GitSeed – Self-hosted control plane for AI coding agents

GitSeed launched a self-hosted, vendor-neutral control plane for AI coding agents that runs Claude Code, Codex, Gemini and OpenCode inside isolated three-phase containers (prepare, agent, finalize) on the user's own infrastructure. The project ships Ed25519-signed PR Governance Receipts, parallel three-model Second Opinions and a docked sandbox rescue feature, and starts locally in under 5 minutes via Docker, exposing a Web UI on port 8421, a FastAPI control plane on 8420, an MCP server on 8422 with 65 annotated tools, a LiteLLM gateway on 4000, PostgreSQL 16 and Valkey. A Helm chart supports Kubernetes deployment, and the control plane provisions five stage agents (@ideator, @planner, @coder, @reviewer, @merger) plus @coordinator.

Self-hosted, vendor-neutral control plane for AI software engineering. Run Claude Code , Codex , Gemini , OpenCode , and more inside isolated 3-phase containers prepare → agent → finalize on your own infrastructure, complete with Ed25519-signed PR Governance Receipts , parallel 3-model Second Opinions , and live docked sandbox rescue. Quickstart quickstart · Why GitSeed? why-gitseed · How It Works how-it-works-the-5-stage-sdlc · Models & Personal Mode frontier-models-personal-mode--local-open-weight-llms · Security & Receipts broker-enforced-security--signed-governance-receipts · CLI & TUI developer-cli-gitseed · MCP Server mcp-server-gitseed-mcp · Architecture architecture--monorepo-layout · Concepts GitSeed-Demo-GitHub.mp4 Up and running locally in under 5 minutes with Docker no cloud account or external Git host required : git clone https://github.com/gitseed-dev/gitseed.git && cd gitseed ./scripts/init.sh generates .env secrets & prints your initial admin login Windows: .\scripts\init.ps1 docker compose up -d --build starts Web UI :8421 , API :8420 , MCP :8422 , LiteLLM & Postgres 1. Sign in at http://localhost:8421 http://localhost:8421 using the admin@gitseed.local credentials printed by ./scripts/init.sh or set GITSEED ADMIN PASSWORD in .env beforehand . 2. Connect a Model & Repo 1-Click Wizard : - Pick an API key Anthropic, OpenAI, Gemini, xAI , local Ollama / vLLM , or single-user Personal Mode CLI OAuth Claude Code , Codex , Gemini , Antigravity , Grok . This automatically provisions all 5 stage agents @ideator , @planner , @coder , @reviewer , @merger plus @coordinator . - Connect Git via 1-Click GitHub App , GitLab/Bitbucket token, or point directly at a Local Folder on disk. 3. Pick an API key Anthropic, OpenAI, Gemini, xAI , local 4. Plant Your First Seed : Create a project and submit a prompt full 5-stage pipeline, ⚡ Fast-Track straight to code, or 2–3 parallel model opinions , or click + New ▾ to open a live Coding Agent chat, Browser PTY terminal, or embedded VS Code Web session. Kubernetes Helm Deployment & Service Port Map Deploy to Kubernetes from the included Helm chart after pushing images to your cluster registry see charts/gitseed/README.md https://github.com/gitseed-dev/gitseed/blob/main/charts/gitseed/README.md : helm upgrade --install gitseed ./charts/gitseed \ --namespace gitseed \ --create-namespace \ --set image.repository=ghcr.io/gitseed-dev/gitseed \ --set runnerImage.repository=ghcr.io/gitseed-dev/runner | Service | Default URL / Port | Description | |---|---|---| | Web UI | http://localhost:8421 | React 19 control plane dashboard, live run logs, diff viewer, SessionDock , and ⌘K @coordinator | | VS Code Sandbox Origin | http://127.0.0.1:8423 | Dedicated cookie-less SANDBOX ORIGIN listener serving /api/v1/vscode/ isolated from Web UI cookies | | Control Plane API | http://localhost:8420 | FastAPI REST service /api/v1/ , short-lived SSE streams, WebSocket PTY, and OpenAPI docs /docs | | MCP Server | http://127.0.0.1:8422/mcp | Loopback-bound Streamable HTTP & SSE MCP endpoint 65 annotated tools; Bearer + Origin protected | | LiteLLM Gateway | http://localhost:4000 | Unified OpenAI-compatible proxy for cloud and local LLM backends with enforced per-run virtual keys | | PostgreSQL 16 | localhost:5432 | Primary relational store for control plane & LiteLLM | | Valkey | localhost:6379 | High-performance in-memory store for rate limits and pub/sub state | Ad-hoc coding prompts work for single files, but shipping production software with agents requires isolated execution, untrusted-agent containment, review gates, provenance, and spend controls: - Untrusted Agent, Trusted Broker prepare → agent → finalize : Coding agents run with zero Git credentials behind an SSRF-hardened egress-proxy ; a separate read-only finalize container enforces blocked paths and added-line secret scanning before pushing. - Ed25519-Signed PR Governance Receipts : Every Pull Request receives a cryptographically signed receipt gitseed.receipt.v1 attesting to the locked spec, models, spend mode, security scans, and human approvals, verifiable offline via gitseed receipt verify . - Parallel 3-Model "Second Opinions" : Dispatch up to 3 agents in parallel during Ideate , Plan , or Review to compare competing specs, task plans, or code reviews side-by-side before approving. - Cloud BYOK, Local GPUs & Single-User "Personal Mode" : