Wirken
The switchboard for the agent era. Per-channel isolation, encrypted credential vault, per-session hash-chained audit log. Single static Rust binary.
Last verified:
What is Wirken?
Wirken is a secure AI agent orchestration platform that acts as a switchboard for the agent era, connecting messaging channels like Telegram, Discord, Slack, Microsoft Teams, Matrix, WhatsApp, Signal, Google Chat, iMessage, and web chat to an AI agent that reads files, calls APIs, and runs tools on your behalf. The system was built in response to security failures in competing platforms like OpenClaw, which consolidated all credentials behind a single token with no channel isolation.
Key features include compile-time channel isolation enforced by Rust's type system, where each messaging channel runs in its own isolated adapter process with its own scoped credential—compromise of one channel cannot cascade to another. All credentials are encrypted at rest with XChaCha20-Poly1305, keyed from the operating system's keychain, with per-credential expiry and configurable rotation. Every agent action is logged to an append-only, hash-chained audit ledger that is independently verifiable and tamper-evident. The system ships as a single static Rust binary with no npm or runtime dependencies.
Wirken is designed for security-conscious developers, enterprises, and organizations that need to deploy AI agents without bypassing existing security and compliance requirements. It supports 8 LLM providers (Ollama, Anthropic, OpenAI, Gemini, Bedrock, Tinfoil, Privatemode, and custom OpenAI-compatible endpoints), includes 16 bundled skills, and offers SIEM forwarding to Datadog, Splunk HEC, Microsoft Sentinel, or webhooks. The MIT-licensed project welcomes contributions and scrutiny.
Wirken pricing
Pricing model: Freemium
Wirken is free and open-source under the MIT license. There are no paid tiers or subscription plans. The repository contains a complete Cargo workspace with all architecture components: encrypted credential vault, append-only audit log with hash chain verification, Cap'n Proto IPC with Ed25519 adapter authentication, gateway core, channel adapters, agent runtime with LLM integration, CLI with setup wizard, and systemd/launchd service installation. All 16 bundled skills, 9 channel adapters, and 8 LLM provider integrations are included at no cost. Prebuilt binaries are available for Linux (x86_64, aarch64), macOS (x86_64, Apple Silicon), and Windows 11 (x86_64).
Wirken pros
- Compile-time channel isolation enforced by Rust type system eliminates cross-channel access vulnerabilities
- Each channel runs in separate OS process with distinct Ed25519 identity preventing lateral movement
- No single token controls everything—scoped credentials per channel prevent cascade compromise
- Credentials encrypted at rest with XChaCha20-Poly1305 keyed from OS keychain
- SecretString type makes logging/printing/serializing decrypted credentials a compile error
- Credentials rotate on configurable schedule with no static forever-tokens
- Append-only hash-chained audit ledger with independently verifiable tamper detection
- Per-agent Ed25519 attestation signs chain head after every turn
- Works day one with OpenClaw ecosystem skills—most are markdown files requiring no migration
- Code skills run in sandboxed Docker containers with drop-all capabilities and read-only root filesystem
- Single static Rust binary—no npm, no node_modules, no runtime dependencies
- Supports 8 LLM providers including local Ollama and confidential inference (Tinfoil, Privatemode)
- SIEM forwarding to Datadog, Splunk HEC, Microsoft Sentinel, or custom webhooks
- Three-tier permission model: allowed, first-use approval, and always-ask for destructive operations
- Prompt injection detection scans for role-switching, instruction overrides, base64 commands
- Offline audit verification with wirkt session verify replays log and re-checks hashes
- Capability-attenuated multi-agent with operator-configured ceilings for child agents
- MCP credentials isolated in separate out-of-process proxy, agent never sees plaintext tokens
- MIT licensed with welcome for contributions, criticism, and scrutiny
- Signed releases with Ed25519 offline key and fail-closed installer verification
Wirken cons
- Not a finished product—published as a foundation for examination and improvement
- Type-level channel separation exists in IPC crate but not yet threaded through production message path
- Windows lacks Signal adapter, orchestrator-push, service installer, and cron presets (Linux/macOS only)
- Egress allowlist does not apply to exec shell sink, MCP server children, or LLM HTTP client
- Sandbox falls back to host execution if Docker not reachable at gateway start with warning
- Prompt injection detection flags threats but does not block messages
- Requires Rust 1.85+ and capnproto compiler to build from source
- Hard depth cap of 4 for child agents limits complex multi-agent hierarchies
- Escape hatches exist that can relax security defaults if operator misconfigures
- gVisor kernel attack surface reduction is opt-in rather than default
Frequently asked questions about Wirken
What is Wirken and what problem does it solve?
