WeKnora now asks permission before it remembers anything
Tencent's MIT-licensed knowledge framework WeKnora has reached version 0.8. Skills now run in their own sandbox rather than the main process, remembered facts persist between sessions, and each one is put to the user for approval before it sticks.
Tencent has released version 0.8 of WeKnora, its open-source knowledge framework. The project is MIT licensed and has more than 22,000 stars on GitHub.
WeKnora turns documents into a queryable system. It runs in three modes: RAG-based quick question and answer for everyday lookups, a ReAct agent that orchestrates retrieval on its own, and a Wiki mode where agents generate structured markdown knowledge bases.
What the new version adds
Skills now run in a sandbox. Previously the skills in use ran inside the main process; that backend is gone. Each session runs in its own sandbox with configurable network egress policies. Docker, E2B or Cube can serve as the sandbox backend.
Memory across sessions. Profile, preference, fact, task and interest entries no longer disappear when a session ends. Each is proposed for the user's approval before it is made persistent.
Skills as assets. Instead of scattered scripts there is a tenant-wide catalogue. Skills are pulled from ClawHub, SkillHub or any git repository, versioned and verified, and loaded before anything runs.
The release also adds an in-process parser for office documents.
Where it runs
Docker and Git are enough to install it. It runs locally, in Docker or on Kubernetes, with offline and private deployment supported. No cloud service is required.
On the model side it supports OpenAI, DeepSeek, Qwen, Zhipu, Hunyuan, Gemini, MiniMax, NVIDIA, LiteLLM and Ollama. For embeddings it works with Ollama, BGE, GTE, Zhipu and OpenAI-compatible endpoints. For vector storage the options include PostgreSQL with pgvector, Elasticsearch, OpenSearch, Milvus, Weaviate and Qdrant.
In other words the whole thing can sit on your own machine, with no document leaving it.
Why it matters
Running skills inside the main process is a known risk in agent frameworks: a faulty skill, or a malicious script, reaches the system itself. Putting every session in its own sandbox and limiting network egress closes that class of problem at the architectural level.
Asking the user before a memory becomes persistent points the same way: what the agent remembers is the user's decision.
