Frequently asked questions
Short answers to the questions people ask most about Kaizen Manas.
What is Kaizen Manas?
A personal AI agent harness you control from Telegram or Discord. The agent is called Manas.
Who made it?
Adarsh Jaiswal. The licence is MIT.
What does the name mean?
Kaizen is steady improvement. Manas is Sanskrit for mind.
What was it called before?
Niplex Harness, with the agent NiPlex Agent. It was renamed on 2026-09-17.
Is the source public?
No. The source repo is private. A public repo holds docs and a curated snapshot.
Which language is it written in?
Python. CI runs 3.12 and 3.13. Production uses 3.13.
Which chat apps work?
Telegram and Discord.
How do I start?
Set a bot token and your user id, start the bot, then run /setup in chat.
What does /setup do?
It asks for a provider, a key and a model, then saves them for the running bot.
Which model providers are supported?
Agnes, Google Gemini, OpenAI, Anthropic through a proxy, OpenRouter and any OpenAI-compatible service.
Can I use Claude directly?
Not directly. Use an OpenAI-compatible proxy base URL.
Where is my API key stored?
In data/runtime_provider.json or in .env. Neither is committed.
How many tools are there?
61 tools in 13 groups, counted from the code. Five tools are always on.
Which tools are off by default?
The shell, git and voice groups.
Who can turn on the shell?
Only the operator, with SHELL_ENABLED in settings.
Can the agent run code?
Yes. Python runs in a limited sandbox. Risky code waits for a button.
Is the sandbox secure?
It limits memory, time and processes. It is not a container or a VM.
What are the approval buttons?
Allow Once, Allow Session, Always Allow and Deny.
Does Always Allow match similar commands?
No. Only the exact command text.
What does /allow do?
It removes prompts for 5, 10 or 30 minutes. Hard blocks still apply.
Can the agent edit its own code?
Not through the file tools. Core folders are protected.
Does file protection cover run_code?
No. It covers the file tools only.
Who can talk to the bot?
Only ids on the allow-list. An empty list refuses everyone.
How are secrets handled?
As placeholders. Real values are filled in at run time and hidden in output.
Is the vault encrypted?
No. It is a plain JSON file that stays out of git.
What stops prompt injection?
A text check flags known phrasing in web content. It is not a guarantee.
Can the bot read private network addresses?
No. The page reader refuses non-public addresses.
Where are notes stored?
As Markdown under data/global and data/sessions.
Does memory need an API key?
Notes do not. Vector search needs a Google key.
What if I have no Google key?
Vector search falls back to keyword search and says so.
What is the event log?
An append-only list of dated events, one file per UTC day.
What are skills?
Markdown instruction files the agent can load or write.
Is there a skill market?
No. The folder is a placeholder.
What are the model tiers?
Small, medium and power, each with up to three fallbacks.
How does escalation work?
A trigger or /escalate hands the chat to the power model. If it fails, the everyday model answers.
Can the agent change the routing?
No. Only commands write the routing file.
What does /model do?
It pins a tier for this chat. /model auto turns that off.
How long can the agent work on one message?
Up to 25 tool rounds by default. The setting is MAX_TOOL_ROUNDS, 1 to 90.
What happens at the limit?
The model is asked once for a wrap-up without tools.
Are two messages handled at once?
No. Each chat handles one at a time. Later ones wait in order.
Are scheduled jobs allowed to use all tools?
No. Only a read-only list.
What time zone do jobs use?
UTC.
How often does the scheduler check?
Every 30 seconds.
Are sub-agents separate models?
No. They are notes with a goal and a result.
Can it send push messages?
Yes, through ntfy, once a topic is set.
Can it speak?
Yes, with Piper voices, once a voice is picked.
How does auto-deploy work?
The supervisor checks the repo, updates and restarts, and rolls back on an early crash.
Does a docs commit restart the bot?
No.
Where does it run?
The author runs it on HidenCloud. Any Linux host with Python 3.12 or 3.13 should work. Only HidenCloud is used in the repo.
Do the tests run in CI?
The workflow exists. GitHub cannot start jobs right now, so tests are run by hand.
How many tests are there?
484 collected with pytest.
Are there performance numbers?
No. None have been measured.
What does /ui show?
Every button, menu and card style the bot can show.
Why are Discord commands not slash commands?
They are prefix commands. The slash tree is synced but empty.
Can it read photos I send?
No. Inbound media is not handled.
Are Telegram replies formatted?
No. They are plain text.
How long can a reply be?
Replies are split at 4,000 characters on Telegram and 1,900 on Discord.
Does it use MCP?
Config-only scaffolding exists. The agent loop does not use it.
Can it report crashes to GitHub?
Only if you enable it. Reports are redacted.
What licence applies?
MIT for the private code. The licence of the older public snapshot is not confirmed.
Is there a version number?
No. There are no tags or releases.
Why is every status merged?
Features are on the main branch. No releases are tagged, so none are called released.
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.