A self-hosted operating system for AI agents: it runs the engines, personas, workflows and runtime-forged tools, meets your users on every messenger, drives a real browser, and keeps a hash-chained audit of it all — with compliance built into the architecture, not bolted on.
The chat isn't a demo window — it's the shell. Personas, engines, workflows, the Forge, RAG, agentic compute and the A2A mesh are all reachable from one prompt. And you can drive it end‑to‑end by voice: speak a request, CorvinOS transcribes it, routes it, does the work, and speaks the answer back — tuned to how you listen. And you don't even need the console open: every messaging bridge is a full control surface, so you can run the whole OS straight from a Telegram, WhatsApp or Signal thread.
Hit the mic and talk. Speech is transcribed locally by default — the audio is deleted the moment it returns, and only metadata ever touches the audit chain.
One prompt reaches every layer
Every compliance mechanism is a structural design constraint. There is no "compliance mode" you can accidentally leave off.
One-time AI-nature disclosure per user, structurally locked. Cannot be disabled via configuration.
Deny-by-default consent for transcript sharing. Per-user, TTL-capped, re-validated at consume time. Every event appends to a SHA-256-linked chain. Tampering invalidates it. Offline-verifiable.
Compliance-zone routing and egress lockdown structurally prevent data from leaving the permitted zone.
That's Agentic Compute: the worker owns the loop, the model owns the framing. The agent says what to optimise and when to stop; a sandboxed worker picks the strategy that fits the problem and turns the crank — from a quick tune to a Bayesian search over an 8 GB dataset, and never a raw byte in the context window.
N iterations run in the worker — the model is idle until the result returns.
Evaluates every combination in the grid. Pre-generated at submit — deterministic and fully reproducible.
Uniform samples per batch from continuous ranges. One seed per run, stored for reproducibility.
A Gaussian-Process surrogate picks the highest Expected-Improvement points — finds a good region in the fewest runs.
A manager engine plans the task, delegates pieces to parallel worker runs, scores every result, and iterates toward a loss target. The point of the recursion is adaptation: where a capability is missing, a worker forges the tool or skill it needs at runtime — so the same flow can tune a model, run a backtest, or analyse an 8 GB dataset straight from a prompt.
Forge and SkillForge run inside the loop. A worker calls forge.create_tool()
and the tool is instantly available to every later worker; another calls skill.create()
and the skill is injected on the next turn. That runtime generation is the adaptation engine — how a plain-language question turns into a working analysis over data far too big for any context window.
The manager never touches your data. Every spawn passes the data gate, so only clean, redacted summaries flow back up the tree — bounded by a shrinking budget.
Register a dataset once. The same file is presented two ways — a redacted snapshot to the model, the real bytes to the sandbox.
data_handle
pandas.read_csv(path)
just worksPoint it at the databases you already run — the model queries them by name over the DSI protocol, and the raw rows never move.
You never draw the boxes and arrows. You describe an outcome in plain language — the manager delegates the run, and the execution graph discovers itself. Save that graph as a repeatable workflow, then export everything it needs — logic, tools, skills, personas and data bindings — into a single portable .awpkg
bundle.
Freezes the exact graph the run discovered — same nodes, same order — for a faithful re-run.
Generalises the graph into a reusable blueprint with parameters — point it at new inputs and run again.
A whole agentic-compute delegation tree — sub-managers, workers and their iteration loops — captures as one .awpkg
, ready to re-run the sweep.
An .awpkg
is a signed ZIP — the whole capability, not just the recipe. Install it into any tenant with one command and the tools, skills, personas and delegation logic all light up together. It declares; the runtime installs — no scripts, no binaries, eight fail-closed checks before a single byte is extracted.
The full AWP topology — agent steps, parallel fan-out/fan-in and recursive delegation_loop
nodes — plus triggers and delivery targets.
Every custom tool the run built, each pinned to a sandbox with network: deny
unless the manifest grants it.
Reusable skill bodies, linted before install and injected into the workers' future turns.
The roles the workers assume — so the packaged team behaves the same on any machine.
RAG-provider and datasource references travel; secret names are declared but their values stay in the vault — never in the package.
Run CorvinOS on one machine in your datacenter — it's just another node in the mesh, the one that happens to do the heavy agentic compute over your confidential data. Every team pairs with every other over A2A: no hub, no center. Anyone sends plain-language tasks, answers flow back, but the raw data never leaves the building.
