{"id":"781241a3-0ed3-4e6c-9a54-ab9f2885848a","slug":"oc8","kind":"mcp","name":"oc8","summary":"Open-source AI business orchestration platform for running governed AI agents across ERP, CRM, Microsoft 365 and other business systems.","owner":"oc8-ai","repoUrl":"https://github.com/oc8-ai/oc8","license":"LGPL-3.0","licenseTier":"weak-copyleft","trust":"community","stars":129,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-08-24T09:16:13.000Z","addedAt":"2026-10-14T05:14:15.129Z","logoUrl":"https://avatars.githubusercontent.com/u/307440613?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["search","memory-knowledge"],"tags":["agentic-ai","ai-agent","ai-agents","ai-orchestration","business-automation","enterprise-ai","erp","fastapi"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-15T02:51:26.338Z","sample":false,"url":"https://conduits.dev/tools/oc8","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# oc8\n\n<p align=\"center\"><img src=\"frontend/public/octopus_oc8.svg\" width=\"160\" alt=\"oc8 Octopus\" /></p>\n\n<h3 align=\"center\">The AI Business Orchestration</h3>\n\n<p align=\"center\"><strong>Become an AI-first business today.</strong></p>\n\n<p align=\"center\">\n  oc8 is an open-source, self-hosted AI agent orchestration platform for businesses.\n  It lets AI agents securely work across ERP, CRM, Microsoft 365, Odoo, Slack and other business systems through MCP,\n  with human approvals, guardrails and audit trails.\n</p>\n\n<p align=\"center\">\n  <a href=\"https://oc8.ai\">Website</a> &middot;\n  <a href=\"https://docs.oc8.ai\">Docs</a> &middot;\n  <a href=\"https://discord.com/invite/vEYpvzXUv\">Discord</a>\n</p>\n\n<p align=\"center\">\n  <a href=\"docs/GETTING_STARTED.md\">Getting Started</a> &middot;\n  <a href=\"ARCHITECTURE.md\">Architecture</a> &middot;\n  <a href=\"ROADMAP.md\">Roadmap</a> &middot;\n  <a href=\"docs/DEPLOY.md\">Deploy</a> &middot;\n  <a href=\"SECURITY.md\">Security</a>\n</p>\n\n- 🔒 **Isolated AI Agents** — each agent runs in its own container, with\n  access only to what oc8 explicitly grants it.\n- 📚 **RAG Knowledge Base Management** — retrieval-augmented knowledge,\n  scoped per agent or department.\n- 🧠 **Works With Any LLM** — Anthropic, OpenAI, OpenRouter, local Ollama,\n  or any OpenAI-compatible endpoint.\n- 🛡️ **Sovereign by Design** — self-hosted; your data and credentials never\n  leave infrastructure you control.\n- 🏢 **Scoped and Built for Enterprise Usage** — tenant isolation, audit\n  trails, and approval thresholds from day one.\n- 🔌 **Works With Your Existing Stack** — oc8 orchestrates the CRM, ERP,\n  and tools you already run; nothing to rip out and replace.\n- 🧑‍⚖️ **Human in Control** — every consequential action waits for approval\n  unless you've explicitly said otherwise.\n- 🧩 **Extensible in Every Direction** — the capa system: connectors,\n  skills, tool packs, and department templates as installable folders.\n- 🔗 **Built on Open Protocols** — every tool call goes through the same\n  governed MCP gateway, compatible with standard agent tooling.\n- 📈 **Built to Scale** — from a single agent to a full digital workforce.\n- 🗂️ **Knowledge & Tool Management for Agents** — assign exactly what each\n  agent can read, call, and use.\n- 🏙️ **Your Digital Company** — departments, agents, and approvals that\n  mirror how your business actually runs.\n\n> **Status:** oc8 is under active development. Read\n> [Scope and limitations](docs/SCOPE_AND_LIMITATIONS.md) before a production\n> deployment.\n\n<p align=\"center\"><img src=\"frontend/public/demo.gif\" width=\"880\" alt=\"oc8 UI walkthrough: the Office dashboard's live department view, the Agents list, an agent's detail page, its streaming Live Log, an approval request with full context, and the Costs dashboard\" /></p>\n\n**oc8 turns \"hire someone to do this\" into a configuration you can inspect,\napprove, and audit.** You describe the outcome, the agent proposes how it'll\nget there, and every consequential step — a write, a send, a spend past a\nthreshold — waits for a human unless you've explicitly said otherwise. Your\nexisting software landscape stays exactly where it is — oc8 orchestrates it,\nit doesn't replace it.\n\n## oc8 is for you if\n\n- ✅ you want an AI agent to actually *do* recurring work — triage tickets,\n  draft and send replies, update records in a real business system — not just\n  answer questions in a chat window.\n- ✅ you need to know, after the fact, exactly which agent did what, when, and\n  under whose approval — not just trust that it behaved.