Every agent. Every repo.
None of it leaves your infrastructure.

Local first

Nothing leaves your Mac.

There is no Manifold account, because there is no server we operate.

   your Mac
   ┌─────────────────────────────┐
   │  Manifold                   │
   │    agent terminals          │ ──→  the model provider
   │    git worktrees            │      you already pay for
   │    ~/.manifold/  (SQLite)   │
   └─────────────────────────────┘

   nothing in between: no vendor, no proxy, no account

Your repositories, your worktrees, your session history and your captured memory live in ~/.manifold on your own disk. Prompts go straight from your machine to the provider you already pay for. Nothing is proxied, stored, or replayed by us.

• Sessions run on your machine, not in someone else's sandbox.
• Session history in local SQLite, per project, under ~/.manifold.
• AI-assisted features are off by default and use your own key.
• MIT licensed, so you can read the source and check.

Fidelity

A real terminal. Not a transcript of one.

Manifold runs the agent's actual CLI in a real PTY.

You see the live stream, ANSI and all. You can type into a running agent while it works, to correct it, answer it, or redirect it, without restarting the session.

When an agent goes wrong at step nine of twelve, you steer it. You don't start over.

Isolation

Four agents. Four branches. One repo.

Every agent gets its own git worktree on its own branch, so they never collide.

manifold  (main)
   │
   ├── worktree  manifold/fix-login-bug      ● running
   ├── worktree  manifold/add-rate-limit     ● waiting
   ├── worktree  manifold/refactor-search    ● done
   └── worktree  manifold/upgrade-deps       ● error

Branches are named <repo>/<task-slug> automatically. Start an agent on a fresh worktree branch, directly on the current branch when you don't want one, on an existing branch to continue work, or on an open pull request.

Automated loop

Agents that grade their own work.

Set a command that scores your codebase and let an agent grind against it.

1. 1 prompt the agent
2. 2 run your evaluation command
3. 3 extract a score exit code · regex · JSON field · LLM judge
4. 4 improved? commit · regressed? revert
5. 5 repeat

Every iteration that improves the score gets committed. Every iteration that makes things worse is thrown away. Per-iteration time limits, logs under ~/.manifold/loop-logs/, and Restore Best to jump back to the best commit at any point.

Runtimes

Every agent. Including the ones that work offline.

Manifold checks for the runtime binaries on your PATH and runs them as-is.

• Claude Code claude
• Codex codex
• Copilot copilot
• Gemini CLI gemini
• Claude Code (Ollama) ollama launch claude no network
• Codex (Ollama) ollama launch codex no network

Point Claude Code or Codex at a local Ollama model and the loop closes completely: your code, your machine, your inference. No API key. No network.

Workspaces

One agent. Many repositories.

Group several repos into one working set and let a single agent see all of them.

workspace  checkout-revamp
   ├── backend      worktree → manifold/checkout-revamp
   ├── frontend     worktree → manifold/checkout-revamp
   └── infra        worktree → manifold/checkout-revamp

   one agent · one branch name · every repo

The first repository is the agent's working directory; the rest are mounted through the runtime's own multi-directory flag: --add-dir for Claude, Codex and Copilot, --include-directories for Gemini. Worktrees are created across every repo in the set when the session starts and removed when it ends.

No orchestration layer. No per-tool approval step. The agent just has all of it.

Opt in under Settings → General → Enable Workspaces.

Search & memory

It remembers.

Search code, file names, or everything the agent has ever noted, across every project.

modes    code · files · memory · everything
scopes   this session · this project · every project
match    literal · regex
saved    per project, with recent history
ask ai   answer from the results, or re-rank them (optional)

Manifold captures what happened into per-project SQLite: prompts, responses, observations the agent noted, and session summaries. Resume a stopped session weeks later and the agent gets its history back.

Plugins

Extend it with your own tooling.

Manifold's own features are plugins. The automated Loop is one of them, so the extension model is the one we build on ourselves.

• Loop manifold.loop Edit → evaluate → keep or discard.
• Worktrees manifold.worktrees Every managed worktree, in one view.
• Watch manifold.watch Hand the agent a video: frames, transcript, report.

