# Kilat Agent Source: https://kilat.host/docs/kilat-agent Kilat Agent is your private AI agent: chat, Telegram, memory and schedules, managed from the Kilat dashboard. New deployments use Kilat OpenID Connect (OIDC) dashboard sign-in by default: sign in with your Kilat account, without registering a Nous dashboard OAuth client. Kilat Agent is built on [Hermes Agent](https://github.com/NousResearch/hermes-agent), the open-source (MIT-licensed) agent by Nous Research. Kilat adds the hosting, the dashboard pages, Telegram setup, sleep and wake, and the Kilat MCP tools. Kilat is not affiliated with Nous Research. A Kilat Agent runs as **Classic** (always on, paid per agent, the sizes below) or **Flex** (sleeps when idle, wakes in about a minute, included in your plan). This page covers both; plans, awake time and waking are in [Flex agents and plans](https://kilat.host/docs/flex-agents). ## Plans | Plan | RAM | CPU | Price / 30 days | | --- | --- | --- | --- | | Small | 1 GB | 0.75 vCPU | Rp 25,000 ~~Rp 50,000~~ | | Medium | 2 GB | 1.25 vCPU | Rp 40,000 ~~Rp 80,000~~ | | Large | 4 GB | 2.0 vCPU | Rp 80,000 ~~Rp 160,000~~ | ## Before you deploy - **A model provider key.** Your agent uses your own model provider account. Model usage is billed by your provider, not by Kilat. - **Workspace backend access.** Newly created agents automatically receive PocketBase management permission: they can read, create, update and delete application records, including sensitive data, and change schemas and API access rules across all accessible PocketBase backends in your workspace, not only a linked website backend. These server-side management calls are not limited by end-user collection rules. Existing credentials remain unchanged. Revoke the agent's token under Account → MCP to stop subsequent calls; already-read data cannot be recalled. Trust the agent and its model provider with this access before deploying. ## Setup 1. Open **Services → Deploy a service**, select Kilat Agent, choose a persona, region and plan, then pay from your wallet. General Assistant is the default; persona selection is not a completed provider or Telegram setup. 2. When the service is running, select **Open dashboard**. Default Kilat OIDC redirects to your Kilat sign-in and authorizes only the service owner. Dashboard authentication does not connect an inference provider. 3. Select **Connect AI** to open its provider settings. Choose Nous Portal and complete the displayed device-code login, or add your own provider API key. Then select your inference provider/model and send a test message. Nous account access or subscription is separate from Kilat hosting; no free model credits are promised. For Kilat-sign-in agents, **Connect AI** opens provider settings inside the Kilat dashboard, like **Open dashboard**. Use **Open in new tab** if the provider's approval page needs a separate browser window. Legacy Nous-dashboard-sign-in agents keep their direct dashboard connection flow. Kilat OIDC authenticates the dashboard; Nous inference OAuth or a provider API key authenticates model usage. They are separate connections. The agent stores inference credentials inside itself; connecting a provider does not automatically select a model. Signing out of Kilat revokes Kilat-issued refresh tokens, not Nous inference credentials; existing agent dashboard sessions may remain until runtime session expiry. The optional **Advanced** Nous dashboard OAuth client ID selects a separate legacy sign-in flow, not the default. If you choose it, register the exact callback shown on the service page (`https://.kilat.host/auth/callback`). ## Choose an agent template Open **New service → Kilat Agent**, then choose **Personal Assistant**, **Expense Notes**, **Research & Daily Reports**, or **General Assistant (Default)** before paying. General Assistant uses the agent's built-in behavior without custom Kilat persona defaults and is selected by default. Other templates seed missing persona/model/memory/timezone files and keys on first boot. Restart or recreation does not reset later edits. Connect your provider and Telegram in your agent after deployment; the full onboarding wizard is not available yet. Expense Notes helps draft private expense notes, not verified accounting, deterministic totals, or CSV exports. Starting model defaults do not establish provider availability or account access. Persona-specific auto-loaded skills remain unset; the updated wrapper separately bundles the website skill described below. Telegram pairing, reminders, and scheduled report delivery still require configuration and verification. Also available: **Translator**, **Private Tutor**, **Social Media Manager**, **Productivity Coach**, **Lead Qualifier**, **Blog Writer**, **Marketing Copywriter**, and **Data Analyst**. These are private personas, not installed integrations or public bots. Publishing, outreach, scheduling and data access require suitable tools and your approval. Research analysis is covered by Research & Daily Reports. **Small (1 GB) is for very light tasks only.