Open source · Apache-2.0 · Self-hostable

The AI COO
with safe hands.

Business OS runs the routine operations of your business (semi-)autonomously: inventory, scheduling, reporting, outreach. Anything that matters waits for you. Every action leaves a receipt.

Get it on GitHub See how it thinks →
Deterministic core One gate for every action Append-only audit log MCP native, both ways

Why this exists

AI finally has a brain.
It never had safe hands.

Most agentic projects don't fail on capability. They fail on ungoverned cost, risk and control. An assistant that can act on your business needs hands that are predictable, auditable and impossible to overreach. Business OS is those hands: your AI proposes, deterministic code disposes, and nothing consequential happens without passing a gate it cannot approve for itself.

Architecture

The deterministic core does 95% of the work.
At $0.00.

Rules compile to plain, readable SQL: no prompts, no agent chatter, no token burn. Scheduled heartbeats run your checks; reflexes act on what they find. The LLM is summoned only at the edges, where language and judgment are genuinely needed.

Heartbeats, not agents

Scheduled pulses run detection rules as indexed SQL, every 15 minutes, daily, weekly. Agents are configurations triggered by task type, never processes burning tokens in a loop.

Rules you can read

No custom DSL, no black box. A rule is a readable condition with a human-authored “why”, a plain-English auto-summary, and a dry-run preview. Legible to your whole team.

LLM only at the edges

Drafting an email, explaining a decision, the weekly executive summary. Every call is routed to the cheapest capable model, priced, and logged. Bring your own API key.

a rule, as it actually runs
-- every fast heartbeat · token-free · indexed
SELECT id FROM entities
WHERE  type = 'stock_item'
AND    stock_level < threshold;

“Every morning, if an ingredient is below its reorder threshold and no open reorder task exists, create one.” That summary is rendered from the rule itself, so it can never drift.

Watch one decision, end to end

A carton of milk runs low.
Here is everything that happens.

  1. HeartbeatThe fast pulse runs its detection rules. Pure SQL, $0.00.
  2. ReflexMilk 1L is below threshold. A reorder task is created: deduped, on cooldown.
  3. The gateThe purchase order crosses your spend threshold. The gate holds it. Nothing is sent.
  4. BriefYou get a grounded, plain-language reason and an approve link on your phone.
  5. ReceiptApproved. The order goes out and every step is written to the append-only log.

The safety spine

Nothing acts without passing the gate.

Every external effect (an email, a purchase order, a payment) passes one single chokepoint that classifies its impact, applies your approval policy, and writes a receipt. Not a promise. A property of how the system is built.

One side-effect gate

Handlers are pure functions that return intents. They literally cannot call out. The gate fails closed: anything not declared benign is held for a human.

AI proposes. Code disposes.

The LLM's output is inert, validated data, never a direct action. A proposer can never approve its own proposal, even when another AI is driving the system.

Human-in-the-loop by policy

Spend, legal, data-export and outreach thresholds force approval, with multi-party sign-off and segregation of duties where the stakes demand it.

Append-only audit log

Who, what, when, why: every approval, every action, every dollar. Exportable by you, in documented formats, at no cost. Forever.

A cap, not a forecast

Every LLM call is priced against a price book before your eyes. The owner-set monthly budget is enforced by the core, not estimated after the fact.

The global pause

One switch stops every autonomous action, instantly. Autonomy defaults to zero until you explicitly grant it, and it never silently grows.

The safety spine and the audit log are never gated behind a paid tier. Read the guarantee →

Governance & audit

Every decision can explain itself.

Autonomy without accountability is a liability. In Business OS, every action carries its full provenance: the rule that fired, the values it matched, who proposed, who approved, what it cost. Assembled from the append-only log, not generated after the fact.

explain this decision
DECISION TRACE · task #4127 triggerrule “low stock” · stock_level 8 < 10 inputconsumption +18% · lead time 2 days proposedpurchase order €412.80 · agent: operations gateimpact: spend → held for approval approvedanna@cafe (owner) · 09:14 co-signnot required under €500 policy cost$0.0041 (rationale) · $0.00 (everything else) receiptlogged append-only · exportable, free, forever

An audit log that can't be edited

Who, what, when, why: every approval, every action, every dollar, in an append-only record. Built for accountability and compliance, not reconstructed for it.

Co-sign & segregation of duties

Declarative approval policies: multi-party, sequential, N-of-M. The approver can never be the proposer, enforced by the gate against the audit trail itself.

Provenance on every receipt

Human, agent, or external system: every actor in a decision's chain is on the record. “Why did this happen?” is a lookup, never an investigation.

Your record, your exit

Export your entire audit history in documented formats at no cost, always. Managed retention is a service; the record itself is never for sale.

Bring your own brain.

The slot above the gate is open by design. A board-level governance app, an independent auditor co-signing high-stakes decisions, or the AI assistant your team already uses: any of them can observe and drive the OS through the same API and MCP surfaces. All of them under one unbreakable rule: whoever proposes can never approve.

Meet the Governance & Auditor apps →

One core, every direction

Connected to everything.
Governed at one point.

Business OS doesn't compete on a connector catalog. It makes every connection trustworthy. Whatever enters, whatever drives it, whatever it touches: everything flows through the same typed core and the same gate.

mcp · inbound

Any MCP server, through the gate

Every SaaS shipping an MCP server is a connector you don't wait for: thousands of tools, each entering as a governed capability that is impact-declared, gated, and receipted. Elsewhere it's an ungoverned tool call; here it passes the gate.

mcp · outbound

Any AI as the operator

The OS is itself an MCP server: Claude, ChatGPT, Copilot, or an agent you build can run your operations through it. High-stakes actions still park for a human the driver cannot impersonate.

http · /api/v1

API-first, to the bone

A versioned, typed HTTP API validated by the same schemas as the core. The dashboard is just one client; your tools, your scripts, your mobile app are equal citizens.

events · webhooks

One event stream, many listeners

Task created, approval needed, threshold crossed, report ready: Slack, n8n, Zapier and your ERP subscribe to the same live stream the dashboard itself runs on.

headless · cli

Runs with no UI at all

Config-as-code provisioning, an operational CLI, a daemon that needs no dashboard. Even fully headless, an approval still reaches a human. The guarantees never depend on who's calling.

bridge · local

Reaches the physical world

A dependency-free local bridge (mutual TLS, zero supply chain) exposes on-premise devices and machines. Fast, safety-critical loops stay local; the OS coordinates, logs and governs from above.

And your business logic is just another module: composable templates over a typed SDK. Nine ship free, from café to commerce to volunteer scheduling, and the ones you author are yours to license, sell, or build a practice on.

cafésupport triagerenewalsvision monitoringnonprofitcommercereservationproduct voicevolunteer scheduling+ yours

A system you can talk about

Small vocabulary. Zero mystery.

Heartbeatthe scheduled pulse Reflexa rule that acts, no LLM Cooldownnever twice, never too soon Briefa decision parked for you Receiptthe “why” on every action Round-upthe nightly analysis pass Nerve centerthe orchestrator

And when you wonder what's going on, just ask “What's the status of the milk order?” and get a read-only, grounded answer from your own data.

Open source

Free forever.
No “enterprise security” tier. Ever.

Business OS is Apache-2.0, genuinely OSI open source. The complete deterministic core, the full safety spine and audit log, the dashboard, the API and MCP surfaces, headless mode, the template SDK: self-host it all, for any business, at any size. The commercial layer is services on top, never features taken out.

Star on GitHub Premium services →
git clone https://github.com/pepijnstribos/business-os && pnpm install && pnpm dev