TinyAGI

The deciding trait is where you talk to it. Reaching your agents through Discord, WhatsApp or Telegram means work gets started from a phone, in a queue, on the way somewhere, and that fits how small requests actually occur to people. It is a genuinely different rhythm from opening a laptop to type a prompt.

The same trait is the warning: giving instructions from a chat window means giving them without seeing the code. Pick it for errands and triage. Pick a desktop tool for work you need to watch.

Directory separation is a convention, not a boundary. Nothing stops a shell command from walking up a level, and several role-specialised agents running continuously will eventually produce one that does, at an hour when nobody is reading the feed. The documented Docker path covers the daemon rather than the individual workspaces, which is the opposite of where the isolation is needed.

What it does right is fanning work out explicitly, so at least the path a task took between agents is recorded rather than inferred.

1. Choosing a transactional store for the work queue means the failure behaviour is defined: either a handoff committed or it did not, and a task that cannot be processed lands somewhere nameable instead of disappearing. Most projects at this maturity keep the queue in memory and discover the consequences later. 2. Retries with a terminal state also bound the pathological case where two agents pass the same item forever.

2. No evaluation is offered, and the claims here are about plumbing, which does not require one.

A rename this early usually means either a trademark conversation or a change of ambition, and neither is free: the audience fragments across two names and the search results take a year to catch up. Thousands of stars accumulated anyway, which says the idea has pull and says nothing about who pays for the next year of it.

Moat: none. Likely path: a maintainer's enthusiasm project that either finds a sponsor or slows to occasional commits. Position: watch it, do not wire a team process into something still choosing its own name.

Any component that holds secrets becomes part of my security review whether it wants to or not. Keys stored inside a self-installed daemon on a developer machine sit outside our vault, outside our rotation schedule and outside the audit that says who can decrypt what. That is the whole conversation.

The platform note adds a second cost, since the Windows population needs a subsystem installed first and supported afterwards. There is no directory integration and no policy surface at any seat count. Not yet.

Accepting an arbitrary compatible endpoint is the minimum I ask for and a surprising number of projects still fail it. Here the provider is a configuration entry, so my own inference host is as valid as anyone's API, and nothing forces traffic through a vendor I did not choose.

A compose file gets the daemon up in one command, and the permissive licence keeps a fork legal when the maintainers wander off. What I miss is protocol support: no MCP at either end, so every tool I want is glue I write myself.