The Finn: an LLM agent that lives inside a router and comments on what it can see

A grumpy agent that lives in a router

A project that reached the Hacker News front page, The Finn, puts a small language-model agent inside an ordinary Wi-Fi router and gives it exactly one job: observe its corner of the network and occasionally complain about it.

According to the project's GitHub repository, by YuriKovalov22, the agent runs entirely on the router itself — a GL.iNet GL-MT3000 on an office wall, running OpenWrt 21.02 with 512 MB of RAM. It takes its name from a character in William Gibson's Sprawl trilogy who survives as a construct sealed inside a box that people visit to hear the oracle grumble. The software homage has no tools, no memory beyond a state file, and no access to mail, calendars or ticketing systems. Its whole world is one hallway and the traffic that passes through it.

Its only output channel is Telegram. It speaks through a bot token paired to a single user ID, and it stays quiet for the first fifteen minutes after installation while it learns what normal looks like for that particular room.

How it decides to speak

The part worth studying, per the repository, is that there is no hand-written list of interesting events. Once a minute the device takes a broad reading of itself and its surroundings, keeps a rolling history of every reading in RAM, and flags whatever has fallen outside its own recent range. Two classes of oddity are detected generically: numeric sensors leaving the band they held over the previous 45 minutes by more than a per-sensor floor, and membership changes — something appearing in or vanishing from a set, such as a device, an upstream neighbour, or an unusual destination port.

Left alone, such a system would talk about traffic almost constantly, because counters are the most volatile things on any network. The Finn therefore rations remarks by kind, capping traffic commentary at one remark per six hours and preferring whichever category has waited longest. A second axis, theme, silences a just-used subject for ninety minutes, and a third, shape, stops it repeating one sentence pattern — six remarks of the form "X is N now, usually M" — by varying whether a remark describes something rising, quieting, arriving, departing or simply a long stretch of nothing. Churn that merely repeats from yesterday does not qualify; only genuinely new things count. Even quiet itself is an observation: after hours with no anomalies, the model is handed that fact rather than being left mute.

Only at that point is a model invoked — Anthropic or OpenAI, both are wired up — and it is prompted to respond as a resident rather than a monitoring system, with permission to reply NOTHING if the input amounts to dull bookkeeping. A failed API call is not treated as a decision to stay silent.

What it can feel

The sensor list reads like a router's nervous system. It covers associated Wi-Fi clients and signal strength via iwinfo, hostnames from DHCP leases (so MAC rotation does not break tracking), per-device activity from conntrack flow churn, upstream neighbour tables, VPN peers through wg show, its own temperature, load, memory and uptime, and failed SSH logins pulled from logread.

The repository also includes an honest warning about per-device throughput: on routers with hardware NAT offload, including this one, established flows are handled in silicon and the conntrack byte counters stop growing, which can yield impossible numbers that an agent would faithfully narrate. Each tick therefore checks the parts against the whole and publishes nothing rather than something wrong.

Setup and cost

Installation takes about ten minutes and requires an OpenWrt router with lua, lua-c and a TLS-capable curl, a Telegram bot, and an LLM API key. The README recommends a dedicated key with a low monthly limit, since the key sits in plaintext on a device sharing a network with other people, and estimates single-digit dollar costs per month at default settings. The installer copies two files, writes the environment file with mode 0600, and adds a per-minute cron entry.

Why it matters

The Finn is a working demonstration of an LLM agent with a deliberately tiny perimeter. Everything runs on the device, so if the rest of the infrastructure is on fire, it keeps working — which the author says was the main goal. Beyond the novelty of a Gibson construct on office hardware, it sketches a reusable pattern for agent design: generic anomaly detection over rolling baselines, explicit rationing so the loudest sensor does not dominate, and a model used only as a voice, with the option to say nothing at all. In a field crowded with assistants holding tools and long memories, an agent restricted to what its own box can observe is a useful counter-example.