Run your one-person company from the terminal. It gets cheaper every run.

Why kokuban

1. It gets cheaper the more it works. The first time, AI does the job and kokuban records how. Steps that turn out to be the same every time are proposed as programs (rules, scripts, API calls, browser replays) that use no AI. You see, per workflow, how many tokens it uses and how much of the work AI still does.
2. No wasted tokens. Each person and each job gets only the tools it needs; more are added when they are needed. Tools are called as commands, so their manuals do not fill the context. Nothing wakes AI up on a timer to ask "anything new?": programs watch, and AI is started only when there is work.
3. Benchmarks, with the method. The same jobs with the same model, kokuban against other tools, and run 1 against run 10. (Coming; the way it is measured will be published with it.)
4. Nothing extra to start. It uses the AI subscription you already have, or an API key. Each role can have its own model.
5. A chat in the terminal. Typing is all it takes. Run it at home and talk to the same team over SSH from anywhere.
6. Light. One Rust binary. It runs on old and small computers.
7. Local, for one person, and safe.
   • Your data and keys do not leave your computer, and nothing listens for the outside world (see below).
   • The AI never sees a key: the gateway adds it on the way out.
   • No telemetry.
   • Tools other people wrote (local MCP servers) run in a box too.

Your sign-ins stay on your computer. Acting as you is not what makes kokuban different (cloud agents can push as you too); that the keys never leave your computer is.

It connects out; nothing listens

Opening a port would contradict "nothing can reach it from outside". So kokuban does not accept anything from the outside world: it connects out and receives.

• Slack: socket mode (kokuban opens the connection).
• Mail: IMAP, connected from here.
• GitHub, Stripe and others: kokuban looks at their APIs now and then, asking only for what changed (ETag), so a look that finds nothing costs nothing.
• Webhooks are not supported, on purpose.

How it gets cheaper

1. AI does a step the first time. kokuban records what it was given, which tools it used and what it answered.
2. When a step's answer depends only on its input (it answered the same way to the same kind of input), Optimizer writes a program for it, tries it on the past runs, and puts it in your inbox with what it would save.
3. A step taken over by a program starts as a trainee: you check its first results. It goes back to AI by itself when its input or output does not look as expected, or the page it replays has changed.
4. The ledger (kokuban ledger) shows, per workflow, tokens, the share read from the cache, the trend, how much AI did, and what programs saved.

Research this builds on:

• Progressive Crystallization (2026): steps move from AI, to AI and program, to program only. In eight months of production use, the share done by programs grew from 0 to about 45%, and the cost per item fell by more than 70%. https://arxiv.org/abs/2607.07052
• SIGIL (2026): a step whose output depends only on its input belongs to a program. Following the set procedure rose from 56% to 86%. https://arxiv.org/html/2607.27309v1
• ASI (2025): only functions that solve the task again when re-run are kept. WebArena success rose from 32.7% to 40.4%. https://arxiv.org/html/2504.06821v2
• Stagehand and Skyvern: replay what worked, check that the page is still the same, and go back to AI when it is not ("a wrong cached click is worse than a slow one"). https://browserbase.com/blog/stagehand-caching · https://skyvern.com/docs/developers/features/code-caching
• Agent Skills (Anthropic): a script's code stays out of the context; only its output goes in. https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview

How it keeps you safe

Protection does not rest on an AI's judgment (classifiers and prompts are broken by adaptive attacks most of the time). It is built into how kokuban runs, in four layers.

flowchart TB
  outside["Mail, issues, web pages, Slack<br/>(text from outside)"]
  subgraph L1["1 · What it reads"]
    reader["A reader: reads outside text,<br/>has no tools, writes a typed summary"]
    doer["A doer: sees only the summary,<br/>has the tools"]
  end
  subgraph L2["2 · What it can do"]
    box["Each AI in a box:<br/>its own folder, only the hosts it needs"]
    gateway["The gateway holds the keys;<br/>first sends to someone new wait for you"]
  end
  subgraph L3["3 · What it can change about itself"]
    drafts["Definitions and memory change only as<br/>drafts you approve; every change is in git"]
  end
  subgraph L4["4 · When you are asked"]
    trust["Between steps: trainees are checked,<br/>trusted steps are left to work"]
  end
  outside --> reader --> doer --> box --> gateway
  doer -.-> drafts
  gateway -.-> trust

1. What it reads. Everything on the blackboard carries where it came from: you, kokuban, derived, or outside (mail, an issue, the web, Slack). An AI that reads outside text gets no tools and writes only a typed summary; the one with the tools reads only that summary (Meta's Rule of Two). What other agents write is data, never instructions.
2. What it can do. Every AI tool runs in a box (macOS Seatbelt, Linux bubblewrap): it writes only in its own folder and reaches only the hosts its kind of work needs. It cannot read ~/.ssh, ~/.aws, the OS keychain or kokuban's own store. Only the gateway holds keys. The first send to someone new waits for your yes; force pushes, tags and deleting on GitHub never happen. Code work happens in a copy of your repository, on a kokuban/… branch.
3. What it can change about itself. Definitions and memory change only as drafts that you approve, and every change is committed to git so it can be undone. Approvals are bound to the content's hash. Changes that arrive from other computers are signed per computer; unknown ones are treated as outside until you look at them.
4. When you are asked. Inside one step, kokuban adds no prompts of its own. Between steps, it works like a team: a new step's output is checked by you, and a step you trust is left to work.

