ENZO: A Self-Hosted AI Workspace That Never Sees Your Keys
A new open-source project called ENZO is trying to solve the trust problem at the center of most AI tools. When you use ChatGPT, Poe, or similar hosted platforms, your prompts and API keys pass through their servers. ENZO cuts that middleman out entirely. It runs on your own hardware, stores API keys only in your browser, and pays providers directly on your behalf.
The project is a single Docker Compose deployment that boots a web UI at localhost:5001. From there, users connect provider keys from OpenRouter, Google AI Studio, NVIDIA NIM, Groq, HuggingFace, Cloudflare, and Gemini. The first key you paste into a fresh instance "claims" it, writing to a sealed container volume so scheduled agents and skills work even when the browser is closed. No account, no subscription, no usage tracking.
300+ Models, 74 Agent Skills, and a Two-Pass Builder
ENZO's model catalog pulls from nine providers simultaneously. Each model is health-checked live, and the toolbar shows an ECG-style heartbeat trace that flatlines red the moment any provider goes unreachable. The system supports streaming chat in normal, thinking, research, and coding modes across all models.
The agent builder works on a two-pass system. First, a drafter analyzes the task domain, what ENZO calls "tacit knowledge, decision heuristics, and edge cases." Then a race fires the task at roughly ten free candidates from the user's own providers. The first model to answer wins, stragglers are killed, and a scoreboard reorders future races based on which models actually deliver results. Every agent records which model drafted it and says so openly if nothing was reachable.
A neural layer runs per-agent, folding in domain-matched platform activity on a 90-second cadence and distilling lessons into memory. The system injects a live "NEURAL FOCUS" block into every agent run, visible in the agent's Neural tab. Agents also improve themselves over time by learning from user activity.
44 Security Assertions, Every Push
ENZO's CI pipeline runs seven stages on every push to main. The most notable is a black-box security pentest that fires 44 live assertions against a booted server: auth bypass, IDOR, hostile payloads, stream integrity, and a keyless-boot proof that verifies the server starts with zero provider keys. A separate stage greps the frontend for any raw localStorage key reads, failing the build on contact. If a key-access site is missed in development, it becomes a red build, not a production bug.
The full codebase is approximately 44,000 lines of strict TypeScript. The test suite covers 298 assertions across agent, vault, crypto, and model suites. Dependency audits run on both frontend and backend, failing on any high or critical vulnerability.
AES-256-GCM Key Storage, Passphrase Optional
Provider keys live in the browser, sealed with AES-256-GCM under a non-extractable WebCrypto key. This key can decrypt stored keys but cannot be exported by any JavaScript, including the application's own code. An optional passphrase mode re-seals everything under PBKDF2-SHA256 with 600,000 iterations and deletes the device key entirely.
The project's threat model is documented in docs/SECURITY.md, linked to the specific code that makes each claim. Self-hosted mode stores the first claimed key in the container's .env file, sealed in a Docker volume, so scheduled agents can run without the browser open. The project states this tradeoff explicitly rather than hiding it. The server never reads keys in hosted mode; in self-hosted mode, only the one claimed key is accessible, and only for scheduled agents.
Google Colab as a One-Click Deploy Option
For users who want to skip the Docker setup, ENZO includes a Google Colab notebook that clones the repository, installs dependencies, builds the UI, boots the server, and hands back two URLs: one for the browser session and a Cloudflare tunnel for phone access. The notebook arms a keep-alive that resets Colab's 90-minute idle timer every 60 seconds and a watchdog that pings the server every five minutes, restarting it if it dies. Sessions run up to 12 hours on free Colab.
Keys still stay local. The Colab instance is just Google's hardware running the same code minus Google sign-in. When the session ends, everything on the VM is gone.
File Conversion, Research Mode, and a Music Player
ENZO includes a file converter that parses PDFs, spreadsheets, CSVs, JSON, TXT, and Markdown files in chat. Files never leave the device; only the reasoning step uses the provider key, exactly like normal chat. The agent can extract tables, merge documents, and cross-convert formats, with CSV and Excel download buttons on the reply.
Research mode runs a loop that writes its own search queries, reads results, and decides when it has enough information, all under hard budget limits. Code generation writes a project, boots it, previews it live, and reports errors.
The music player searches and plays songs from the model marketplace without a YouTube API key. A five-band Web Audio equalizer with presets adjusts frequency response, and a "For You" feature builds listening history locally on the device.
Five releases have shipped since v1.0.0, each documented in the changelog. The project requires Docker Desktop with at least 4 GB of allocated RAM. Updates run through a single pull-and-up command.