Every connection is a Friendship Token — a shared HMAC key exchanged out-of-band. No platform sits in the middle; each node authenticates the other and audits every envelope on its own hash chain.
CorvinOS isn't a fixed product you conform to. It learns how you like to work, it builds the capabilities it's missing while it runs, and it opens cleanly to whatever else you need to plug in.
Voice & Profile tunes how each listener is spoken to — vocabulary, jargon level, depth — and personas route every turn to the right voice, tools and engine. Your overrides always win.
Hit a gap and a worker forges the tool and writes the skill — at runtime, mid-task. Each one persists and is instantly available to every later turn, so the system keeps getting more capable the more you use it.
Install external MCP servers from the catalog, add vendor layers through the Extension API, or drop in custom compute engines. The corvin.*
core stays cryptographically locked — an extension can add a guardrail, never weaken one.
From multi-channel messaging to runtime tool generation, CorvinOS ships production-grade infrastructure out of the box. Native daemons for Discord, Telegram, WhatsApp, Slack, Email, Teams and Signal. Hot-reload settings, per-chat profiles, rate limiting.
Forge generates schema-bound, sandboxed tools at runtime via MCP with a four-scope workspace hierarchy.
SkillForge injects markdown skills into future turns, with automatic grading, promotion gates and an injection linter.
Swap between Claude Code, Codex, OpenCode, local Hermes/Ollama and GitHub Copilot — no bridge changes. Adaptive Haiku/Sonnet model selection built in.
FTS5 SQLite recall with PII-redacted indexing and GDPR Art. 17 erasure via /forget
.
Register SQL and vector stores through the DSI protocol. The model queries them by name — raw rows never enter its context.
Drive a real Chromium — navigate, fill, click, read — while you watch live and approve sensitive actions. It acts by element index, not pixels; secrets come from the vault and never reach the model or the audit log.
Install external MCP servers from the catalog, or ship vendor layers through the Extension API — scoped per project, tenant or user. The corvin.*
core stays cryptographically locked; extensions add, never weaken.
Every action — model call, tool run, message, browser click — lands on a hash-chained log that's verified daily. Metadata only: never transcript text, typed secrets or raw rows.
The same runtime — bridges, voice, RAG, workflows, agentic compute, the data firewall and the A2A mesh — shows up very differently depending on who is asking. From one person on a laptop to a whole organization.
Talk to a single agent from Telegram, WhatsApp, Signal or the web — by text or voice. It carries your persona and profile across every channel, so it always sounds like your assistant.
Point retrieval at your documents and get grounded answers with sources. Everything is self-hosted on your own machine — no third-party inbox, no data handed to a SaaS.
Fire off a voice message and get a spoken reply tuned to how you like to listen. Speech is transcribed locally by default and the audio is deleted the instant it returns.
Connect the Postgres or Snowflake you already run. The team asks in plain language, the sandbox works on the real bytes, and only redacted, audited answers come back — raw rows never leave.
Design a multi-step AWP pipeline in guided natural language, run it on demand or on a schedule, and export the whole thing as one .awpkg
to share or re-run.
An agent handles your support channels, grounded in your own docs, with redaction always on and every action written to a hash-chained audit log you can actually verify.
Legal, support and data each run their own agent and delegate to one another over HMAC-signed envelopes — no hub, no central owner. Peers are scoped Observer or Executor.
A datacenter node runs 100-iteration sweeps, tuning and backtests over confidential data. Everyone sends a request and gets an answer back — the data stays put, the models stay idle while workers turn the crank.
EU-AI-Act and GDPR controls are structural, local-only engines keep CONFIDENTIAL tenants zero-egress, and you extend through the Extension API and MCP — while the corvin.*
core stays cryptographically locked.
Every bridge is a full control surface
Anything you can do in the console you can do from the messenger — pin a persona, run a workflow, kick off an agentic-compute sweep, query a database — by text or voice. CorvinOS meets your users where they already are.
Self-host the whole thing under Apache-2.0, forever. Upgrade only when you need to lift the limits.
Self-hosted & open source. Everything runs on your own infrastructure.
Everything unlocked. No feature gates, no seat math. Cancel anytime.
For organizations that need governance, residency and a support agreement. Open source under Apache-2.0. Star it, fork it, self-host it — no vendor lock-in, ever.