fak — the Fused Agent Kernel

fak (Fused Agent Kernel) is an open-source Go binary that sits between an AI agent and the tools it calls, acting as a management plane for model traffic, context lifetime, and capability policy. Released under Apache-2.0 by Netra Systems, Inc., it is designed to drop in front of existing agents — Claude Code, Codex, Cursor, or any OpenAI/Anthropic/MCP client — without requiring a rewrite or API key to evaluate. The project is pre-1.0 and actively developed, with every capability claim tagged as [SHIPPED], [SIMULATED], or [STUB] in a public claims ledger.

What It Is

fak is an agent kernel: an in-process gate that intercepts every tool call an agent makes and treats it like a syscall. The model proposes; the kernel disposes. From the operations seat it is a control plane with audit and policy enforcement. From the performance seat it is a coordination layer that eliminates repeated work across context, cache, and model traffic. The project's own framing is that those two functions turn out to be the same gate — the tool-call boundary.

The kernel runs in two modes: fak guard launches beside a single local agent session as its supervisor, and fak serve runs as a shared OpenAI-, Anthropic-, or MCP-compatible endpoint that multiple clients can point at. Both modes run the same kernel; the difference is scope.

How the Kernel Gate Works

Every tool call passes through a five-gate flow inside the kernel before it reaches the outside world:

• Policy verdict — each proposed call receives ALLOW, DENY, TRANSFORM, or REQUIRE_WITNESS against a reviewable capability floor. The project states this check runs at ~362 ns in-process with no policy model or network hop, and defaults to default-deny for unknown tools.
• Addressable KV cache — the kernel can reach into the middle of a kept run, evict a single poisoned or expired span, and leave the model's scratchpad bit-for-bit identical to a run that never saw it (the project labels this max|Δ| = 0).
• Shared-prefix reuse — the system-prompt-plus-tools block is prefilled once for a whole agent fleet and reused across sessions. The project's benchmark authority documents claim approximately 4.1× fewer prefill tokens versus a tuned warm-cache stack on a 5-agent × 50-turn workload.
• Context compaction — sessions compact their own history (up to ~107K tokens per trim) and can resume after a crash instead of dying at the context limit.
• In-kernel GGUF serving — the kernel can load GGUF weights itself and serve OpenAI, Anthropic, and MCP clients directly, with SSD expert-weight offload for mixture-of-experts models so the full model does not have to sit in RAM.

Deployment Model

fak is a single static binary with no runtime dependencies. Installation is a one-line curl or go install for Go 1.26+ users. It is offline-capable: fak agent --offline runs a deterministic mock planner that verifies the managed-agent path and policy boundary without an API key, model download, or GPU. The project also ships a Colab quickstart notebook for browser-based evaluation.

For production use, fak guard wraps an existing agent CLI (e.g., fak guard -- claude) and fak serve exposes a gateway endpoint that existing OpenAI or Anthropic clients point at unchanged. A fak node install command registers an always-on MCP service.

Tradeoffs to Know

The project's README is explicit about what fak is not:

• It is not a faster model server — vLLM, SGLang, and llama.cpp win raw throughput; fak runs in front of them.
• The security floor is structural, not detection-based — it removes the tools and results a prompt injection would need rather than claiming to detect a successful injection.
• Tool-calling turns are adjudicated whole-turn, not token-streamed — prose deltas still stream, but tool-call bytes do not, so full-turn latency applies when wiring an interactive harness to the gateway.
• The reuse win is self-host only; frontier-scale fleet numbers are design targets, not measurements.
• Power and energy numbers are simulated.

Update: v0.43.0 (July 2026)

The README was verified against VERSION 0.43.0 on 2026-07-29. The latest GitHub release tag is v0.41.0 (published 2026-07-14). The repository was last pushed on 2026-07-29, indicating active development. The project's CLAIMS.md and BENCHMARK-AUTHORITY.md are maintained as living documents that trace every benchmark number to a commit and artifact, and label what is simulated versus measured.