Show HN: Hydra, a local-first trust control plane that routes AI by confidence

Hydra — Multi-Model AI Orchestration CLI

local-first · provider-neutral · trust control plane

The local-first Trust Control Plane for AI. Hydra discovers every model on your machine — CLI agents, API keys, local servers — and routes each task to the cheapest head that clears your target confidence.

move your cursor · scroll ↓

Where we fit in the universethe uncontested quadrant

Every other tool is a hosted proxy.
We built the local-first one.

Cloud gateways route your traffic through their servers. Eval tools score answers after the fact. Local runtimes each manage only their own models. Plot the field on two axes — hosted↔local and cost-routing↔trust — and one quadrant sits empty. That is where Hydra lives. Hover any star.

hosted · proxy-first

local-first · on-device

trust · confidence

cost · latency routing

Cloud gateways Eval & observability Local runtimes Frontier heads (destinations) Hydra

The math, drawnmechanism, not decoration

Three curves that run the router.

Routing isn't vibes. Hydra rides the cost/quality Pareto frontier, stops sampling the instant confidence clears the bar, and reads the code graph to know when a change is dangerous. Here is the actual math.

a · cost vs quality

The Pareto frontier

Single models are dots. For any one of them, Hydra's routed curve reaches equal or better quality at lower cost — it picks the best head per task.

cost per task → quality → Haiku Flash GPT-class all-Claude Hydra routes here

b · optimal stopping

Confidence, then stop

Hydra polls heads until the sequential test (SPRT) crosses your target confidence — then it stops early and banks the unspent heads.

heads queried → confidence → target 0.95 accept ✔ stopped early

c · percolation-κ

Blast radius (Molloy–Reed)

κ = ⟨k²⟩/⟨k⟩. A hub file with many transitive dependents is cascade-capable — so it demands more confidence. Hover a node.

hover a node — κ & blast radius

Live routingwatch a task fall down the cost ladder

Cheapest head that clears the bar — with a local floor.

A task is classified, then falls down the ten-tier ladder (red = expensive, green = free/local) to the cheapest head that fits. If that head rate-limits, the fallback fires — terminating at local Qwen, which never runs out.

dispatch --enum STANDARD --file internal/auth/token.go classifying…

TIER LADDER — cost ↓ prompt "rotate the signing key in token.go" classify → STANDARD · target 0.95 blast κ=3.1 ⚠ 12 dependents → bar raised openrouter · T6 primary head qwen · T10 · local terminal fallback · always on

tier cost ramp active route fallback fired local terminal floor

By the numbersevery number has a mechanism

Loud numbers. Real levers.

No tokens-processed arms race. Each of these is something you can reproduce on your own machine with hyctl stats and hyctl probe.

73%

cheaper, typically

Median cost avoided by routing boilerplate away from the frontier orchestrator to a mid or local head. Reproduce with hyctl stats.

58%

kept 100% local

Share of tasks that never left your machine. No hosted gateway can claim this.

0.95

target confidence

Routes to a calibrated confidence-of-correctness, then stops early via SPRT.

12

heads discovered

CLI agents + API keys + local servers found on a typical dev box. Run hyctl probe.

100%

offline-capable · ~0ms routing overhead

The router runs on-device with zero network calls to decide. Local Qwen is the always-on terminal fallback, so a dispatch never hard-fails on a rate limit.

Hydra vs the gatewaysonly one is local-first + trust + ledger

Others route your traffic. Hydra routes on your metal.

Cost routing and fallback are table stakes — most tools have them. The differentiators are the rows nobody else can check: local-first, confidence/trust routing, and an on-device accountability ledger.

The interactive agent-tree cockpit is the one roadmap item here — every row checked above ships today in the CLI (hyctl dispatch --confidence, hyctl graph blast, hyctl mcp).

Getting startedthree commands

Installed to first dispatch in under a minute.

01 — INSTALL

Get the binary

One Go binary. No daemon, no account, no cloud.

$ brew install ankit373/hydra/hyctlcopy

$ npm install -g hyctlcopy

$ pip install hyctlcopy

$ curl -fsSL …/install.sh | shcopy

🍺 hyctl 1.x installed · or run once with npx hyctl

02 — DISCOVER

Scan your machine

Finds every head: CLI agents, API keys, local servers.

$ hyctl probecopy

✓ 12 heads · agy · gemini · openrouter

ollama(qwen) · lmstudio · …

03 — DISPATCH

Route a task

Classify → tier → cheapest head that clears confidence.

$ hyctl dispatch --enum SIMPLE …copy

→ T8 gemini-flash · $0.0001

✓ done · saved $0.0149 vs all-Claude

Stop paying frontier prices
for boilerplate.

One cortex, many heads. Route each task to the cheapest head that clears your bar — on your own hardware, with your spend and policy staying home.

AI Article