Open-source ENZO self-hosts 300+ AI models with bring-your-own-key agents

What launched

A developer posting as theguysudo has open-sourced ENZO, a self-hosted AI workspace that reached the Hacker News front page through a Show HN post. According to the project's GitHub README, the platform gives you a single chat interface to more than 300 models across nine providers — OpenRouter, Google AI Studio, NVIDIA NIM, Groq, Hugging Face, Cloudflare and Gemini are among those listed — and layers agent-building, research and code-generation tools on top.

The core design decision is bring-your-own-key. When you send a message, the request travels from your browser through ENZO to whichever provider you picked, and you pay that provider its normal price. The README stresses that there is no ENZO account, no usage metering and no subscription, because nothing sits in between taking a cut.

One workspace, several surfaces

Installation is deliberately minimal: clone the repository, run docker compose up -d, and open the app on localhost. The README claims no accounts, no mandatory environment variables and no separate database server are required.

The app is organised around several surfaces. A Terminal offers streaming chat in normal, thinking, research and coding modes, with a live health trace that flags when the model catalog is unreachable. A marketplace view unifies the catalog across all providers and shows download counts, licences and benchmarks. A code-generation surface writes a project, boots it, previews it live and reports when it breaks. A research mode runs a loop that writes its own queries, reads what it finds, and decides when to stop — under hard budgets so it cannot drain your key. There is also a keyless music player and a Vault for managing keys.

Self-drafting agents

The agent builder works in two passes, per the README. An analysis pass reads the domain of a plain-English task and derives the tacit knowledge, decision heuristics and edge cases an operating manual should cover; a drafting pass then writes that manual. When a draft needs a model, roughly ten free candidates fire simultaneously and the first to answer wins, with stragglers aborted and a scoreboard reordering future races — a hedge against dead or rate-limited free tiers. Agents record which model actually drafted them, and a per-agent neural layer continues folding in domain-matched activity every 90 seconds.

Seventy-four domain skills ship bundled, and the codebase is described as roughly 44,000 lines of strict TypeScript spanning five releases, v1.0.0 through v1.4.0.

Security claims and one caveat

The project documents a written threat model in its security file. Provider keys are sealed in the browser with AES-256-GCM under a non-extractable WebCrypto key, and an optional passphrase mode re-seals everything with PBKDF2 at 600,000 iterations. The CI checks are unusual for a solo project: a pipeline stage scans the frontend for raw localStorage key reads and fails the build on a hit, and every push triggers a 44-assertion black-box pentest covering auth bypass, IDOR, hostile payloads and stream integrity, plus a proof that the server boots with zero provider keys present.

One trade-off is stated openly. On a fresh self-hosted instance, the first validated key you paste claims the instance and is written to the container environment so server-side features such as scheduled agents unlock and survive restarts. Pre-seeding a provider key in the compose environment is the offered alternative for anyone who dislikes that claim window.

Hosted demo and Colab option

Beyond self-hosting, the project points to a hosted instance running the same code, and publishes a Google Colab notebook that clones, installs, builds and boots the app, then hands back a browser URL plus a Cloudflare tunnel link that works from other devices. The notebook arms a keep-alive against Colab's roughly 90-minute idle timer and a watchdog that restarts the server if it dies, within free Colab's cap of about 12 hours per session. Keys pasted there stay yours, and everything on the VM disappears when the session ends.

Why it matters

Most hosted AI workspaces meter usage, hold your keys on their servers, or gate features behind subscriptions, while many self-hosted alternatives demand multi-service setups. ENZO's pitch — one unified catalog, one install command, keys that in hosted mode never reach the server — is a coherent counter-proposition for developers who want agent tooling on their own infrastructure. The CI-enforced pentest and written threat model are also more concrete than most open-source projects bother with. The usual caution applies: every figure and security claim here comes from the project's own README, and anyone self-hosting should read that threat model, especially the instance-claiming behaviour, before pasting production keys.