HYDRA, the local-first Trust Control Plane: multi-model AI orchestration CLI

Every other tool is a hosted proxy.
We built the local-first one.

Cloud gateways route your traffic through their servers. Eval tools score answers after the fact. Local runtimes each manage only their own models. Plot the field on two axes, hosted↔local and cost-routing↔trust, and one quadrant sits empty. That is where Hydra lives. Hover any star.

Three curves that run the router.

Routing isn't vibes. Hydra rides the cost/quality Pareto frontier, stops sampling the instant confidence clears the bar, and reads the code graph to know when a change is dangerous. Here is the actual math.

You gave an agent your repo. What did it do?

Every access an agent makes is recorded in a local, hash-chained ledger. hyctl security reads that log and answers the one question you actually have, not a wall of metrics.

“4 denied, 2 flagged” and “injection → recon → escalation → an attempt on the audit trail” are the same rows read twice. Only the second one is an incident. Severity is OWASP Risk Rating (likelihood × impact), never a blended score.

hyctl security --why opens the whole programme underneath: a risk register on an SLA clock, crosswalked to OWASP LLM / NIST AI RMF / ISO 42001 / MITRE ATLAS / SOC 2 · OWASP LLM Top-10 coverage · a policy audit that finds rules which can never fire · PII exposure resolved against real heads, so a local model is not reported as a leak · control effectiveness, where a control that is configured but never applied reads as inert rather than as protection · head-binary integrity · edit blast radius.

Honest about its own limits. Framework mappings are marked curated assertions, not measurements. Defect cost is per-occurrence, not annualised. A file the dependency graph does not index is unknown, never “low-risk”. The attestation is unsigned, because Hydra has no key management and a signature without one is theatre.

The ledger records what an agent did. hyctl mcp registry scores whether the MCP server it was talking to was ever safe to trust in the first place, every existing MCP directory answers “does this exist”, none answer “is it safe to run with my credentials right now”, and star counts are actively misleading (the most-starred servers score worst on quality in independent research). audit resolves what's installed against the official registry and scores it; every trust state drops back to provisional on a version bump, the direct fix for a server that ships clean for months then turns malicious in one release.

Loud numbers. Real levers.

No tokens-processed arms race. Each of these is something you can reproduce on your own machine with hyctl stats and hyctl probe.

Others route your traffic. Hydra routes on your metal.

Cost routing and fallback are table stakes, most tools have them. The differentiators are the rows nobody else can check: local-first, confidence/trust routing, and an on-device accountability ledger.

Every row checked above ships today: hyctl dispatch --confidence, hyctl graph blast, hyctl mcp, hyctl mcp registry. The cockpit (hyctl tui) runs the work you type and renders real runs from the per-run event log, and the desktop app ships as a download for macOS, Windows and Linux on both x86-64 and ARM64 with every release, not yet code-signed, so macOS needs right-click → Open on first launch.

Prefer to watch it rather than grep it?

Everything above is the CLI. The same control plane has a desktop app that opens on a chat: ask for work, and every reply says which model answered, at which tier, and what it cost, beside a pane showing what the router knows. Models, Activity, Usage and Audit sit behind it, over the logs hyctl already writes. No account, no server, nothing leaves the machine.

macOS · Linux · Windows, attached to every GitHub release with a SHA-256 checksum. Not yet code-signed, so macOS needs right-click → Open the first time, the install script clears that for you. ARM64 builds ship for both Windows and Linux (#263). Direct downloads.

Installed to first dispatch in under a minute.