Text it the chore.
It does it for you,
in a real browser.
OpenInstinct is an open source personal assistant that lives in your iMessage thread. It books tickets, orders groceries and fills forms on real websites, while your passwords and cards stay encrypted in your own Vercel account.
- MIT licensed
- Runs in your Vercel account
- Works with any model
A personal agent that can act for you, without handing it your keys
Finishes real tasks
It drives a cloud browser through sign in, search, cart and checkout on the actual site, then sends you a screenshot and a summary.
Your secrets never reach a model
Passwords and cards are encrypted before they touch your database. The browser fills them from a handle, so no model ever reads the raw value.
Asks before it spends
Purchases, sent emails and destructive changes wait for your approval in the thread. It quotes the merchant, item and total first.
Remembers the boring parts
Your name, address, phone number and preferences are saved once and reused on every form. Say the word and it forgets them.
Any model, your bill
Inference runs through Vercel AI Gateway on your own account. Swap models in one line without changing anything else.
An assistant is only useful when it can sign in, book and buy. That should never mean giving a model the keys to your life.
Running in about ten minutes
You need a Vercel account and an iPhone. Everything else is provisioned for you.
- 01
Deploy to Vercel
One guided flow provisions everything: Kernel cloud browsers, Neon Postgres, a private Blob store, a Linq iMessage line and AI Gateway access. No environment variables to paste.
- 02
Text the number once
Message your new line from your phone to verify it. Sign in on the web workspace to save logins and cards to the encrypted vault, or skip it and add them when a task needs one.
- 03
Send it a chore
It opens a browser, works through the site, and pauses in your thread for an OTP or a purchase approval. When it is done you get a screenshot and the receipt details.
The kind of thing you would text a very capable friend
Illustrative threads. Merchant names and numbers vary with your accounts and location.
Groceries
- You: reorder last week's instacart, swap the oat milk for whole
- OpenInstinct: cart's ready at Wegmans. 14 items, whole milk swapped in. $87.41 with delivery for the 6 to 8pm window. want me to place it?
- You: yes
- OpenInstinct: placed. order #WG2831 arriving tonight between 6 and 8.
Appointments
- You: book me a haircut at fellow barber friday after 5
- OpenInstinct: Fellow Barber on Elizabeth St has 5:30 and 6:15 on Friday with Marcus. booking 5:30 unless you'd rather the later one.
- You: 5:30 works
- OpenInstinct: done. confirmation went to your email.
Forms and renewals
- You: renew my library card, it expires this month
- OpenInstinct: BPL renewal form filled from your saved address. it needs the card number, which I don't have. can you text it?
- You: 2192 0041 7638
- OpenInstinct: submitted. new expiry is Sept 2027.
The problem
Useful agents need your logins. Most of them read your passwords to use them.
A hosted assistant that can buy and book has to hold your accounts. That usually means your credentials pass through a model, sit in someone else's database, and leave with the next data breach.
OpenInstinct runs in your own Vercel project. There is no vendor in the middle, and you can read every line that touches a secret.
Encrypted before it is stored
Vault values are encrypted with a key that lives in your private Blob store, never in the database row beside them.
Filled by handle, never by model
The worker passes a saved login's handle to the browser. After the fill, neither model can inspect or return the value.
You answer the challenges
One time codes are asked for in your thread and used once. CAPTCHAs, passkeys and 3D Secure open a live view for you to finish yourself.
Narrow scopes by default
The Gmail connection uses the modify scope, not the permanent delete scope. Sending email or creating events always asks first.
Questions people ask before they deploy
What do I need to run it?
A Vercel account and an iPhone. The deploy button provisions cloud browsers, Postgres, private Blob storage, an iMessage line and AI Gateway access in one flow. There are no environment variables to fill in.
What does it cost?
The software is free and MIT licensed. You pay only for what your own account uses: Vercel compute, Kernel browser minutes, Neon Postgres, Linq messaging and model tokens through AI Gateway. There is no OpenInstinct subscription.
Which models can it use?
Any model available through Vercel AI Gateway. The default is set in one file and you can change it whenever you like.
Does it see my passwords?
No. Secrets are encrypted before they reach your database, and the encryption key stays in your private Blob store. The browser fills a saved login from a handle, so no model reads or returns the raw value.
What happens with two factor codes and CAPTCHAs?
For a one time code it asks you in the thread, uses the code once, and never stores it. For a CAPTCHA, passkey prompt or 3D Secure step it sends you a live view link so you can complete that step yourself.
Will it buy things without asking?
No. Before a purchase it quotes the merchant, item, quantity, option and total and waits for your approval. Sending email, creating calendar events and anything destructive also require approval every time.
Can it use my Gmail and Calendar?
Yes, optionally. You connect Google through your own OAuth app and Vercel Connect stores the tokens. Gmail access uses the modify scope, so it cannot permanently delete mail.
Is iMessage the only way to talk to it?
No. Your deployment also includes a web chat and a workspace where you manage saved logins, cards and addresses.
Can I run it somewhere other than Vercel?
Yes. Set an auth secret, an encryption key and your public URL, point it at a Postgres database and a Kernel key, and run it wherever Node.js runs. The README covers the manual path.
How do I get rid of it?
Delete the Vercel project and its connected stores. Nothing lives anywhere else.
Your own assistant, in your own account
Open source, no subscription, nothing to hand over. If it is not for you, delete the project and it is gone.