ENZO

When you send a message, the request goes from your browser through ENZO to the provider you picked, and you pay that provider their normal price. Nothing sits in between taking a cut.

A self-hostable, bring-your-own-key AI workspace — chat with 300+ models, research, code-gen with live preview, and a local agent with durable memory. All keys stay in your browser, encrypted; this server stores none of them.

docker compose up -d
# → http://localhost:5001

That's the whole install. No accounts, no mandatory env, no database server.

Try it hosted first: https://enzo-hub.duckdns.org — the same app, running on our infrastructure. This repo is exactly that code, minus Google sign-in (self-hosted login is just your provider keys) with a trimmed default theme set for a small download.

Quickstart

# requires docker (or docker compose v2)
git clone https://github.com/theguysudo/ENZO.git
cd enzo
docker compose up -d

Open http://localhost:5001, press Login, and pick any provider:

Keys are saved encrypted in your browser (passphrase-protected vault, with a recovery file you can download). The server never sees them — requests are relayed with your key attached, and you can wipe them anytime from the Vault.

Two editions

Both animate by default — the lite themes are GPU shaders, not static images. To get every theme:

ENZO_IMAGE=ghcr.io/theguysudo/enzo:full docker compose up -d

What's stored where

Everything you make lives in Docker named volumes, safe across upgrades:

• enzo-projects — generated coding projects
• enzo-skills — skills the agent learned from GitHub repos
• enzo-memory — the agent's durable notes about your work

Your provider keys are not in the volumes — they're browser-side (encrypted at rest with your passphrase).

Optional configuration

Everything works with zero environment variables. A few features want server-side values — put them in a .env next to docker-compose.yml:

# Extra origins allowed to call the API (comma-separated)
ENZO_CORS_ORIGINS=https://enzo.example.com

# "Connect with Cloudflare" OAuth button (optional — pasting a token works too)
CLOUDFLARE_OAUTH_CLIENT_ID=...
CLOUDFLARE_OAUTH_CLIENT_SECRET=...

# HuggingFace OAuth app for the HF onboarding step (optional — token paste works)
VITE_HF_CLIENT_ID=...
HF_CLIENT_SECRET=...

VITE_HF_CLIENT_ID only takes effect when building the image from source (it's baked into the frontend at build time).

Building from source

docker build -t enzo:mine --build-arg THEME_VARIANT=full .

What's different from the hosted deployment

This image is generated from the same codebase that runs https://enzo-hub.duckdns.org, with exactly two feature differences:

1. No Google sign-in. The hosted site offers Google OAuth as a convenience; here, login is setting your provider keys. Everything else — providers, research, coding agent, vault, memory, skills — is identical.
2. Default themes (lite image). The first homepage and workspace themes run as pure WebGL/three.js so the image stays small. The full image has the complete set.

License

Apache-2.0 — see LICENSE.