Limitations

Stated plainly, because technical buyers test them first.

Platforms

Not supported	Detail
macOS	No build, on Intel or Apple silicon
Windows (native)	No native build. Use WSL 2
32-bit x86	No i686/i386 target

ARMv7 is published on a best-effort basis. It is not a release gate, so an artefact may be absent for a given version. Pin a tested version rather than tracking latest if your fleet depends on it.

Full detail in System Requirements.

A model endpoint is required

--base-url has no default, and the binary supplies the agent, not the model. You need an OpenAI-compatible endpoint reachable from the machine: hosted, on-premises, or a local server.

This is a deliberate trade. No default endpoint means no accidental data egress: nothing leaves your network unless you point it somewhere.

Two things soften it. check and audit are not gated on inference, so the conformance catalogue is usable on a machine that has no model server at all. And first-run setup will look for a local server, offer to install one, or let you defer the question and add an endpoint later.

A guided install changes the model server

If you accept the guided install at first run, it sets ollama's context length for the whole machine, by writing /etc/systemd/system/ollama.service.d/oasis-context.conf.

This is deliberate. ollama's 4096 default is smaller than the prompt Oasis CLI sends before you have typed anything, so the alternative is an install that completes and does not work. But it has two consequences worth knowing:

• It applies to every client of that ollama instance, not only to Oasis CLI.
• It survives an ollama upgrade, which is why it is a drop-in rather than an edit of the unit file.

Delete the file and restart ollama to undo it. The change is named on the consent screen before the install starts, and it is skipped entirely if you enter an address by hand.

Structured Text is not compiled

oasis-cli is a build orchestrator, not a toolchain vendor. The IEC 61131 module ships checks and guidance rather than tools.

Structured Text is compiled by a toolchain mutexer deliberately does not carry. Rather than writing ST into a repository that cannot build it, the agent is directed to say so. If you need ST compilation, supply the toolchain. The module tells you whether it is present and usable.

Five checks are indicative, not proven

Of 45 check descriptors, 40 are classed proven and 5 are indicative. An indicative check is an inference, not a direct measurement of the property in its title.

The two control-loop checks in the preempt-rt module are the clearest example: they infer loop behaviour without telemetry from the loop itself. They are labelled that way on purpose, and an audit report says so in its summary block, in capitals, when any finding short of proven contributed to the assessment.

See Conformance Checks.

An audit report is evidence, not a conformity assessment

The report says this on its face. It records what was measured and what could not be, with framework mappings and remediation. It does not certify anything, and it is not a substitute for an accredited assessment.

Hard-stop tools always prompt

A PLC write, a motion command, energising an output: these prompt in every permission mode, including dangerous, and --skip-permissions does not waive them.

This is a safety property, not a gap, but it does mean you cannot build a fully unattended pipeline that performs a physical write. An unattended run that reaches for one will stall waiting for a human.

One session per process

A served process owns one conversation and one connection at a time. Serving many conversations concurrently is a broker's job, and there is no broker.

A client that disconnects and returns is served normally, so this is rarely the constraint it sounds like, but if you need N concurrent conversations, you need N processes.

The control protocol has no network transport

There is no network listener, no TLS and no TCP. OCP speaks over stdio or a unix socket only.

Remote access is ssh host oasis-agent connect /run/oasis.sock, or any other tunnel you already trust. Where a stream needs securing, the thing carrying it secures it.

Four OCP methods are off by default

config.set, checks.run, audit.run and update.apply reshape the host and answer unsupported unless the server was started with --allow-host-mutations.

Authorisation is separate work that has not landed. Until it does, anyone who can open the socket can call anything the build enables, so enable those four only when you control who can reach the socket.

config.set additionally refuses skip_permissions, mode, cwd, api_key and actor in every configuration. Those are set by whoever starts the process.

MCP scope

Oasis CLI implements initialize → tools/list → tools/call. Resources, prompts, sampling and roots are not implemented.

A partial implementation of each would be worse than their absence. A client that half-supports a capability is harder to reason about than one that does not claim it.

There is also no mcp.login OCP method: an OAuth browser flow needs a browser and a terminal a served process does not have. Run oasis-agent --mcp-login out of band.

The audit trail is best-effort

An unwritable audit path never fails a tool call. A full disk or a read-only home directory stops the log without stopping the agent.

The trail also records file writes only. Bash can write files without appearing in it, and protocol writes are not in it at all. If your environment requires that no unaudited write can occur, enforce that outside the agent: a read-only mount, or auditd.

See Audit Trail.

Changing the tool set costs one cold prefill

The tool schema is part of the prompt prefix the model server caches, so enabling or disabling a capability pack, or adding an MCP server, reprocesses the whole prompt once (~13 k tokens).

Steady-state reuse is 94–100%; the cost is paid on the change, not on every turn. Decide your pack and server configuration per project and leave it alone.

What PREEMPT_RT does and does not cover

The preempt-rt module assesses real-time readiness, not every conceivable timing requirement. PREEMPT_RT achieves hard real time within defined bounds and covers the vast majority of industrial control loops comfortably.

Edge cases that need faster cycle times (high-speed motion synchronisation, certain servo loops) still exist. They are the exception, not the rule, but the checks will not tell you your application is one of them.