\n- ✅ you'd rather self-host on infrastructure you control than hand your\n  business data and credentials to someone else's cloud.\n- ✅ you want to plug in the tools you already use (a CRM, a helpdesk, a\n  knowledge base) without hand-rolling an integration for each one — or\n  ripping out and replacing what already works.\n- ✅ \"run this in an isolated container, not my agent host\" is a requirement,\n  not a nice-to-have.\n\n## How it works\n\n| Step | What happens |\n| --- | --- |\n| 1. Describe | State the outcome in plain language: \"classify incoming tickets, draft a response, escalate anything about billing.\" |\n| 2. Configure | Assign a model, the knowledge and tools it needs, and the autonomy/escalation boundary — or let the built-in Copilot draft the configuration for you to review. |\n| 3. Run | The agent executes on a schedule, an event, or a chat message; every governed action is checked against its permissions before it happens. |\n| 4. Govern | Anything over a value threshold or on an always-ask list waits for a human — from the inbox, or from Telegram/WhatsApp. |\n\n<br/>\n\n<div align=\"center\">\n<table>\n  <tr>\n    <td align=\"center\"><strong>Works<br/>with</strong></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/claude.svg\" width=\"32\" alt=\"Claude Code\" /><br/><sub>Claude Code</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/codex.svg\" width=\"32\" alt=\"Codex\" /><br/><sub>Codex</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/opencode.svg\" width=\"32\" alt=\"opencode\" /><br/><sub>opencode</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/nanoclaw.svg\" width=\"32\" alt=\"nanoclaw\" /><br/><sub>nanoclaw</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/bash.svg\" width=\"32\" alt=\"Bash\" /><br/><sub>Bash</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/http.svg\" width=\"32\" alt=\"HTTP\" /><br/><sub>HTTP / MCP</sub></td>\n    <td align=\"center\"><img src=\"frontend/public/logos/openrouter.svg\" width=\"32\" alt=\"OpenRouter\" /><br/><sub>OpenRouter</sub></td>\n  </tr>\n</table>\n\n<em>Any agent runtime that can be sandboxed and driven through oc8's gateway is hireable.</em>\n\n</div>\n\n<br/>\n\n## What's under the hood\n\n```\n                         ┌─────────────────────────┐\n                         │        caddy (edge)      │\n                         └────────────┬─────────────┘\n                    ┌──────────────────┴───────────────────┐\n                    │                                       │\n           ┌────────▼────────┐                    ┌─────────▼─────────┐\n           │     frontend      │                    │      backend       │\n           │  (React/Vite SPA) │◄──────REST/WS──────│  (FastAPI, API v1) │\n           └────────────────────┘                    └─────────┬──────────┘\n                                                                 │\n                     ┌───────────────────┬───────────────────┬─┴───────────────┐\n                     │                   │                   │                 │\n              ┌──────▼──────┐    ┌───────▼──────┐   ┌────────▼───────┐  ┌──────▼──────┐\n              │   worker      │    │  scheduler    │   │ ingestion-worker│  │  postgres    │\n              │ (run executor)│    │ (cron/trigger)│   │  (RAG ingest)   │  │  + pgvector  │\n              └───────┬───────┘    └───────────────┘   └─────────────────┘  └─────────────┘\n                      │\n                      │ isolated-runtime agents (opt-in per agent)\n                      ▼\n              ┌──────────────────────┐\n              │  runtime-provisioner   │  the ONLY process with Docker socket access\n              └──────────┬─────────────┘\n                         │ one container per agent — spawned, reaped, never shared\n        ┌────────────────┼────────────────┬────────────────┐\n        │                │                │                │\n  ┌─────▼─────┐    ┌─────▼─────┐    ┌─────▼─────┐    ┌─────▼─────┐\n  │  agent A   │    │  agent B   │    │  agent C   │    │  agent N   │\n  │ container  │    │ container  │    │ container  │    │ container  │\n  │ own tools, │    │ own tools, │    │ own tools, │    │ own tools, │\n  │ own creds  │    │ own creds  │    │ own creds  │    │ own creds  │\n  └────────────┘    └────────────┘    └────────────┘    └────────────┘\n```\n\nEvery isolated agent gets its own container — no shared filesystem, no shared\ncredentials, no visibility into another agent's tools or data. The\n`runtime-provisioner` is the only process in the stack that ever touches the\nDocker socket, so the backend and worker processes themselves never carry\nthat (host-root-equivalent) privilege.