Your own plugins load from ~/.manifold/plugins. Each one runs in a sandboxed host process, not in the app's main process and not in the UI, and declares the capabilities it needs in its manifest. The host enforces that list. An unrecognised capability rejects the whole manifest rather than being quietly ignored, so a typo can't widen a plugin's reach.

  manifest     declares capabilities   storage · workspace:read · configuration
  host         forks a sandboxed process, brokers every call
  gate         unknown capability → whole manifest rejected
  privileged   agent:control · agent:spawn · lm · workspace:manage
               built-in only, whatever a manifest claims

Plugin ids can't contain a path separator, per-plugin storage is escape-guarded, and plugin webviews are served over their own scheme under a nonce CSP. There is also a VS Code compatibility shim, so a subset of existing extensions runs unmodified: commands, activation events and tree views.

Manifold Server Beta

Issues in. Pull requests out.

Label a GitHub issue and a server you run works it to a pull request, with nobody watching the terminal.

Not released yet. Manifold Server is in beta and isn't published. You can't download or run it today, and there is no date. The desktop app above is the shipping product and never depends on it. This is here so you know where Manifold is going.

  issue labelled    manifold
        │
  claimed           manifold-working    a label swap, so two
        │                                 runners never collide
  sandboxed         clone → branch manifold/issue-<n>
        │
  agent runs        unattended, with a time limit
        │
  verify            your command: compile, unit, contract
        │
  pull request      "Closes #<n>"  ·  manifold-done
        │
        └── failed, or changed nothing → needs-human + why

A run that fails, or that changes nothing, escalates with a comment explaining why. It doesn't open a speculative pull request.

The verify command is yours, and it runs offline in the same locked-down sandbox as the agent, so a green result means compile-and-unit sound rather than integration-proven. A non-zero exit blocks the pull request rather than shipping something broken.

Humans stay the merge gate. The server opens pull requests; your CI and branch protection decide what lands.

Concurrency is capped, because concurrency is spend. Each agent invocation has a time limit. Commits land under the bot's own identity, and the repo-controlled verify command runs with the git credentials stripped from its environment.

On a laptop, an agent runs with your reach. In a pod, the namespace is the sandbox.

That is the real reason the server exists. It runs the agent as a container in Kubernetes, so confinement is enforced by your cluster, using the controls you already run every other workload under: service account, security context, resource limits, network policy. The agent gets a per-issue clone instead of a developer's whole disk. The security page covers both boundaries.

Want it? Start a thread in Discussions, or reach out on LinkedIn.

For engineering organisations

Full autonomy. No vendor in your critical path.

The questions a security review actually asks, answered by how Manifold is built rather than by a policy document.

Where does our source code go?

Onto your developers' machines and, if you run the server, into your own cluster. Prompts go from there to whichever model provider you already have a contract with. There is no Manifold-operated service in the path, so there is nothing of ours to review, breach, or subpoena.

Which region is it hosted in?

Yours. You choose, because you deploy. Nothing is pinned to a region we picked.

What does it cost per engineer?

Nothing. There is no per-seat licence and no paid tier, so the line item doesn't grow with headcount. At two hundred engineers, a per-seat agent tool is a six-figure annual commitment. This is zero. You pay your model provider for inference, as you already do.

Can we audit it?

The desktop app is MIT licensed. Clone it and read every line. Legal gets a permissive licence, and security gets the source.

Who approves what an agent writes?

You do. Agents work on isolated branches and open pull requests. Your CI and branch protection decide what lands, the same gate as any engineer.

Does it fit our stack?

Bring your own model credentials, or run entirely on local models. Extend the workspace with your own plugins. Point it at as many repositories as you like.

The receipt

What you don't get.

• No per-seat licence.
• No account to create.
• No Pro tier, no upgrade path, no upsell.
• No service of ours in the middle.
• No telemetry.
• No lock-in. It's your git, your branches, your infrastructure.

Free under the MIT licence, at any headcount. 168 releases since March. Fork it if we get it wrong.

Themes

Ten themes ship with the app. This page uses them too.

• Manifold Dark Manifold Light
• Garfield Dark Garfield Light
• Neon Dark Neon Light
• Jade Dark Jade Light
• Platinum Dark Platinum Light

Get started

Three steps and a repo.

1. 1 Download the .dmg and drag Manifold to Applications
2. 2 Make sure one agent CLI is on your PATH
3. 3 Open a repo. Start an agent.

$ claude --version     # or codex / gemini / copilot
$ git --version
$ gh --version         # optional, for opening PRs in-app