parlor 0.15.0

Parlor - a private parlor for AI conversation

Parlor

The secure digital speakeasy for AI conversation.

Self-hosted ChatGPT-style web UI and agentic CLI that connects to any OpenAI-compatible API.
Install with pip. Run locally. Own your data.

Documentation • Quick Start • Features • Security

---

Why Parlor?

Step inside. Parlor connects to any OpenAI-compatible endpoint --- your company's internal API, OpenAI, Azure, Ollama, LM Studio, or anything else that speaks the OpenAI protocol. Built to OWASP ASVS L1 standards because your conversations deserve real security, not security theater.

One command. No cloud. No telemetry. No compromise.

---

Quick Start

pip install parlor
parlor init         # Interactive setup wizard

Or create ~/.parlor/config.yaml manually:

ai:
  base_url: "https://your-ai-endpoint/v1"
  api_key: "your-api-key"
  model: "gpt-4"

parlor --test       # Verify connection
parlor              # Web UI at http://127.0.0.1:8080
parlor chat         # Terminal CLI
parlor --version    # Show version

---

Features

Web UI

Full-featured ChatGPT-style interface with conversations, projects, folders, tags, file attachments, MCP tool integration, prompt queuing, command palette, and four built-in themes.

CLI Chat

An agentic terminal REPL with built-in tools (read/write/edit files, bash, glob, grep), MCP integration, skills system, and Rich markdown rendering. Type while the AI works --- messages queue automatically.

parlor chat                          # Interactive REPL
parlor chat "explain main.py"        # One-shot mode
parlor chat -c                       # Continue last conversation
parlor chat --model gpt-4o "hello"   # Override model

Shared Core

Both interfaces share the same agent loop, storage layer, and SQLite database. Conversations created in the CLI show up in the web UI, and vice versa.

---

Security

Layer	Implementation
Auth	Session tokens, HttpOnly cookies, HMAC-SHA256
CSRF	Per-session double-submit tokens
Headers	CSP, X-Frame-Options, HSTS, Referrer-Policy
Database	Parameterized queries, column allowlists, path validation
Input	DOMPurify, UUID validation, filename sanitization
Rate Limiting	120 req/min per IP
CLI Safety	Destructive command confirmation, path blocking
MCP Safety	SSRF protection, shell metacharacter rejection

Full details in SECURITY.md.

---

Documentation

For complete documentation including configuration, CLI commands, API reference, themes, MCP setup, skills, and development guides, visit parlor.readthedocs.io.

---

Development

git clone https://github.com/troylar/parlor.git
cd parlor
pip install -e ".[dev]"
pytest tests/ -v

Backend	Python 3.10+, FastAPI, Uvicorn
Frontend	Vanilla JS, marked.js, highlight.js, KaTeX
CLI	Rich, prompt-toolkit, tiktoken
Database	SQLite with FTS5, WAL journaling
AI	OpenAI Python SDK (async streaming)
MCP	Model Context Protocol SDK (stdio + SSE)

---

MIT License
Built for people who care about their conversations.
parlor.readthedocs.io