为什么值得关注

它从设计上实现了隐私优先：管理员无法读取访客聊天记录，面向访客的 AI 零工具，同时提供可扩展的记忆钩子和可替换的 LLM 适配器。

适合谁使用

构建自托管 AI 人格服务的开发者
注重隐私、希望访客交互不留日志的创作者
探索临时性 AI 对话的爱好者
原型设计面向访客的 AI 功能的产品经理

典型使用场景

让朋友通过一次性链接与自定义 AI 人格聊天，而主人看不到对话内容
提供私密、一次性的 AI 交互用于反馈或访谈
托管一个 AI 驱动的访客留言簿，向主人汇总访问摘要
在无工具滥用风险下沙箱测试或展示 AI 人格

项目优势

隐私优先：管理员看不到原始对话；访客用 AI 没有工具且记忆默认关闭
自包含的后端模块，API 清晰，提供记忆钩子，易于集成到现有 Express 应用
LLM 适配器可插拔，支持任何模型或 API，不限于 Claude CLI
文档完善，附带最小示例和自动化测试覆盖核心流程

使用前须知

不包含正式前端；管理 UI 和访客页面需要用户自行构建
默认 LLM 适配器要求宿主机安装并认证 claude CLI
采用 CC BY 4.0 许可，复用或修改时必须署名

README 快速开始

Atrio

A small, self-hosted guest lounge for your AI persona — friends chat with your AI through one-time links, and you only ever see the AI-written visit summary. 一个小而干净、可自托管的 AI 人格「会客厅」——朋友凭一次性链接和你的 AI 聊天，你只看得到 AI 写的到访摘要。

Atrio is Italian/Spanish for "atrium, entrance hall" — the first room a guest steps into. （atrio 是意大利语/西语的「中庭、门厅」——客人进屋先到的地方。）

English · 中文

English

A small, self-hosted guest lounge for your AI persona.

Give a friend a one-time link. They open it and chat with your AI. When the visit ends, the AI writes you a short note about how it went — and that note is all you ever see. You never read the raw conversation.

It ships as a backend module (registerGuestRoutes(app, options)) plus a small runnable example host. There is no real UI — only a deliberately unstyled reference page to prove the wiring works. Bring your own front end.

Privacy by design

This is the whole point of the project, so it comes first.

The admin side cannot read guest conversations. There is no "view log" endpoint. When a session ends, the persona writes a one-line summary; the management routes only ever return that summary plus non-content metadata (name, timestamps, message counts). The raw transcript never leaves the visitor's own token-scoped view.
The guest-facing AI has zero tools. The default LLM adapter runs claude -p in an isolated temp directory with --strict-mcp-config (no MCP), --permission-mode default (no approver ⇒ any tool call is auto-denied), and every built-in tool explicitly disallowed. A guest cannot make the AI touch your filesystem, your network, or your MCP servers.
Memory injection is OFF by default. The recall and memorize hooks are just seams. Out of the box, no memory is pulled in and nothing is written out. If you wire your own memory system in, you decide exactly what crosses the line.

Architecture

                 ┌─────────────────────────────────────────────┐
   admin  ─────▶ │  ADMIN routes (behind your adminAuth)        │
 (your UI)       │   POST /api/guest/create                     │
                 │   GET  /api/guest/list   ← summary only      │──▶  store.js
                 │   DELETE /api/guest/:id                      │   (atomic write +
                 └────────────────────────────────────

项目描述

A small self-hosted guest lounge for your AI persona — friends chat via one-time links; you only ever see the AI-written visit summary. CC BY 4.0.

atrio