\n\n| System | What it owns |\n| --- | --- |\n| **Microkernel core** | Agents, runs, approvals, memory, tools, secrets — no vendor-specific logic. |\n| **Capas** | Everything Odoo-, Slack-, or vendor-specific. A connector, tool pack, or skill is a folder, not a fork. |\n| **MCP tool gateway** | The one and only MCP server an agent ever sees; every external call is governed and auditable here. |\n| **Postgres + RLS** | Row-level security keyed on a tenant GUC set per transaction — the enforced isolation primitive, not application-level filtering. |\n| **Runtime isolation** | An agent runs in-process by default, or in its own Docker/Podman container for stronger blast-radius containment — either way, it only ever sees the knowledge, tools, and credentials oc8 explicitly grants it, never anything more. |\n| **Secret store** | Envelope-encrypted credentials (AES-256-GCM, per-tenant DEK under an operator-held KEK) — never plaintext, never in the codebase. |\n\nFull write-up, request-flow walkthrough, and design decisions: [ARCHITECTURE.md](ARCHITECTURE.md).\n\n## What oc8 is not\n\n| It's not... | Because... |\n| --- | --- |\n| A chatbot | An agent here does work — writes, sends, updates records — not just answers questions. |\n| A no-code automation builder | Automations are scoped to what a governed agent can safely do, not arbitrary workflow graphs. |\n| A prompt-management tool | Prompts are one input to an agent's configuration, not the product. |\n| A hosted service | oc8 runs on infrastructure you control; there's no account to create with us. |\n| A place to paste secrets into chat | Credentials live in an encrypted secret store the agent never reads directly — see [ARCHITECTURE.md](ARCHITECTURE.md#the-secret-store). |\n\n## Quick start\n\nFollow the complete [Getting Started guide](docs/GETTING_STARTED.md), or use\nthe guided local installer:\n\n```bash\n# Run oc8 locally (Docker)\ngit clone https://github.com/oc8-ai/oc8.git\ncd oc8\n./scripts/quickstart.sh          # macOS / Linux\n# PowerShell on Windows:\n./scripts/quickstart.ps1\n```\n\nThe scripts check Docker, ask which mode to run (**Community** — empty, real\npassword setup; **Demo** — seeded bilingual ACME showcase behind a real\npassword login, good for a hosted walkthrough on a custom domain; or **Dev** —\nseeded ACME data with an unauthenticated instant login, localhost only, never\nexpose it). For Community/Demo, they also ask whether you already run your\nown reverse proxy on this host (binds oc8 to `127.0.0.1` on a plain port\ninstead of letting Caddy grab `:80`/`:443` or provision a certificate) or\nwant oc8's own Caddy to handle HTTPS on a custom domain instead. Then the\nscripts create missing `.env` secrets without overwriting existing values,\nbuild and start the stack, wait for its health endpoint, and print the URL. A\nfresh Community installation opens the local administrator setup wizard. Then\nconfigure a model, create an agent, and run a first task.\n\nNon-interactive/scripted runs (no terminal attached) default to Community mode\nwith no proxy and no custom domain, same as before — set\n`OC8_QUICKSTART_MODE` (`community`/`demo`/`dev`), `OC8_QUICKSTART_OWN_PROXY`\n(`y`/`n`, plus `OC8_QUICKSTART_PROXY_PORT`/`OC8_QUICKSTART_EXTERNAL_URL` when\n`y`), and `OC8_QUICKSTART_DOMAIN` to preset the answers instead of being\nprompted.\n\n## Your first automation\n\n1. Create an agent and state one clear outcome under **Mission & Automation**.\n2. Select its model, knowledge, and the minimum tools it needs.\n3. Choose when it starts: manually, on a schedule, or from a capa event.\n4. Define autonomy and escalation boundaries.\n5. Test with a low-risk task, then review activity and audit events.\n\nYou can alternatively tell the OC8 Copilot what you want, for example:\n\"Prepare an agent that classifies support requests and escalates payment or\nsecurity cases.\" It will create a reviewable proposal — it never activates or\nchanges anything without an authorized person applying it. The Copilot\nreceives capabilities, not credentials: it cannot read secret values, shell\ninto hosts, or apply changes itself.\n\n## Security model\n\n- Credentials are stored in an encrypted secret store and are not exposed to\n  normal agents or the OC8 Copilot.\n- OAuth and secret entry happen in dedicated human-controlled flows.