A Cloudflare-native agent that runs on the $5 tier. The current checkpoint is a grounded database librarian you can deploy in one click, and never watch hallucinate your schema.
Cato is a personal operations agent built entirely on Cloudflare's edge. A Durable Object holds state, a ReAct loop does the work, and the whole thing is sized to run on the free or $5 plan. It reads its source of truth on every turn and refuses to make things up. The evolution below is real: each version earns the next.
The working system today. Durable-Object orchestrator, skill-first execution, approval tiers, and a local node federation. Multi-channel: Telegram, email, web.
A ground-up rebuild. The first slice is a deployable database librarian: read, write, and govern a SQLite schema with an audit trail and an approval gate.
The feature-rich agent this is building toward. The functionality of a full assistant, at a fraction of the cost to operate.
A server-side SQL classifier sorts every action into a tier before it runs. Reads are free. Writes are logged. Anything that could reshape the database waits for a human.
Runs immediately. Questions about the data never need a gate.
Runs, and lands in an append-only audit log. Every change is accountable.
Queued, not run. The agent proposes; the admin approves in Telegram, or it expires.
Calling something a deployable template is a promise that a stranger can run it safely. So the code went out for independent engineering review before the repo was opened, and the first audit found three release-blocking gaps at the exact boundaries this project presents as its security model. All three are fixed, each with a test that pins the behavior. A second senior review followed, and its confirmed findings are fixed too.
An admin webhook a stranger could forge. A read-only tier that a crafted statement could still mutate through. An approved schema change that could be recorded as done without having run.
Webhook verification that fails closed when it is unconfigured. A classifier that reads the top-level verb, sees through a common-table expression, and refuses multi-statement SQL outright. A cursor consumed before any approval is granted.
77 tests run inside workerd against real Durable Object SQLite, not a mock. Continuous integration runs the whole suite on every push, and the badge on the repo is that result, live.
The repo is a base template. Everything except your domain is generic infrastructure. You edit the agent's identity prompt and your table definitions. That is the whole job.
Tell the agent what it is working with: your tables, your identifier formats, what it must never touch.
Add your tables and their comments. Those comments become the agent's ground truth on every call.
Cato reads a generated schema manifest on every invocation. If an answer is not in the source, it says so instead of guessing.
Admin endpoints are fail-closed behind a bearer token. An unconfigured deployment exposes only a health check.
A model registry lives in the database. One Telegram command changes the active LLM, with automatic fallback.