Limitations

Stated plainly, because technical buyers test them first.

Platforms

Not supported	Detail
macOS	No build, on Intel or Apple silicon
Windows (native)	No native build. Use WSL 2
32-bit x86	No i686/i386 target

ARMv7 is published on a best-effort basis. It is not a release gate, so an artefact may be absent for a given version. Pin a tested version rather than tracking latest if your fleet depends on it.

Full detail in System Requirements.

A model endpoint is required

--base-url has no default, and the binary supplies the agent, not the model. You need an OpenAI-compatible endpoint reachable from the machine: hosted, on-premises, or a local server.

This is a deliberate trade. No default endpoint means no accidental data egress: nothing leaves your network unless you point it somewhere.

Structured Text is not compiled

oasis-cli is a build orchestrator, not a toolchain vendor. The IEC 61131 module ships checks and guidance rather than tools.

Structured Text is compiled by a toolchain mutexer deliberately does not carry. Rather than writing ST into a repository that cannot build it, the agent is directed to say so. If you need ST compilation, supply the toolchain. The module tells you whether it is present and usable.

Five checks are indicative, not proven

Of 45 check descriptors, 40 are classed proven and 5 are indicative. An indicative check is an inference, not a direct measurement of the property in its title.

The two control-loop checks in the preempt-rt module are the clearest example: they infer loop behaviour without telemetry from the loop itself. They are labelled that way on purpose, and an audit report says so in its summary block, in capitals, when any finding short of proven contributed to the assessment.

See Conformance Checks.

An audit report is evidence, not a conformity assessment

The report says this on its face. It records what was measured and what could not be, with framework mappings and remediation. It does not certify anything, and it is not a substitute for an accredited assessment.

Hard-stop tools always prompt

A PLC write, a motion command, energising an output: these prompt in every permission mode, including dangerous, and --skip-permissions does not waive them.

This is a safety property, not a gap, but it does mean you cannot build a fully unattended pipeline that performs a physical write. An unattended run that reaches for one will stall waiting for a human.

One session per process

A served process owns one conversation and one connection at a time. Serving many conversations concurrently is a broker's job, and there is no broker.

A client that disconnects and returns is served normally, so this is rarely the constraint it sounds like, but if you need N concurrent conversations, you need N processes.

The control protocol has no network transport

There is no network listener, no TLS and no TCP. OCP speaks over stdio or a unix socket only.

Remote access is ssh host oasis-agent connect /run/oasis.sock, or any other tunnel you already trust. Where a stream needs securing, the thing carrying it secures it.

Four OCP methods are off by default

config.set, checks.run, audit.run and update.apply reshape the host and answer unsupported unless the server was started with --allow-host-mutations.

Authorisation is separate work that has not landed. Until it does, anyone who can open the socket can call anything the build enables, so enable those four only when you control who can reach the socket.

config.set additionally refuses skip_permissions, mode, cwd, api_key and actor in every configuration. Those are set by whoever starts the process.

MCP scope

Oasis CLI implements initialize → tools/list → tools/call. Resources, prompts, sampling and roots are not implemented.

A partial implementation of each would be worse than their absence. A client that half-supports a capability is harder to reason about than one that does not claim it.

There is also no mcp.login OCP method: an OAuth browser flow needs a browser and a terminal a served process does not have. Run oasis-agent --mcp-login out of band.

The audit trail is best-effort

An unwritable audit path never fails a tool call. A full disk or a read-only home directory stops the log without stopping the agent.

The trail also records file writes only. Bash can write files without appearing in it, and protocol writes are not in it at all. If your environment requires that no unaudited write can occur, enforce that outside the agent: a read-only mount, or auditd.

See Audit Trail.

Changing the tool set costs one cold prefill

The tool schema is part of the prompt prefix the model server caches, so enabling or disabling a capability pack, or adding an MCP server, reprocesses the whole prompt once (~13 k tokens).

Steady-state reuse is 94–100%; the cost is paid on the change, not on every turn. Decide your pack and server configuration per project and leave it alone.

What PREEMPT_RT does and does not cover

The preempt-rt module assesses real-time readiness, not every conceivable timing requirement. PREEMPT_RT achieves hard real time within defined bounds and covers the vast majority of industrial control loops comfortably.

Edge cases that need faster cycle times (high-speed motion synchronisation, certain servo loops) still exist. They are the exception, not the rule, but the checks will not tell you your application is one of them.