Wirken is a secure AI agent orchestration platform that acts as a switchboard for the agent era. It solves the critical security failures in competing platforms like OpenClaw, which consolidated all encrypted messaging channels behind a single static authentication token with no channel isolation, no credential rotation, no audit trail, and no skill sandboxing. Wirken applies distributed, locally authoritative, isolated-by-channel principles so that compromise of one component cannot cascade to another.
How does channel isolation work in Wirken?
Each messaging channel runs its own isolated adapter process with its own scoped credential. There is no single token controlling everything. This isolation is enforced at compile time by Rust's type system—each adapter is generic over a zero-sized channel marker type. A Telegram adapter holds a SessionHandle<Telegram> that cannot be constructed by, converted to, or accessed from a Discord adapter because the type parameter is sealed. The compiler rejects cross-channel access before code can run.
How are credentials stored and protected?
All credentials are encrypted at rest with XChaCha20-Poly1305, keyed from the operating system's keychain (macOS Keychain via Security framework, Linux Secret Service via freedesktop API). Decrypted secrets are wrapped in Rust's SecretString type, which does not implement Display, Debug, Serialize, or Clone—the compiler rejects any attempt to log, print, serialize, or copy a decrypted credential. Credentials rotate on a configurable schedule and expire. There are no static forever-tokens.
What is the audit log and how do I verify it?
Every agent action—every message read, sent, tool invocation, file access, network request—is logged to an append-only, hash-chained audit ledger before execution. The hash chain is independently verifiable and tampering is detectable. Run 'wirken audit verify' to check log integrity offline. The command verifies the audit log integrity, confirms hash chain is intact, and validates chain-head signatures. If anyone changes a single entry, the seal breaks and the check fails.
Which messaging channels are supported?
Wirken supports 10 channels: Signal, WhatsApp, Telegram, Matrix, Discord, Slack, Microsoft Teams, Google Chat, iMessage, and a web chat UI at http://localhost:18790. Each channel runs in its own adapter process with a distinct Ed25519 identity. There are 9 channel adapter crates under crates/adapter-* for the native platforms, plus web chat as the local interface.
Which LLM providers work with Wirken?
Wirken works with 8 LLM providers: Ollama (local), Anthropic, OpenAI, Google Gemini, AWS Bedrock, Tinfoil, Privatemode, and any OpenAI-compatible custom endpoint. Tinfoil and Privatemode run LLMs inside hardware enclaves (AMD SEV-SNP, Intel TDX) for confidential inference where prompts are encrypted end-to-end and protected against software attacks on infrastructure.
What are the permission tiers and how do they work?
Wirken uses a three-tier permission model scoped per agent. Tier 1 (allowed): workspace file access, channel responses, web search—no interactive query needed. Tier 2 (first-use approval, then remember): shell exec for allowlisted commands, external file access outside workspace, cross-channel messaging—first call asks, subsequent same-pattern calls run without asking; approvals expire after 30 days. Tier 3 (always ask): destructive file operations, network requests from skills, credential access, cron creation, skill installation, shell exec for non-allowlisted commands—approvals are not cached.
How do skills work and can I use OpenClaw skills?
Skills are directories containing SKILL.md (instructions to the model) and a YAML frontmatter block declaring tools and permission expectations. Optional skill.wasm provides compiled WebAssembly modules. Skills from the OpenClaw ecosystem work on day one—the majority are markdown instruction files requiring no compilation or migration. Code skills run in sandboxed containers. New skills target WebAssembly with deterministic resource limits. Skills are signed with Ed25519 signatures over the SHA-256 hash of SKILL.md.
How do I install Wirken?
On Linux and macOS, run: curl -fsSL https://raw.githubusercontent.com/gebruder/wirken/main/install.sh | sh, then werken setup and wirken run. The installer verifies the SHA-256 checksum and signature with an embedded Ed25519 public key, failing closed on any verification failure. For Windows, see docs/windows.md for the Windows install path and feature-set differences. To build from source, require Rust 1.85+ and the capnproto compiler, then run cargo install --path crates/cli.
Can I deploy Wirken for enterprise teams?
Yes. Wirken gives organizations controls for AI agent deployment without bypassing security and compliance. Features include full attribution (platform sender id, channel, session, agent per message), tamper-evident audit trail with SIEM forwarding to Datadog/Splunk/Microsoft Sentinel, crash recovery via session log replay, graduated permissions, capability-attenuated multi-agent with operator-configured ceilings, sandboxed execution in Docker/gVisor, centralized policy via org config pulled from company endpoint, and policy refresh on every wirken run. Developers get grab-and-go setup while IT manages one config.