Recued

Demo | Documentation | Marketplace

Recued

Give an AI agent the key to your email or CRM, and it can do anything that key allows. Recued is a self-hosted gateway between AI agents and your accounts, and the agent never gets the key. It gets only the tools you grant it. By default, anything that writes, sends, or deletes waits for your yes. So an agent can be useful without acting behind your back. Your mail, calendar, files, and CRM records stay on a machine you control.

[A real run, shortened. An AI agent asks Recued to send an email. Recued holds it and shows you an approval card. You click Approve, and only then is the email sent.]

It works two ways. An AI agent you already use gets in over MCP, through a contract that lists exactly what it may do. Or Recued does the job itself: you ask in its chat, or a recipe runs on a schedule or when something happens. Either way, every action passes the same gate.

Recued does not replace the AI you use. Claude, ChatGPT, Codex, or a local model still does the thinking. Recued is where that thinking meets your data and your accounts, on terms you set. That is the space it holds, between you and AI.

This repo holds the complete self-hosted server and the webclient. It also holds the workspace packages they are built from.

Recued as a gateway

[Recued holds the boundary. Your accounts, the people who reach you, outside AI agents and the AI providers all meet one gate on your own machine, and so do Recued's own jobs. Contracts decide who may call which tool, writes wait for approval, and every call is logged before it runs.]

• One door per agent. You make a contract for each AI agent: Claude, Codex, OpenClaw, or your own. It lists the tools that agent may use. The agent connects over MCP with the contract's key.
• One gate for every call. The gate checks the contract first, and asks you when a call writes. It logs the call, and only then runs it. An unknown caller is refused. One switch pauses everything.
• Your yes for risky actions. By default, anything that writes, sends, or deletes waits for you. Approve one, a batch, or a whole session.
• Keys stay home. Your account keys stay on your server, or with a broker you pick. Recued's cloud never holds them. An agent gets the tools a contract grants, never the keys behind them.

Recued does jobs on its own

[Recued's chat. A quick lookup is answered from your saved records, with no AI. A question that needs AI gets the personal details swapped out and the relevant facts brought along first.]

• Ask it. Recued has its own chat: in the web app, by email, and in Slack and Telegram. It answers from your saved records first. A lookup like "What is Maya's email?" needs no AI at all. When a question does need AI, Recued swaps out the personal details and brings the relevant facts along, so the model has them before it starts. Replay Maya's questions in the demo.
• Let it run. A recipe is a job Recued runs by itself, on a schedule or when something happens. Mail about a parcel, a bill, a booking, an order, or a lead can start one. So can a new record. It calls a model only where judgment is really needed.
• Same gate. Its own jobs pass the same gate as an outside agent. By default, a step that writes or deletes still waits for your yes.

What Recued is

• One server, one owner. Each Recued server stands on its own. It stands for one person or one organization (a company, a team, a family, and so on).
• It connects to any provider and any API. It makes your command-line tools reachable too.
• Any AI agent can connect over MCP: Codex, Claude, OpenClaw and the other Claw variants, or your own.
• It keeps a local copy of your mail, contacts, and CRM records. So reads are fast.
• Before an AI sees any of your warehouse data, it tries to swap out the personal bits. Those are names, emails, organizations, phone numbers, and addresses. Safe stand-ins go in their place. This is the PII alias. It does its best, it is safe, and it can be undone. The stand-ins still show the region (city, state, country). They still show which people and sites belong to the same organization. So the model can reason over that.
• It encrypts your data at rest (while it sits on disk). The 24-word recovery key is the only way back in.
• No third party sits in the middle. Nobody takes a cut of your money. Nobody pipes your data.
• It works with any AI provider, hosted or local. You get two default slots, plus an unlimited pool of extra provider slots it rotates through.
• Every risky action can be gated. Then it runs only after you say yes.
• Free to run. No feature is locked away.

What Recued is not

• Not a coding agent.
• Not a general chat app. Its chat is for your own records and accounts.
• Not a runner for SKILL.md files. Recued cannot run them.
• Not built for open-ended questions that take many steps over a long stretch.

Install

One command. It fetches the signed binary for your platform. That is the program file, stamped so you know it is really from Recued. It checks it against the release key. It puts recued on your PATH, so you can run it from anywhere. And it sets it to start when you log in.

# Linux and macOScurl -fsSL https://recued.com/install.sh | sh

# Windows — in PowerShellirm https://recued.com/install.ps1 | iex

The installer starts the server too. So when it is done, the server is already running. To pair a browser, run recued pair. It prints a pairing code and a link to the webclient. Open the link and type in the code. If recued is not found in that terminal, open a new one.

Do not want it to start at login? Put RECUED_AUTOSTART=0 just before sh: curl -fsSL https://recued.com/install.sh | RECUED_AUTOSTART=0 sh. Put it before curl, and only curl sees it. In PowerShell, run $env:RECUED_AUTOSTART=0 on its own line first. Then start it yourself with recued serve. It prints the pairing code. The install location, the release channel, and the rest are in INSTALL.md.

A headless Linux box is one with no screen or desktop. There, starting at boot needs root, the admin account. Run the installer with sudo, and pair with sudo too. The installer prints the exact command. Here is why. Without a desktop keyring, there is only one way to seal the key file to the machine. That way reads a host key only root can read. A Linux desktop session installs a user unit and needs no root.

