Argo documentation

1. What is Argo?

Argo is a desktop app that builds a “company of AI employees” from a single prompt. Describe a role and a specialist agent is hired; they accumulate folder-scale memory and collaborate to finish the work.

2. Five-minute start

(1) Install the app -> (2) create a company -> (3) hire your first agent (one line, e.g. “A senior researcher — market research, summaries”) -> (4) start chatting. Four steps and you are working.

3. Core concepts

Company = your workspace. Agent = an AI employee (each with a role and card). Memory (vault) = a folder tree of notes, journals, and an index. Delegation = a moderator hands work to the right agent. Approval = risky or important actions run only after you sign off.

4. Hire, role, and card

Describe the expert you need in one sentence; Argo writes a persona card and the agent joins. You can edit the name, title, team, and rules from the card at any time.

5. Teaching it to remember

Reusable decisions and preferences accumulate as vault notes as you talk. Searching a keyword loads only the relevant memory, saving tokens — it does not re-read everything each time.

6. Delegation & collaboration

A moderator delegates work to the right agent, and another reviews it. One does the work, another reviews, and you just approve.

7. How agents are instructed

Each agent is defined by one system-prompt card. Here we publish only the structure, not the actual internal text — (1) identity (2) accuracy rules (3) working rules (4) memory usage (5) company context (auto-injected). Internal agent codenames, company context, keys, and paths are omitted.

---
runner: <engine>        # claude · codex · gemini · glm
model:  <model id>
name:   Agent A         # display name (placeholder)
role:   Researcher      # title (placeholder)
team:   <team>
---

## 1. Identity  (신원)
One line: the role, what it's good at, and its scope.

## 2. Accuracy rules  (정확성)
- Say "I don't know" when unsure; assert only from evidence.
- Re-check the result against the goal before finishing.

## 3. Working rules  (운영 규율)
- Request -> goal & success criteria -> break into steps -> execute.
- State assumptions and risks, and offer alternatives.

## 4. Using memory  (기억 사용법)
- Save reusable decisions and preferences as vault notes.
- Search and read only the memory the task needs.

## 5. Company context  (auto-injected)
Your recorded preferences, decisions, and no-gos are injected here.

8. Make it your own

You shape an agent’s instructions three ways. (1) Preset — pick a ready-made role template. (2) Custom — edit the card directly. (3) Append — layer company-wide rules onto every agent (e.g. “always lead with the conclusion”).

9. Choose a runner

Argo runs on multiple engines (runners) — Claude, Codex, Gemini, GLM. Connect your own API key or subscription (BYOK). Whatever the engine, the “Argo style” — delegation, memory, approvals — stays the same.

10. Settings, env, budget

Workspace path, runner keys, and integrations are managed in settings. Set a monthly budget (spend cap) to stay in control before you go over. Keys and secrets are handled by name and location, never shown or logged in plain text.

11. Capabilities & approval gates

You can turn each capability an agent may use — file access, browser, shell — on or off. Sensitive ones pass an approval gate before running, so you decide what is allowed or blocked.

12. Handling risky actions

Hard-to-undo actions — deleting, sending externally, spending — follow an “approve, then act” rule. The agent proposes a plan first and only executes after you sign off.

13. Security

Agents run on your computer, as your user, with full access including the shell. On top of that, the permission gate holds a hard line that never opens — the running Argo code, runner credentials (~/.codex, ~/.claude, ~/.gemini, ~/.argo), other companies' workspaces, and the company vault (connections, MCP, routines, agent definitions). For SDK runners this is enforced in code on every file, search and MCP tool call.

We also say what it cannot stop. Shell commands are strings, so only naive attempts that spell out a forbidden filename are caught; variables and relative paths get through. External CLI runners such as Codex and Gemini do not pass through the gate at all. Everything an agent reads — vault documents, messenger messages, fetched web pages — can carry instructions, and a successful prompt injection means local command execution as your user. The system prompt tells agents to treat outside input as data; that is a contract, not a guarantee.

The only real boundary against an adversarial model is outside the process — OS-level isolation (a container or sandbox). Argo does not yet ship an option that confines agent execution to a container; this is a known product gap and a priority track. Until then, do not wire untrusted input surfaces (a public mailbox, open channels, arbitrary URL ingestion) into an agent as a standing input, register only the work folders you need, and set a spending cap on the runner accounts you connect.

Secrets are handled by name and location, never by value. Runner credentials, bot tokens and MCP env vars never sync to the cloud (see 14-1), no secret is kept in plaintext anywhere in the code, and a commit hook catches vendor key patterns. The full trust model and report scope live in SECURITY.md in the source repo.

14. Telegram, Slack, MCP, sync

Connect an agent to a Telegram or Slack gateway to continue with the same context on your phone. Add external tools and servers via MCP in one click, and sign in to sync context between web and app.

14-1. Sync & credentials — what goes up, where the key lives

If you never sign in, nothing leaves your computer. Set the environment variable ARGO_SYNC=0 to disable sync entirely.

Credentials are not uploaded — the three credential files (runner login tokens and API keys in .secrets.json, Telegram/Slack bot tokens in connections.json, MCP env vars in mcp.json) are structurally excluded from hosted sync. Newly saved credentials are reachable by no one but you, operator included; new devices simply reconnect runners and bots. A copy left by an older version is withdrawn on the next sync (deferred on the free plan by a cloud-write restriction, and run once you are on Pro/trial).

Company data (memory, chats, agents) replicates to Argo cloud with envelope encryption (AES-256-GCM). Its per-account key lives in the same cloud, so the operator can technically decrypt that data — for this category we do not claim "operator-proof". End-to-end encryption that only you can open is in progress separately.

Team messenger data (orgs, channels, messages, attachments) is shared among members, so it is stored in plaintext on the server (orgs are separated by RLS) and the operator can technically read it. If you prefer not, self-host Supabase or skip the messenger.

On self-hosting (your server, your Supabase) the operator is you, so you may choose per company whether credential files sync across devices (Settings → Device sync → Credential sync).

15. API & tool reference

Precise specs for the tools and commands agents use live in the reference — a dictionary you look things up in. (The detailed tables expand alongside product releases.)

16. Troubleshooting & FAQ

Common snags and fixes — a runner key not recognized, a capability blocked, memory that looks like it is not accumulating. Check here first when you get stuck.

17. Changelog

Version-by-version changes and migration notes. We record what changed and what we verified, honestly.