Koda is a self-hosted AI agent this studio built from scratch — with an encrypted credential vault, task-result verification, and deny-by-default permissions. These safeguards grew from the studio's experience with credential handling and task verification. Her core components are now open source, MIT licensed, on GitHub, ready to drop into your own agent.
In early 2026 we installed one of the popular open-source AI agents to run parts of this studio. It reported unfinished tasks as complete. It kept credentials in plaintext on disk. We built Koda with a credential vault, task-result verification, and permission checks for risky actions. Those components make the agent's actions easier to inspect and control. We named her Koda — Lakota for friend — and ran her daily on real client work.
Each package is extracted straight from Koda's production backend, stands alone with minimal dependencies, ships with its full test suite, and installs with one line of pip. No signup, no telemetry, no strings.
Encrypted credential storage for agents that handle real accounts.
pip install git+https://github.com/HeyKodaAI/koda-vault.git
Independent checks for reported task results.
pip install git+https://github.com/HeyKodaAI/koda-verify.git
Deny-by-default action gating with four risk tiers.
pip install git+https://github.com/HeyKodaAI/koda-permissions.git
DAG automation with real branching and pause/resume.
pip install git+https://github.com/HeyKodaAI/koda-workflows.git
Route tasks by estimated complexity, model tier, cost, and latency.
pip install git+https://github.com/HeyKodaAI/koda-router.git
Persistent, tiered memory with checks for recognized secret patterns.
pip install git+https://github.com/HeyKodaAI/koda-memory.git
These are unedited runs of the README quickstarts. In the first, the result dict claims a file was written — koda-verify checks the disk and reports the missing file. In the second, koda-memory catches a credential before it can be stored.
verified - File verified on disk: /tmp/quarterly-report.txt (11 bytes, written 0s ago) failed - File does NOT exist at /tmp/never-written.txt despite reported success next steps: ['Try the action again', 'Check the audit log for more details']
SecretDetection(detected=True, confidence=0.95, type='token', service='github') my github token is [CREDENTIAL_STORED_IN_VAULT]
'hey, good morning' → claude-haiku simple 'Refactor the auth module, then add tests, update docs' → claude-sonnet moderate 'Delete the production database backups' → claude-opus critical
Choose the packages that fit your credential storage, verification, permission, workflow, routing, and memory needs. Plain Python, minimal dependencies, pip install from GitHub.
The examples below show how to use each component.
Your agent needs your Gmail token, your Stripe key, your server passwords. Where are they right now — a .env file? Pasted into its prompt? The vault stores them AES-256 encrypted, checks a supplied permission scope before retrieval, and records access in an audit log. The provider permissions attached to the credential determine what it can do once retrieved.
from koda_vault import AuditLogger, CredentialVault, VaultStorage, derive_master_key
key, salt = derive_master_key("correct horse battery staple")
storage = VaultStorage("vault.db")
vault = CredentialVault(storage=storage, encryption_key=key, audit=AuditLogger(storage))
vault.store(name="work-gmail", service="gmail",
scopes=["gmail:read", "gmail:send"], value="ya29.oauth-token")
# caller identity + required scope are enforced and audited
token = vault.retrieve(name="work-gmail", service="gmail",
requested_by="email-engine", required_scope="gmail:send")
A completion message needs supporting evidence. Wrap its actions in a verifier that goes and checks — is the file really on disk, did the API really return an ID — before success gets reported. If the claim doesn't survive contact with reality, it's reported as failed, with evidence.
from koda_verify.verifier import TaskVerifier
verifier = TaskVerifier()
# the agent wrote a file and claims success — check the actual disk
task = verifier.create_task("filesystem:write_files", service="filesystem")
outcome = verifier.verify(task, raw_result={"path": "/tmp/quarterly-report.txt"})
print(outcome.verification.status.value) # verified — the file is really there
# the agent CLAIMS success, but nothing was ever written
task = verifier.create_task("filesystem:write_files", service="filesystem")
outcome = verifier.verify(task, raw_result={"path": "/tmp/never-written.txt",
"success": True})
print(outcome.verification.status.value) # failed — the claim did not survive
You wouldn't give a new hire root on day one. Deny-by-default means your agent can do nothing until you enable that specific scope — and risky actions (send email in bulk, run shell commands, delete anything) route through an approval queue you control.
from koda_permissions.manager import PermissionManager
from koda_permissions.models import RiskTier
from koda_permissions.registry import ActionRegistry
from koda_permissions.storage import PermissionStorage
manager = PermissionManager(ActionRegistry(), PermissionStorage("permissions.db"))
manager.check("gmail:send_email").allowed # False — deny by default
manager.enable_scope("gmail", "send", risk_tier=RiskTier.MEDIUM)
manager.check("gmail:send_email").allowed # True — you turned it on
# HIGH-tier actions go through an approval queue you control
manager.enable_scope("gmail", "delete")
req = manager.request_approval("gmail:delete_email",
description="Delete 3 newsletters")
manager.resolve_approval(req, approved=True)
The package combines tiered memory and LLM-ready context windows with checks for recognized credentials in incoming text. Detected credentials can be redacted before storage.
from koda_memory.manager import MemoryManager
from koda_memory.secret_detector import SecretDetector
from koda_memory.storage import MemoryStorage
manager = MemoryManager(MemoryStorage("memory.db"))
manager.remember("Prefers dark mode and concise answers", key="ui_preferences")
for item in manager.recall("dark mode"):
print(item.key, "->", item.content)
# catch credentials BEFORE they're written to memory
detector = SecretDetector()
result = detector.scan("my github token is ghp_...")
if result.detected:
print(detector.redact(result.original_message, result))
For the recurring job with a human sign-off in the middle: define it as a graph of steps — triggers, conditions, transforms — validated for cycles before it runs, with pause-for-approval built into the state machine.
Full examples in the README →The router estimates each request's complexity and selects a model using tier, cost, and latency settings. Requests flagged as dangerous are routed to a model in the configured higher tier.
Full examples in the README →All snippets above are the actual README quickstarts — every one executed successfully before it was published. That's kind of our whole thing.
Every component is a plain Python library with a FastAPI surface where it makes sense — so any agent that can call HTTP can use them today. Python agent frameworks import them directly. And an MCP server exposing the vault, verifier, and permissions as Model Context Protocol tools is in the works, which puts these components one config entry away from OpenClaw, Claude Code, Cursor, and any other MCP-capable agent.
The components above are the extracted core of the complete Koda agent — a self-hosted dashboard with chat, a fully local voice pipeline, memory, workflows, smart-home control, and 131 LLM-callable tools, all running on your own machine.
All six repositories live under the HeyKodaAI organization on GitHub. Use them, fork them, ship them. If you'd like help wiring honest-agent infrastructure into your own product, that's what this studio does.