions (repo docs)

Skills, hooks, rules and subagent definitions are owner-editable files, and the Apache-2.0 runtime itself can be modified and forked.

• Skills (repo docs)
• Project license (repo docs)

The owner can add any MCP server, plugins and skills, and can scope filesystem and network access with custom permission profiles and exec-policy rules.

• MCP (repo docs)
• Permissions (repo docs)

Any OpenAI-compatible, Anthropic-compatible or local provider (Ollama, LM Studio) can be selected with `/model`. Some surfaces, such as web search, depend on provider-side tooling and may be unavailable with local models.

• Providers (repo docs)
• Web Search (repo docs)

No license checks, paid tiers or approval steps gate any modification. The project is Apache-2.0 open source.

• Project license (repo docs)

Permission profiles let the owner allow or deny network domains and filesystem paths for commands, enforced by the OS sandbox (Seatbelt, Bubblewrap/seccomp, Windows sandbox) below the model's judgment. MCP servers, connectors and approved escalations fall outside those profiles, and the owner cannot limit which peers or messaging channels the agent uses.

• Permissions (repo docs)
• Sandbox & Approvals (repo docs)

The runtime enforces approval policies (`untrusted`, `on-request`, `never`) and exec-policy rules. Commands that need approval do not run until the owner confirms.

• Sandbox & Approvals (repo docs)
• Exec policy (repo docs)

The owner can interrupt a turn from the TUI at any time, and the local process or background daemon can be stopped immediately (`interpreter app-server daemon stop`).

• Interactive mode (repo docs)
• Daemon (repo docs)

Analytics are on unless `[analytics] enabled = false` is set, and events go to a project-operated endpoint whenever a ChatGPT login or API-key auth session exists. No such events are sent when no auth session is present, for example with local models only. No data-training use by the project is documented.

• codex-rs/analytics/src/client.rs
• Authentication (repo docs)

Credentials are held in the OS keyring or ~/.openinterpreter/auth.json (`cli_auth_credentials_store`), or in environment variables. The owner can inspect, revoke (`/logout`) and move them, and no provider-held integration broker is needed.

• Authentication: Credential Storage (repo docs)

All agent state is local and the owner can delete it permanently by removing ~/.openinterpreter and project files. There is no provider-side agent account; analytics already sent when an auth session was active are the only data outside the owner's control.

• Portability guide (repo docs)
• Sessions (repo docs)