Skip to content
tenon

Code with AI. Keep your data in Europe.

tenon is an open-source coding agent for the terminal. It reads your project, proposes changes and runs commands, with European or local models. Every action waits for your approval, and every step goes into a verifiable audit log.

brew install tenon-code-eu/tap/tenon

The script checks the SHA-256 hash, and the minisign signature when minisign is installed. Read the script

  • licenceEUPL-1.2
  • Go1.26
  • Linux · macOS
  • Releases signed with minisign
  • CycloneDX SBOM
  • Built in Europe
00

The tenon harness

Eighteen components, one rule: nothing leaves without going through your permissions, your masking and your log.

Click a component · drag to orbit
  1. Tools — Read, write, search, run a command: every tool stays anchored to the project root.
  2. System sandbox — Shell commands and stdio MCP servers confined by the OS (Landlock, sandbox-exec): writes only in the project, network closed unless you allow it.
  3. Permissions — Writes, commands and MCP calls wait for your approval. A repository cannot loosen anything.
  4. Engine — The agent loop: read, propose, run, turn after turn, every event sent to the log.
  5. Masking — Secrets and some personal data masked before the request leaves the machine.
  6. Sensitivity routing — Paths and markers such as EU RESTRICTED make the session sensitive: from then on it goes only to the local model, and every decision is logged.
  7. Profile · allowlist — eu-only, secnumcloud and strict-local profiles and a provider host allowlist, checked at startup and before each send.
  8. Providers — Mistral AI, Codestral, Scaleway, OVHcloud, Albert API, or local with Ollama and vLLM. Outside the EU: your consent.
  9. Audit log — Each line seals the previous one by hash. tenon audit verify proves it, RFC 3161 timestamps date it.
  10. RFC 3161 timestamp — Only the head hash of the log goes to a timestamp authority: a log rewritten afterwards is detected.
  11. Compliance export — tenon audit export: an HTML and JSON report for your DPO, built from the log, with no conversation content.
  12. Skills — SKILL.md files in the Agent Skills format, loaded on demand, unable to widen permissions.
  13. Sub-agents — Tasks handed to other agents, with the same permissions, masking and audit.
  14. Hooks — Your commands before and after tools: block, ask, add context. A repository's hooks never run.
  15. MCP — stdio or http servers with a declared jurisdiction, filtered by profile and policy.
  16. Checkpoints — Every prompt is a restore point: /rewind brings back the files, the conversation, or both.
  17. CRA assistant — tenon cra: SBOM, VEX, reporting deadlines and the Cyber Resilience Act technical dossier, with an offline OSV scan.
  18. Organisation policy — A floor signed with minisign, verified at every startup, that nobody can loosen.

The journey of a request

The harness from the inside: one request drives the agent loop, and every step lands live in the audit log, with tenon's real events.

The tenon harness from the inside: one request is about to drive the agent loop.

  1. You type your request in the terminal.
  2. Your hooks can add context or block the request.
  3. The engine builds the context and loads the right skill, unable to widen its rights.
  4. Before every model call: secrets masked, then routing. Classified content: local model only.
  5. Iteration 1: the model asks to read main_test.go. A read inside the project is allowed by default.
  6. The result goes back to the engine, which calls the model again: this is the loop.
  7. Iteration 2: the model wants to edit main.go. A write: tenon asks for your approval.
  8. A checkpoint copies the file before the write: /rewind can undo it.
  9. Iteration 3: a shell command. Approval, then the system sandbox closes around it.
  10. Confined: writes in the project only, ~/.ssh unreadable, network closed. Result: ok.
  11. Iteration 4: the model answers, the turn ends. The answer reaches your terminal.
  12. Every event is sealed, timestampable and exportable for your DPO.

Where your data goes

Before each send, tenon masks secrets and applies your rules. The destination depends on your configuration, and it is written to the audit log.

  1. Your project code, files, commands
  2. tenon
    • Secrets and personal data masked
    • Writes, commands and MCP calls wait for you
    • Hash-chained log, timestampable (RFC 3161)
    • Classified content: local model only
  3. On your machine Ollama · vLLM
    European providers Mistral AI · Codestral · Scaleway · OVHcloud · Albert API
    Outside the EU only with your explicit consent

Evidence for the audit, not promises

tenon does not make a system compliant on its own. It produces the records your compliance team and DPO ask for.

tenon audit export --out report
The HTML and JSON report for your DPO, built from the audit log, with no conversation content unless you ask.
ReferenceWhat tenon does
AI Act, Art. 12 · record-keepingEvery request, tool call and decision goes into a hash-chained log. tenon audit verify detects a changed line; RFC 3161 timestamps detect a rewrite.
AI Act, Art. 14 · human oversightBy default, writes, commands and MCP calls wait for your approval. A repository cannot loosen your rules.
AI Act, Art. 50 · transparencyCommits that contain code written by the agent can be marked.
GDPR · transfers outside the EUEuropean or local providers preconfigured. Any send outside the EU needs your consent; the eu-only, secnumcloud and strict-local profiles lock it down.
Organisation · signed policyAn administrator imposes a floor signed with minisign: profile, allowed hosts, rules, audit level. Nobody can loosen it.

Install tenon

Linux and macOS. Any OpenAI-compatible endpoint works.

Homebrew

brew install tenon-code-eu/tap/tenon

Script

curl -fsSL https://raw.githubusercontent.com/tenon-code-eu/tenon/main/install.sh | sh

Verify a release

Each release ships archives, .deb and .rpm packages, a CycloneDX SBOM and a SHA256SUMS signed with minisign.

minisign -Vm SHA256SUMS -p tenon.pub

In the works

VS Code and JetBrains extensions, a desktop app.

Read the docs