JARVIS

Why it's ranked here

The engineering is more careful than the butler persona suggests. The source documents specific attacks it has closed: a browser origin check plus a private token file in front of every state-changing request, a refusal to be framed by other pages, a loopback-only default, environment scrubbing so an inherited API key cannot quietly take over billing, and a rule that a turn which read web pages or third-party connector output may not act unsupervised. Against that sit hard limits: macOS and Chrome only, a paid voice service with no fallback, and a license that bars commercial use without a separate deal. A strong personal tool, not a team platform.

What's good

Memory is plain Markdown, one fact per file, so you can fix or delete one memory in any editor. The index the assistant always sees is capped at 80 entries of at most 240 characters, and each line is only saved if it parses back exactly as written, which stops a planted note from forging new instructions. Startup checks confirm the Claude Code version, the login, and on macOS the stored refresh token's expiry, without ever reading the token itself; each check is bounded to five seconds and cannot block startup. The assistant's tools are an explicit allowlist of 32 of its own plus web search and fetch.

Tradeoffs

Builds skip Claude Code's permission prompts by default, because a voice session cannot answer them. A setting turns that off, but then unattended runs can hang. Anything that reaches the server can start such a process, which is why the loopback default matters. The platform lock is real: terminal control runs through AppleScript, speech recognition is Chrome's built-in API with no server-side fallback, and without a Fish Audio key it goes silent and replies only as text. Setup needs a self-signed certificate pair, two terminals, Python 3.11 and Node 18. Weather defaults to an IP geolocation lookup at a third-party service. The license forbids commercial use without a separate license.

How to use it well

It suits a solo developer on a Mac with a Claude subscription who runs several Claude Code sessions at once and wants to hear when one is blocked. Keep the default local-only bind and do not expose it on a network, since every request acts with your full authority. If your Desktop is large or cloud-synced, point the project scan at your real project folders; the scan gives up after 20 seconds. Add your own Model Context Protocol servers through its connections file, but each tool costs roughly 250 tokens of context per turn, per the README. It does not cover Linux, Windows, shared team use or commercial products.

Observed

License

Custom personal, non-commercial license; commercial use requires a separate commercial license (LICENSE)

Platform

macOS only; terminal control, screenshots and notifications go through AppleScript

Browser

Google Chrome required for its Web Speech API; no server-side transcription

Language and runtime

Python 3.11+ backend on FastAPI and uvicorn; Node.js 18+ front end

Required services

Claude Code CLI 2.1.224 or newer, logged in; Fish Audio API key, with no fallback voice

Anthropic API usage

None; ANTHROPIC_* and CLAUDE_CODE_* variables are scrubbed from spawned processes (brain.py)

Interfaces

Browser voice page, web dashboard, local HTTP and WebSocket API, stdio MCP server exposing tools to its own brain (jarvis_mcp.py)

Network default

Binds 127.0.0.1, API port 8340; Origin check or token file on mutating routes (web_auth.py)

Permission default

Skip-permissions setting defaults to true for spawned Claude Code processes (.env.example, server.py)

Tests

A tests directory with many pytest modules is present in the repository tree; pytest is in requirements.txt