Extensions

• Recued Bridge — Chrome Web Store. Pair Chrome with your Recued server so recipes and AI agents can work with web pages you allow.
• Recued Kitchen — VS Code Marketplace. Author recipes, packs and compositions with local validation. Local editing needs no Recued connection; connect when you want to read and save Kitchen drafts.

Packs

A pack is a JSON file. It says how to connect to any resource: a CLI, a SaaS, a REST API, or MCP. You can set permissions for each operation. By default, every write, admin, and destructive action needs your approval by hand. Ready-made packs are free at https://recued.com/packs. You can make your own with the built-in editor, or in JSON.

SKILL.md and recipes

A skill tells a model how to approach something. The model decides each step as it runs. A recipe is the steps themselves. It is JSON, fixed before the run. The server runs it. It calls a model only where judgment is really needed.

They are not rivals. Recued offers recipes over MCP. So the skill that decides this morning is worth looking at can hand the work to a recipe. The only question is which half of a job belongs in which.

A worked example

Every Monday morning: pull the past week's rising search terms from Google Trends. Then work out whether there is anything worth selling against them.

The hard step is the first one, and it is not a lookup. Trending searches name people, teams, and events: bmw championship payout, hurricanes weather. None of those is a product. A golf tournament means gloves and rangefinders. A storm means battery lanterns. And plenty of terms warrant nothing at all. Deciding that is the one part of this job a model has to do. The rest is fetching and arithmetic: what each keyword sells, what its clicks cost, and what is left.

We ran the same job three ways, on the same data with the same model. Tokens are the small pieces of text a model counts.

_{The blind skill is a good one, not a strawman. Why its runs gave no valid answer is in the write-up.}

The best skill is not less correct. It reached the same fifteen products in the same order. But look at what it has become: a program with a natural-language wrapper. It needs its own secret keys, retries, and rate limits. It needs a place to keep the file. And it needs a way to run on Tuesday, when nobody opens a session. A recipe is that program, on a server that already has all of those.

The full write-up is in examples/. It has the recipe itself. It has the skill it is measured against, written blind. It says what is real here and what is mocked. And it tells what happened when one sentence of our own prompt was wrong.

What you can run on Recued, for your life and business

• Take bookings, appointments, big file drops, and custom intake forms through a public reception page.
• Answer questions about your products with AI. The answers stay grounded in the knowledge and Q&A you import.
• Sell through Stripe.
• Charge by subscription or by use for the MCP tools you publish.
• Charge by subscription or by use for the knowledge you serve through the LLM gateway.
• Prototype fast. Turn an idea into a working app.
• Extend Recued about as far as you like. Write your own packs and recipes, or install free ones from the Recued Marketplace.

Examples, concretely

I built some real business apps to show what Recued can do:

• Ledger Book: accounting, double entry, budgets, and records.
• Fleet Money: assigned jobs and worker payments, from offer through settlement.
• Queue Desk: a take-a-number line. A visitor picks a service type on your public reception form. They get a number and a link that shows how many people are still ahead. Staff call the next person from any paired device.
• DeepTutor Records: a subscription business in education and tutoring. It keeps students, assessments, answers, artifacts, and scorecards. It comes with nine ready-to-run workflows that enrol students, send assessments, capture answers, and grade them. It needs the DeepTutor pack to make questions. It runs on your own machine. Actions that change data use Recued's approval controls. DeepTutor is an open source project by HKUDS.
• Rental Book: property, landlord, ledger, and records.
• Federated Projects: project management, federation, records, and work entities. It shows a few Recued servers joining up to work together, through Federated Project Peer.
• Social Publishing: scheduling posts to Mastodon, X, Facebook, and Bluesky.

Documentation

https://recued.com/docs covers how to install, pair, and connect. It also covers writing recipes and packs, publishing, AI chat and MCP, and the schema reference.

In this repo:

• INSTALL.md: how to install a release, its options, and how to build from a clone
• ARCHITECTURE.md: how the code is laid out
• CONTRIBUTING.md: build, test, and pull requests

Run from source

On Linux and macOS:

npm cinpm run buildnpm run build:servernpm run build:webclientRECUED_WEBCLIENT_DIR="$PWD/apps/webclient/build" npm start

On Windows, in PowerShell:

npm.cmd cinpm.cmd run buildnpm.cmd run build:servernpm.cmd run build:webclient$env:RECUED_WEBCLIENT_DIR = "$PWD\apps\webclient\build"npm.cmd start

Type npm.cmd, not npm. By default, PowerShell blocks the script a plain npm runs. npm.cmd is the same npm, without that script.

The server listens on port 7717. Open http://localhost:7717/webclient/. You can also use the stable static webclient at https://app.recued.com/.

Full detail, including what each platform needs first, is in INSTALL.md.

What is in here

• backend/server/: the self-hosted Recued server and CLI
• apps/webclient/: the local webclient
• packages/: the workspace modules those two are built from
• community/: the Day-1 foundation packs and their recipes, as a worked example for the authoring guides

The root package.json, the lockfile, and the TypeScript build graph are generated by a tool, not by hand. They cover exactly the set of packages this repo depends on. The browser bridge, the cloud services, the marketplace, and Recued's own in-house tools are separate things. They are not part of this repo.

The source code is a filtered copy of one reviewed checkpoint of the Recued source tree. That checkpoint is a git commit. The file .recued-public-export.json records which one, what was left out, and why. This README, the install guide, the changelog, and the contributor notes are kept here directly.

License

Recued is licensed under the GNU Affero General Public License, version 3 only (AGPL-3.0-only).