A real agent loop
Streaming, native tool calling, automatic context compaction when the window fills, and append-only JSONL history under ~/.rex/sessions/.
Capabilities · v0.3.6
Plans it. Does it. Proves it.
Most agents stop at writing code. REX runs the whole loop — understand the codebase, plan the change, make it, run the check that proves it holds — and hands you the controls at every step that matters.
Edit, review, approve
Writes are atomic and arrive as a diff you can edit before approving. Conflict detection catches files that changed underneath; every write drops a checkpoint.
Secrets stay sealed
Keys are encrypted with the platform credential store — DPAPI on Windows — rather than dropped in a dotfile. Environment variables still work as a fallback.
A browser it drives
A real browser view composited into the window: navigate, read the accessibility tree, click by reference, type, evaluate and screenshot.
Desktop control
Native backends per OS — Win32/PowerShell, AppleScript, xdotool/ydotool/AT-SPI2. Never auto-allowed: every action asks, every time.
Memory that lasts
A REX.md at the project root is read into every session, so what you explain once outlives the restart and the model switch.
42 tools
Grouped by what they can cost you.
Reads run freely. Writes show a diff. Anything that touches your machine, your screen or the network asks first.
Files and search
free to runreadfiles into context
globmatch by pattern
grepbundled ripgrep
codebase_searchsemantic lookup
update_planvisible task list
ask_userask instead of guess
Writes
diff first, then approvewriteatomic create
editeditable diff
gitscoped subcommands
create_artifactbuild a document
update_artifactrevise it
memory_writepersist a fact
memory_readrecall it later
memory_deleteforget it
Execution
denylist checked before any ruleshellrun a command
check_processpoll a background job
send_inputfeed a running process
kill_processstop it
skillrun a packaged workflow
Network
SSRF guard on every fetchweb_fetchread a page
web_searchsearch the web
http_requestany verb, any header
Browser
a real view you can watchbrowser_startlaunch it
browser_navigatego somewhere
browser_snapshotread the a11y tree
browser_clickclick by ref
browser_typefill a field
browser_screenshotcapture it
browser_evalrun JS in page
browser_closeshut it down
Desktop control
never auto-alloweddesktop_screenshotsee the screen
desktop_clickclick a point
desktop_typetype text
desktop_keysend a shortcut
desktop_windowslist windows
desktop_focus_windowbring to front
desktop_ui_treeread UI automation
desktop_click_elementclick by name
Security analysis
4 tools · off until enabled for your accountFor authorised engagements only. These stay disabled on every account and every plan until they're switched on for that specific person — the agent enforces it itself, from a claim in the signed session token.
Architecture
A monorepo you can read.
Layout
apps/desktop Electron: main/ (host), src/ (renderer)
packages/
shared-types cross-package contracts
agent-core loop, sessions, context
model-adapters provider catalog + adapters
tools all 42 tool executors
permission-gate rule engine + denylist
scripts build / dev / packaging
Design
The renderer holds nothing
The React renderer keeps no secrets and executes nothing. It sends intents over IPC and renders what streams back — so a compromised page has nothing worth stealing.
Packaged for three OSes
NSIS and portable builds for Windows, a hand-assembled .deb that builds even from a Windows host, a distro-agnostic tarball, and macOS targets wired up.