Skip to content
Nouride

FAQ

Before installing

Do I need a GPU? No. Nouride does not run a model. It calls an endpoint you point it at, so RAM and CPU are unaffected by which model an agent uses.

Do I need Docker? No. The binary carries its own runtime — no Node, no Bun, no Python, no package manager. Docker is one option of four.

Does it work on a Raspberry Pi? Yes, on a 64-bit OS. uname -m must say aarch64. There is no 32-bit ARM build.

What does it cost to run? 64 MB of RAM is the verified floor and 512 MB is the recommendation. Around 95 MB of disk. Under 1% of one core at idle. Every measurement →

Which models can I use? Anything speaking the Anthropic Messages or OpenAI Chat Completions wire format — so Claude, GPT, OpenRouter, a company gateway, a local Ollama, or your own proxy.

Does anything phone home? No. The conversations, the memory and the credentials are files in one directory on your machine. The only outbound traffic is to the model endpoint you configured and the chat platforms you connected.

Is it open source? No. Nouride is proprietary software from Nouverse Technologies. The WhatsApp bridge ships as a separate executable under GPL-3.0, because the library it uses is GPL-3.0 and process isolation is where that boundary sits.

Setting up

Do I need a bot token to try it? No. nouride chat and the dashboard’s chat both work with no token at all, through a real in-process gateway.

I missed the first-run password. It is shown once and there is no reset. Recovering means starting from an empty user table — which also deletes your conversations and secrets. Set INITIAL_ADMIN_USERNAME and INITIAL_ADMIN_PASSWORD in .env before the first start and this cannot happen.

Where does my API key end up? In data/secrets.json at mode 0600, or in an environment variable. config.toml gets only the name of the credential. That is why a config file is safe to commit and to render in a browser.

Can I run more than one agent? That is the point. Each is a directory of Markdown and costs about 0.4 MB of RAM. Give each one its own bot token and they have separate identities on the same platform.

Can two agents talk to each other? Yes, and in two different ways depending on where. In a group, they tag each other and the tag is the handover. In a one-to-one chat that cannot work — each bot has its own private conversation with you — so an agent uses the ask_agent tool instead, and the one you are talking to stays the only one that speaks. Details →

Running it

My bot ignores group messages. On Telegram, privacy mode. BotFather → /setprivacy → Disable, or make the bot an admin. On Discord, the Message Content intent — without it every message arrives empty.

I saved a connection and nothing happened. Gateway adapters are built at boot. Every gateway change needs a restart, and the dashboard says so and offers the button.

A stranger messaged my bot and got a code. That is pair mode, the default. nouride access approve <code>, or the Access tab. Switch to allowlist once the people you want are in.

Why does it keep asking about terraform apply? Infrastructure commands are a hardline class: they ask every time and can never become a standing grant. Their read halves — plan, get, describe, --dry-run — are not gated at all.

Why does it not ask about most things? [security] approvals defaults to risky: ordinary calls run unprompted and only the dangerous classes ask. /approvals normal in a chat turns the full policy on for you.

The agent forgot something after /new. /new clears the conversation. Facts that must survive belong in MEMORY.md, USER.md, or a [[people]] entry. Access & people →

Can it read a PDF I send it? Yes, but not by sending it to a model. Documents land in the agent’s workspace and it opens them with read or a command, so a PDF costs nothing until the agent looks. Images are sent to a model, if read_images is on.

Can it browse the web? It can search and fetch pages. There is no browser automation, and it is not planned — a browser driven by a model that takes its instructions from a chat message is a general-purpose request engine inside your network boundary, with no equivalent of the exec approval gate. If it is ever wanted, it belongs in an MCP server. Why →

Can I add my own tools? Yes, through the Model Context Protocol, declared per agent. MCP servers →

Operating it

How do I back it up? tar over .nouride/ and .env with the daemon stopped. There is no backup command yet, and no restore path for the database. Maintenance →

How do I upgrade? Re-run the installer. It replaces the binary and leaves .nouride/ alone. Migrations run at boot.

nouride status says there is no daemon, but it is running. The CLI resolves the install relative to your working directory. Run it from the install directory — the error names the path it wanted.

nouride restart refuses. It works by asking the daemon to exit so its supervisor brings it back. With nothing supervising it, that would just be a stop. nouride service status says whether anything would respawn it.

Can I run the CLI against a remote box? Yes. NOURIDE_URL and NOURIDE_TOKEN, and every command except start works.

Can I run two daemons against one bot token? No. Two Telegram bots polling one token get half the messages each. When migrating, stop the old one before starting the new one.

Security

Is the approval gate a security boundary? No, and it does not claim to be. A determined model routes around any classifier. It exists so ordinary work does not surprise you. What actually holds is the service account, the systemd hardening, the workspace roots and the access gate.

Can an agent read my API keys? Not through its file tools — the credentials directory is deliberately not a workspace root, and the daemon refuses to start if it lands inside one. A command can reach it through $NOURIDE_CREDENTIALS_DIR, and that is a hardline class that asks. Secrets listed in exec_secrets arrive in a child process as environment variables and never in the prompt.

Can an agent give itself more permissions? It has a nouride tool, so treat that as a real question rather than a rhetorical one. Two things answer it: [security] approvals = "none" has no CLI write path and no chat command, only the dashboard behind a login and the config file, which is itself a hardline path. And the hardline classes cannot be auto-approved however loudly the gate is switched off.

Can an agent read another agent’s files? No. Each loads only its own directory, and that is true because nothing in the loader looks anywhere else. What one agent knows about another comes from its own AGENTS.md and from messages on the bus.

Is the dashboard safe to expose? It is a login, so put TLS in front of it if it is reachable from anywhere you do not control. The default is loopback-only and an ssh -L tunnel, which is the right answer for most people.

Things that are not built

Stated plainly, because a missing feature that reads as a bug wastes more time than one that is documented.

  • Off-host backup. The daemon snapshots its database daily and nouride db restore puts one back, but both sets of snapshots live under data/ — on the same disk as what they protect.
  • Telegram webhook mode. Long polling only.
  • A spend limit in dollars you can rely on. max_daily_cost_usd defaults to off, and it can only see models it has a price for. max_daily_tokens is the ceiling that applies to every model — it also defaults to off, and it is the one to set.
  • Browser automation. Deliberate — see above.
  • 32-bit ARM.