MORPH ◈

Mohith's Omni-purpose Reasoning and Personal Helper — a local personal AI assistant with a strict, always-on Safe Mode.

Features

• Chat with Claude (claude-sonnet-4-6) with real-time word-by-word streaming
• Persistent memory — conversations stored in MongoDB and remembered across sessions
• Voice input (Web Speech API, with listening animation) and voice output (ElevenLabs, browser-TTS fallback)
• Autonomous web search — MORPH decides when to search via Tavily; you never have to ask
• Document Q&A (RAG) — upload PDF/DOCX/TXT/CSV/JSON; content is split with LangChain, embedded locally, and stored in Chroma (in-process vector store fallback if Chroma isn't running)
• Vision — attach images/screenshots and MORPH analyzes them
• Code assistant — paste code for review, debugging, explanation, improvements
• Computer control — open apps (VS Code, Chrome, MongoDB Compass, Postman…), open websites, create/read/write/copy/move/rename/delete files, run terminal commands, take screenshots (shown in chat), convert documents to PDF, list folders, read & summarize files

SAFE MODE (always active)

Rule	Implementation
Path jail	Every file/terminal operation is confined to MORPH_SAFE_DIR (default Desktop\MORPH). Extra roots only via MORPH_ALLOWED_PATHS.
System dirs blocked	Windows/System32/Program Files/Library/usr/root/etc + any folder containing "system", "windows", "root", and all hidden dot-folders.
Sensitive files	Files whose name/path contains private, confidential, secret, password, credentials, or env are never read or sent to any API.
Audit log	Every file op, app launch, website, command, and API call → MongoDB morph_audit_log (append-only; MORPH has no code path to delete it). File fallback if Mongo is down.
Confirmation cards	Medium risk (create/write file, screenshot, PDF convert) → Approve/Deny card. High risk (delete, move, rename, overwrite, terminal commands) → red warning + must type CONFIRM (verified server-side).
Risk levels	low = read/list/open app/website · medium = create/write · high = delete/move/modify/execute
No network from tools	Terminal commands with curl/wget/ssh/ping/Invoke-WebRequest etc. are rejected. Only configured AI APIs (Anthropic, Tavily, ElevenLabs) are ever called.
Session lock	30 min idle → locked; unlock by typing your name (MORPH_USER_NAME).
Activity feed	Live panel showing every action, color-coded green/yellow/red.
Panic button	🛑 aborts all running operations, cancels pending confirmations, logs a panic event.

Setup

1. Prerequisites: Node.js ≥ 18.17, MongoDB running locally (optional but recommended). Optional: Chroma server (pip install chromadb then chroma run).
2. Install dependencies (already done if you received this folder with node_modules):

   npm install
   

3. Configure:

   copy .env.example .env
   

   Then edit .env and add at minimum ANTHROPIC_API_KEY. Add TAVILY_API_KEY and ELEVENLABS_API_KEY for search and voice.
4. Run:

   npm start
   

   Open http://localhost:3000

Notes

• The first document upload downloads a small local embedding model (Xenova/all-MiniLM-L6-v2) — one-time, then cached.
• If Chroma isn't running, MORPH silently uses an in-process vector store re-hydrated from data/chunks.json.
• If MongoDB isn't running, memory and audit fall back to append-only files in data/ (start Mongo for the full experience).
• Voice input requires Chrome or Edge.

Project layout

server/
  index.js              Express app + all API routes
  config.js             env config & safe-dir defaults
  db.js audit.js        Mongo memory + append-only audit log
  events.js             live activity feed (SSE)
  safemode/             guard (path jail), confirmations, session lock
  agent/                Claude streaming agent loop + tool registry w/ risk levels
  tools/                files, apps, terminal, web search, screenshot, pdf
  rag/rag.js            LangChain split → local embeddings → Chroma (+fallbacks)
  voice/elevenlabs.js   TTS proxy
public/                 chat UI, voice, confirmation cards, activity feed, lock, panic