Talorys: A Free Personal AI Agent on Cloudflare, and What 10,000 Neurons Buys

Talorys is an MIT-licensed personal AI agent that deploys into your own Cloudflare account with npx create-talorys@latest, and it is built to fit the free plan: chat with memory, tasks, notes, projects and scheduled reminders, with no server or database run by its author. It reached the Hacker News front page on October 10 with 246 points, and most of the thread argued about the word "self-hosted" rather than the agent. This post covers what is actually deployed, how far the free daily AI allocation goes, and what to check before you trust it with anything.

I did not deploy it for this piece. Everything below comes from the Talorys README and security doc and Cloudflare's Workers AI pricing page, and my own arithmetic is labelled as such.

What the installer puts in your account#

Per the README, the stack is four Cloudflare pieces, all available on the free plan:

• Pages serves a React and Vite frontend plus one Pages Function that forwards /api/* calls.
• A private Worker (Hono) does the API work. It is deployed with workers_dev: false and preview_urls: false, so it has no public URL and is reachable only through a service binding from Pages.
• One SQLite-backed Durable Object stores everything: conversations, memories, tasks, notes, projects, automations, sessions. Reminders run on Durable Object alarms, so nothing has to stay online.
• Workers AI runs the chat model, @cf/zai-org/glm-4.7-flash, with streaming and tool calling.

It does not provision R2, D1, KV, Vectorize or any paid service. The installer checks your Node version (20.18+), uses Wrangler's OAuth login, hashes the owner password locally with PBKDF2, stores secrets through stdin, deploys, then verifies the live site without running any inference. If it dies halfway, you rerun the same command and it reconciles instead of duplicating resources. Later commands are update, status, doctor and reset-password.

The design choice worth noting is the shape: one person, one Durable Object, no accounts. That is the opposite of the multi-tenant agent platforms covered in Durable AI Agent Frameworks Compared, and it is why the free tier is even plausible.

The part that decides whether it stays free: Neurons#

Cloudflare gives every account 10,000 Neurons per day at no charge, reset at 00:00 UTC. Past that, Workers Paid bills $0.011 per 1,000 Neurons, and on the free plan further requests fail with an error. For glm-4.7-flash the pricing page lists 5,500 Neurons per million input tokens and 36,400 per million output tokens ($0.06 and $0.40 per million tokens).

Here is my arithmetic, not a measurement. It assumes the whole conversation is re-sent as input each turn and ignores any caching:

So light chat fits comfortably, and a long thread with big tool results does not. The README says the same thing in softer words: it is "not unlimited free," a daily AI cap exists, and chat shows a message and resumes after the reset while tasks, notes and reminders keep working. It also ships guardrails you can tune under Settings, AI: max output tokens, max context tokens (older history is summarized), max tool calls per request, and daily caps on AI requests and scheduled AI runs. Simple reminders and task digests never touch the model. The Usage panel shows local estimates only, so the exact number lives in the Cloudflare dashboard.

If you want more headroom, the shape of the fix is Cloudflare's own paid tier or a gateway, which is the territory of Cloudflare folding Workers AI into AI Gateway. I have not tested swapping the model in Talorys, and the README does not document a model setting, so do not assume it is a one-line change.

The security model, read as a builder#

The security doc is more careful than most weekend agent projects:

• Sessions are random 256-bit tokens in an HttpOnly; Secure; SameSite=Strict cookie, and the database stores only an HMAC of the token.
• Five failed logins per client IP in 15 minutes lock that client out.
• Destructive tools (delete_task, delete_note, forget_memory, cancel_automation) require confirmed: true and an explicit confirmation in the owner's latest message, "enforced in code, not just in the prompt."
• Scheduled AI runs get read-only tools plus a notify tool.
• There is no shell, code execution, outbound HTTP, credentials or deployment tool.

That last line is the real safety story. An agent with no way to reach the network or run code has a small blast radius even if a note or memory contains an injected instruction. It is also why this is a notes-and-reminders assistant, not a coding agent. If you want OS-level containment for an agent that does run commands, that is a different problem, covered in the Microsoft MXC developer guide.

What people are actually saying#

I read the Hacker News thread at roughly 120 comments.

• The label fight dominates. Several commenters said running on Cloudflare is "self configured, cloud hosted," not self-hosted, and one suggested a title like "an AI agent hosted on Cloudflare's free tier." Others argued the term has stretched to include rented infrastructure you control. A defender pointed out that the code is open and the AI calls can be repointed at a local model server with a small edit. That is plausible given the code is MIT, but it is a claim from the thread, not something the project documents.
• The billing warning. One commenter said they were billed for Neuron usage they believed should have been covered by free limits when they also ran paid Workers, and got no answer from support. That is one anecdote, but it matches the README's own caveat that paid plans bill beyond included amounts. Check which plan your account is on first.
• The burn rate. A tester who set it up said the 10,000 free Neurons covers light daily use, but that they spent 500 in a few minutes of chatting. That lines up with the per-turn arithmetic above.
• The gap people found within hours. One commenter stored "I am a vegetarian" as a memory, asked for dinner ideas, and got chicken and salmon, then opened a proposal for semantic recall. The README says only "the most relevant memories" are sent each turn, and relevance is evidently weaker than it sounds. Compare that with the managed approach in Cloudflare's agent memory primitive.
• The meta-comment. The repository's commits are co-authored by Claude, and a reader complained about "Claudeish prose" in the launch post. Treat a day-old 0.1.2 project accordingly.

What to do Monday#

If you want a free personal agent to try, the cheap path is:

1. Confirm your Cloudflare account is on the Free plan, so the daily cap fails closed instead of billing.
2. Run npx create-talorys@latest in an empty directory and keep the generated talorys/ folder for updates.
3. Run npx create-talorys@latest doctor after deploy, and set the daily AI request cap in Settings before you start chatting.
4. Watch the Cloudflare dashboard, not the in-app estimate, for the first week.
5. Download a backup from Settings, Privacy before updating; the README says update keeps the same Durable Object and runs migrations automatically.

Skip it if you need web access, code execution, or good long-term recall. For a local-model route with a real coding workflow, start from the best local coding LLMs and the agent harness map instead.

Continue Reading#

• Durable AI Agent Frameworks Compared - one run across four durable stacks
• Cloudflare Folds Workers AI Into AI Gateway - the paid-tier and gateway route past the free cap
• Cloudflare Agent Memory - the managed alternative to hand-rolled memory
• Microsoft MXC Developer Guide - containment for agents that do run code
• The Best Local Coding LLMs in 2026 - when you want the model on your own hardware

Sources#

• rociiu/talorys README - architecture, installer, guardrails, free-tier notes
• Talorys security doc - auth, CSRF, tool safety
• Cloudflare Workers AI pricing - 10,000 free Neurons per day, glm-4.7-flash rates
• Hacker News discussion - community reaction
• Talorys issue 2 - semantic recall proposal