For a visual intro, here’s a YouTube video demonstrating the features and use cases: https://youtu.be/Jz0l_izoA1w
I started this project because I wanted a few small AI-powered apps for myself — a bookmarks tool, a calorie tracker, a TODO list — but deploying N separate apps with N deployments, URLs, and auth configs is too much effort for a single-user use case. So I built one container that holds all the apps, runs them at the same URL, and lets the agent inside modify them. If I want to change my bookmarks app, I don't open Claude Code and push to a repo — I tell the agent, and it edits the HTML directly. Not great for a large SaaS with lots of users but works great for a single-user app.
Each app is just an HTML file but with access to a filesystem API, full network access and full agentic capabilities.
Since then, Lilo has grown to also support a filesystem/workspace that can hold more than just apps. You can upload PDFs or screenshots and have the AI analyze and organize them for you. The AI also remembers key details about you in a “LLM wiki” style tree of markdown files. It’s a full-on personal assistant.
Inspired by OpenClaw, I added support for additional channels like WhatsApp, email, and Telegram. Now I take a photo of my lunch, text it to Lilo, and the calorie tracker updates. If I didn't eat the pizza crust, I text "didn’t eat the crust" and it adjusts the entry. Cal AI couldn't do that. And unlike say a calorie tracker WhatsApp bot, I also have a nice visual interface to look at my meals.
This combo of personal assistant + personal apps is very powerful. And very flexible. The UI is nice for glancing at data. The chat is nice for operations the UI doesn't cover. I don't have to build a search into every app, I can just ask the agent.
Lilo is open source and alpha software. Bring your own keys. The setup is not the easiest (a lot of API keys and you need to self host). All security advisories for LLM apps with network access apply here. But at the start, since there is no personal data, no data exfiltration is possible but credential exfiltration certainly is. Your entire workspace can be backed up and versioned using a git repo so the data is durable.
I’d love to hear feedback, and hope people find this as useful as I have.
