Wirken: Open-source AI agent gateway

Wirken is an open-source gateway that sits between messaging apps and AI agents; it assumes any agent can be turned against its owner and limits what a compromised one can reach.

Take an agent that reads your chats and email, holds the keys to your accounts and can run commands.

Setting the sandbox mode to off lets commands run with no container, and the gateway warns at startup.

Outbound traffic is only partly contained: MCP server child processes and the LLM client make their own outbound connections.

The tamper check depends on a key kept off the machine, and an attacker running as the same user who rewrites both the log and the key can evade it.

One hidden instruction in a message or a shared document could talk it into leaking a secret or rewriting files, and shell commands run in an ephemeral container with no network access, and if the sandbox is unavailable, execution is refused.

Wirken connects Signal, WhatsApp, Telegram, Matrix, Discord, Slack, Teams, Google Chat and iMessage, plus a web chat, and runs each channel as a separate process that holds only its credentials.

Credentials sit in an encrypted vault and are supplied at the edge, so neither the agent nor the model handles them.

Sample output shows 1234 rows across 7 sessions and 24 verified chain-head signatures, which demonstrates the check running and says nothing about any deployment.

Removing the data directory destroys the audit log, so the project recommends exporting it first.

The installer is a shell script for Linux and macOS with a published hash to check before piping it to a shell, while Windows 11 has a separate path and a different feature set.