A local-first, security-first voice assistant for Linux. Say "Vega", speak naturally, and it performs real actions on your machine and accounts — launching apps, controlling the system, managing Google Calendar and Gmail, setting reminders, searching the web, and remembering things about you — without surrendering control or privacy.
Most assistants ask you to trust a model with your machine. Vega does not. Its
defining design principle is a hard separation between cognition and
action (see docs/CONSTITUTION.md):
- 🧠 The model can only propose, never act. The LLM emits a structured list of tool calls — never shell, code, or free-form actions. Its prose is never executed.
- 🛡️ One deterministic gate authorizes everything. A Validator (plain, auditable Python the model can't influence) checks every call: the tool exists, parameters match a typed schema, the capability is granted, and destructive actions are confirmed. There is no bypass path.
- 🚫 Default-deny. Nothing is permitted unless you granted it. A jailbroken or prompt-injected model still can't delete your calendar, email your contacts, or widen its own permissions — there isn't even a tool that grants capabilities.
- 🏠 Local-first. Wake word, speech-to-text, text-to-speech, and the default LLM all run on your machine. Audio never leaves by default.
- 📜 Everything is audited. Every utterance, plan, validation result, and action is written to a local JSONL log (with secrets and raw content redacted).
Read the threat model for concrete attacker scenarios (jailbroken model, malicious-email injection, local attacker, stolen token) and the tests that prove each defense.
⚠️ Cloud LLMs are a deliberate, confirmed opt-in. On-device privacy holds only with the local Ollama provider. Enabling a cloud provider sends your utterances and the email/web/memory text fed back to the planner off-device — so it requires an explicit warning + confirmation (a two-flag opt-in), never a quiet toggle.
One command. Requires Python 3.11+ on Linux.
curl -fsSL https://vega-project.org/install.sh | shThat's it. The bootstrap installer (bootstrap.sh) handles everything technical,
asking for your password at most once (to install system libraries):
- installs the system libs Vega needs — PortAudio, libsndfile, ffmpeg — via your package manager (apt / dnf / pacman, auto-detected);
- installs Vega per-user with pipx, with all extras (
audio,google,tui) baked in; - installs Ollama and pulls the default local model (it offers first);
- pre-downloads the stock wake-word model;
- registers the systemd user service;
- launches
vega setupso you can grant capabilities.
It refuses to run as root, is safe to re-run, and never grants a
capability or enables a cloud LLM on its own — you choose those in vega setup.
Two things still need you (they can't be automated):
- Google sign-in — run
vega google loginfor the browser consent screen (only if you want Calendar/Gmail). - Custom "Vega" wake word — the stock model is non-commercial and isn't the word "Vega"; training your own is a manual step.
Manual / power-user install (from a checkout, no bootstrap)
git clone https://github.com/vega-project/vega
cd vega
./install.sh # per-user (never root); registers the user service
# or install the package directly:
pipx install '.[audio,google,tui]' # isolated; all features
pip install --user '.[tui]' # minimalYou must install the system libraries yourself (sudo apt install libportaudio2 libsndfile1 ffmpeg, or the dnf/pacman equivalents) and Ollama
(https://ollama.com) for the local LLM.
Optional extras (install only what you need):
| Extra | Adds | System deps |
|---|---|---|
tui |
the vega setup terminal wizard (Rich + questionary) |
— |
audio |
mic capture, wake word, VAD, STT, TTS | PortAudio, libsndfile, ffmpeg |
google |
Google Calendar + Gmail | — |
The assistant core installs and runs without any extra; extras are additive.
The ollama client is a core dependency, so the local LLM works out of the box.
vega setup # choose provider, grant capabilities, link Google, pick wake model
vega grants # see exactly what is permitted (default-deny)
vegad # run the daemon in the foreground to try it
# or run it as a managed background service:
systemctl --user enable --now vega.serviceThen say "Vega", wait for the chime, and speak. See the full User Guide for granting capabilities, daily use, reminders/memory, and proactivity.
The shipped default uses a stock wake model (hey_jarvis) for development
only — it is non-commercial and is not the word "Vega". Train your own "Vega"
model and point [audio.wake].model_path at it (or via vega setup). See
docs/wake_word_training.md.
docs/CONSTITUTION.md— immutable charter & non-negotiablesdocs/THREAT_MODEL.md— assets, trust boundaries, attacker scenariosdocs/ARCHITECTURE.md— components, state machine, data flowdocs/USER_GUIDE.md— install → setup → daily usedocs/SKILL_AUTHORING.md— add a new capability-gated toolSECURITY.md— reporting vulnerabilities + the on-device/cloud boundarydocs/decisions/— architecture decision records (ADRs)
GPL-3.0-or-later — see LICENSE and
docs/decisions/ADR-0002-license.md.