** Tools, browser work, and large inputs can exhaust memory and restart the agent. Medium offers 2 GB; Large offers 4 GB and 2 vCPU at Rp80,000 per 30 days (Rp160,000 list, current 50% discount). More RAM provides headroom, not a workload guarantee. Plans are available only where host capacity permits. ## Connect Telegram and check readiness Configure Telegram in your agent after deployment: create your bot with BotFather, keep its token private, and restrict access to your own numeric Telegram user ID. Do not enable public access for a private persona. Kilat's provider-validation and private-code pairing wizard is not available yet; follow the runtime's setup instructions and verify the bot replies to your private chat. Container status, dashboard sign-in and persona selection do not prove a model response or delivered Telegram message. Confirm a useful reply before relying on the agent. Configure and test reminders or scheduled reports separately; neither a template name nor recreation proves scheduled delivery. ## Publish a static website through MCP The updated Kilat wrapper bundles **kilat-create-website**, a native agent skill for building and publishing static frontends. Newly created agents receive a dedicated Kilat MCP connection with read-only service access, website publishing permission and workspace-wide PocketBase schema and record management. Ask: *Build a website with my PocketBase backend and publish it on my free Kilat site; ask before changing data, access rules or making it public.* Site creation stays on the free tier; only the owner can purchase or upgrade hosting through the dashboard. Verified email, free-site quota and host capacity still apply. **Image rollout required:** this skill and automatic bootstrap require the new wrapper image; older deployed images do not gain them from a Rails update. Existing agents are not automatically granted credentials. For an older agent, create a **Site publish** token under **Account → MCP**, store it privately in `/opt/data/.env`, and add this remote entry to `/opt/data/config.yaml`: ``` mcp_servers: kilat: url: https://kilat.host/mcp headers: Authorization: "Bearer ${KILAT_MCP_TOKEN}" ``` Restart an older agent after manual configuration, then verify `list_sites` and `get_site`. New automatic credentials are tied to the originating agent, stop authenticating while its access is suspended, and revoke on deletion; owners can revoke them in Account → MCP. Revoked tokens are not silently replaced on restart. Model credentials remain separate. Live MCP connectivity, package-registry egress and build memory still depend on the deployed runtime. 1. Ask your agent to inspect the site's linked PocketBase public URL and status. Use end-user authentication and collection rules; never embed a superuser password. Linking does not change backend rules or schema. 2. Generate source in your private project, install dependencies, and build static output (for example `npm ci && npm run build`). The image includes Node/npm, tar/gzip and curl; memory and network availability still constrain builds. SSR/API routes need a different hosting product. Preserve source separately; hosting stores finished assets, not a source backup. 3. Review `dist/` for secrets. Ask your agent to call `prepare_site_upload` with the site ID, a unique request key and an explicit SPA fallback choice. Keep the short-lived upload grant private, including tool transcripts visible to your model provider. 4. Package and PUT the output using the returned grant. Supply `UPLOAD_TOKEN` and `UPLOAD_URL` privately; disable shell tracing. Header input below keeps the token out of curl's command-line arguments: ``` set +x tar --format=ustar -czf site.tar.gz -C dist . printf 'Authorization: Bearer %s\n' "$UPLOAD_TOKEN" | curl --fail --show-error --request PUT --header @- \ --data-binary @site.tar.gz "$UPLOAD_URL" unset UPLOAD_TOKEN ``` Approve `deploy_site` with the returned release ID and the active release ID from `get_site` (null on first publication). Poll `get_site_deployment` and `get_site`; report success only after the active release and HTTPS verification agree. Runtime activation failures restore previous content; failed external verification requests rollback, but candidate content can briefly be visible before verification completes. `rollback_site` also needs approval and the expected current release. See [Static website setup and plans](https://kilat.host/docs/websites-and-backends#static-sites) and [MCP static tools and limits](https://kilat.host/docs/mcp#static-sites) for complete arguments and retry rules. **Everything in published assets is public.** Never ship `.env`, MCP/upload tokens, provider keys, PocketBase superuser credentials or private keys. Build-time frontend environment variables can become browser JavaScript. Automated secret rejection cannot prove an artifact safe. ## Keys and safety Agents can run tools and code you ask them to. Use a separate model key for each service with a spending limit, keep unrelated production credentials out of the agent, and rotate keys after deleting the service.