\n- Capas are executable code and therefore a trust boundary; install only\n  code you have reviewed and trust.\n- The reference runtime provisioner is the only Compose service with Docker\n  socket access. That access remains host-root-equivalent.\n\nRead [SECURITY.md](SECURITY.md), [DEPLOY.md](docs/DEPLOY.md), and\n[SCOPE_AND_LIMITATIONS.md](docs/SCOPE_AND_LIMITATIONS.md).\n\n## FAQ\n\n**Why not just give my agent framework direct API access to my tools?**\nBecause then nothing stops an over-threshold action from executing before a\nhuman sees it. oc8's MCP gateway is the one path every tool call takes, which\nis what makes an approval threshold enforceable instead of advisory.\n\n**Do I need Kubernetes to run this?**\nNo. The reference deployment is a single `docker compose up` — Postgres,\nRedis, the backend and its workers, the frontend, and a Caddy edge proxy.\n\n**Can I add my own integration without forking the core?**\nYes — that's what the capa system is for. A data-only capa (a skill, a\ndepartment template, a tool pack's guardrail presets) needs no code at all;\nsee [capas/README.md](capas/README.md).\n\n**What happens if I don't configure any approval thresholds?**\nGuardrail presets shipped by a capa give you a sound default (e.g. always\nrequiring approval for a deletion, since it carries no monetary value to\nthreshold against) — you don't have to hand-assemble a policy from scratch.\n\n## Roadmap\n\nSee [ROADMAP.md](ROADMAP.md) for what's shipped and what's next — currently:\ncore agent/department/approval model, provider-neutral model routing,\nknowledge and memory with budgets, the capa framework, the MCP tool\ngateway, guardrail presets, Docker/Podman runtime isolation, an optional\nHMAC-chained audit trail, and encrypted backup/restore are all shipped;\nsandboxed execution for community-trust capas is next.\n\n## Repository map\n\n| Path | Purpose |\n| --- | --- |\n| `backend/` | API, workers, data model, agent runtime, migrations, tests |\n| `frontend/` | React/TanStack operator experience |\n| `capas/` | Open connector, skill, channel, and runtime extensions |\n| `docs/` | Deployment, operational, security, and getting-started guides |\n| `docker-compose.yml` | Reference deployment |\n\n## Development and verification\n\n```bash\ncd backend\npython -m pytest\npython -m ruff check src tests\n\ncd ../frontend\nnpm run lint\nnpm run test:unit\nnpm run build\n```\n\nFor a clean-install Compose smoke test:\n\n```bash\n./scripts/community-compose-fresh-install-smoke.sh\n```\n\n## Documentation\n\nStructured like [Odoo's documentation](https://www.odoo.com/documentation/19.0/):\n\n- [Documentation hub](docs/index.md)\n- [User documentation](docs/user/index.md) — run and operate oc8\n- [Install and maintain](docs/user/install-and-maintain/index.md)\n- [Developer documentation](docs/developer/index.md) — build capas\n- [Contributing](docs/contributing/index.md) — work on oc8 core\n\nReference:\n\n- [Getting Started](docs/GETTING_STARTED.md)\n- [Architecture](ARCHITECTURE.md)\n- [Roadmap](ROADMAP.md)\n- [Deployment guide](docs/DEPLOY.md)\n- [Scope and limitations](docs/SCOPE_AND_LIMITATIONS.md)\n- [Backup and restore](docs/BACKUP_RESTORE.md)\n- [Capa guide](capas/README.md)\n- [Security policy](SECURITY.md)\n- [Contributing](CONTRIBUTING.md)\n\n## About\n\noc8 comes out of the [BOP Alliance](https://oc8.ai/about), a network of\nsoftware partners spanning thousands of projects across dozens of\ncountries, after years spent connecting business systems by hand. An\nagent in oc8 isn't tied to one application — it reaches the ERP, the CRM,\nthe file store, and the accounting system in the same run, because they\nall speak one open protocol. Open by default, sovereign by design, human\nin control, built together with the community rather than a vendor\nroadmap decided behind closed doors.\n\n## Contributing and license\n\nPlease read [CONTRIBUTING.md](CONTRIBUTING.md),\n[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [SECURITY.md](SECURITY.md).\n\noc8 Community (`backend/` and `frontend/`) is licensed under the **GNU Lesser\nGeneral Public License v3.0 or later** (`LGPL-3.0-or-later`), see\n[LICENSE](LICENSE). A third-party dependency audit is\nrecorded in [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md). Each capa\nunder `capas/` also has its own license and provenance; see\n[capas/README.md](capas/README.md). Contributions are accepted under\nthe [Developer Certificate of Origin](https://developercertificate.org/) —\nsee [CONTRIBUTING.md](CONTRIBUTING.md).\n"}