Your AI intern with a shell blocklist and a long-term memory

What it does

Mercury is a TypeScript AI agent that chats, codes, and manages tasks across CLI, Telegram, and a local web dashboard. It wraps filesystem, shell, Git, web fetch, and scheduling tools behind a permission system that blocks dangerous commands like sudo or rm -rf / by default and scopes file access to specific folders. A built-in SQLite “Second Brain” auto-extracts and consolidates memories across ten types, while Kanban boards let it process task cards autonomously with per-card token tracking.

The interesting bit

The “soul-driven” angle means the agent’s personality is literally a set of markdown files (soul.md, persona.md, taste.md, heartbeat.md) you own and edit, rather than a hidden system prompt. It also runs as a cross-platform daemon with crash recovery and boot-start integration via LaunchAgent, systemd, or Task Scheduler, making it closer to a system service than a chat script.

Key highlights

• Permission-hardened tool use: shell blocklist, folder-level read/write scoping, and per-session “Ask Me” or “Allow All” modes.
• Token budgeting with daily limits, auto-concise mode when usage crosses 70%, and in-chat /budget controls.
• Persistent memory via SQLite + FTS5, with auto-extraction, conflict resolution, and consolidation across 10 memory types.
• 126+ community skills installable from a registry, treated identically to the 31 built-in tools after download.
• Multi-channel access: Ink TUI for CLI, editable streaming messages on Telegram with role-based multi-user access, and a React SPA dashboard bound to localhost.

Caveats

• The web dashboard defaults to credentials mercury / Mercury@123 and binds localhost only, which is convenient for single-user local access but not designed for exposed multi-user hosting.
• Community skills are unaudited; the README explicitly warns to review SKILL.md before installing.
• In daemon mode, the CLI becomes log-only, so Telegram is effectively required for interaction when running headless.

Verdict

Good for developers who want a locally running, always-on agent with memory and safety guardrails across multiple interfaces. Skip it if you need a cloud-native, multi-tenant web service or an agent that silently automates without confirmation prompts.