On a computer where the box cannot be used, kokuban says so and checks AI steps one level more strictly.

Connect your services

Each service is connected from your terminal with kokuban connect, using a key you make on your own account. kokuban registers no app of its own anywhere, and keys stay on your computer.

• GitHubReads and comments on issues, opens pull requests, pushes code work
• SlackPosts and reads messages; you can talk to kokuban's people from Slack
• GmailReads, answers and sorts your mail
• Email (IMAP and SMTP)Reads and sends mail of any provider
• StripeWatches payments and reads what happened
• Google AnalyticsReads your site's visits, pages and events (GA4)
• Google Search ConsoleReads searches, clicks and indexing; resubmits sitemaps
• Bing Webmaster ToolsReads searches and clicks from Bing; sends new pages to it
• kokuban's own browserWorks on sites that have no API (an admin page, a bank's statements), signed in by you
• MCP serversUses the tools of an MCP server (Linear, Notion, your own…)
• Any other APICalls any HTTPS API with its key
• Anthropic API keyLets kokuban's AI run on an API key instead of your Claude subscription (ai.auth api-key)

See the screen

The screen runs in your browser too, with sample data: open the demo

Install

macOS and Linux:

curl -fsSL https://kokuban.sh/install | sh

Or with Homebrew:

brew install init-co-jp/tap/kokuban

Windows (beta):

irm https://kokuban.sh/install.ps1 | iex

On Windows, WSL2 is recommended: the Linux version runs as it is, and the AI's box works there.

The install script checks the download against its checksum, puts kokuban in ~/.local/bin, and starts the first setup: it finds the AI tools on your computer, your Chief of Staff asks what your business is, and Talent proposes your first company and its people (nothing is made until you approve it). Then kokuban opens the chat.

To keep kokuban working while the screen is closed, kokuban daemon install starts it at login (launchd, systemd, or a logon task).

What it makes on your computer

Everything is in one folder, ~/.kokuban (KOKUBAN_HOME moves it; %USERPROFILE%\.kokuban on Windows). Settings and definitions are KDL; long text is Markdown. You can read and change all of it with $EDITOR, and kokuban keeps its history in git.

~/.kokuban/
├── kokuban.kdl              settings for everything
├── hq/                      HQ: your Chief of Staff and the people who build the rest
│   ├── members/             your changes to HQ's people (their own definitions are in the binary)
│   ├── workflows/<name>/    HQ's workflows (Optimizer's, for one)
│   ├── connections.kdl      connections (never the keys)
│   └── memory/              what kokuban remembers about you
├── companies/<company>/
│   ├── company.kdl          the company's settings
│   ├── company.md           what it is for, and how it works
│   ├── members/<person>.kdl name, role, icon, tools and model, connections, budget
│   ├── workflows/<name>/
│   │   ├── workflow.kdl     its steps, who does each, and what starts it
│   │   ├── rules/           sorting rules (some made by Optimizer)
│   │   └── scripts/         its programs (some made by Optimizer)
│   ├── connections.kdl
│   ├── skills/              SKILL.md
│   └── memory/
├── ui/                      the screen, built from settings
│   ├── defaults.kdl         kokuban's own (rewritten on update)
│   └── local.kdl            yours (kept on update)
└── local/                   this computer only (never shared)
    ├── machine.kdl          this computer's name, its workflows, its safety settings
    ├── kokuban.db           the blackboard: everything that happened (SQLite)
    ├── sessions/            AI conversations to resume
    ├── state/               where schedules and watchers left off
    ├── cache/               safe to delete
    └── logs/

Keys are not in this folder: they are in the OS keychain (macOS Keychain, Secret Service on Linux, Credential Manager on Windows).

To move to another computer, kokuban backup puts the definitions and the history in one file (keys only with a passphrase), and kokuban restore unpacks it.

Compared with other tools

Looked at on 2026-10-29; the other tools may have changed since.

License, issues and contributions

kokuban is under the Apache License 2.0. The code is open because a tool that holds your keys and acts as you has to be one you can check.

Pull requests are not accepted. Please open an issue instead, and we will write the change ourselves. This keeps outside code out of a tool that holds keys, keeps the design whole, and keeps the license ours to change. You are welcome to take part through plugins, skills and company templates.

Support

You can support kokuban through GitHub Sponsors.

Supported by init-co-jp.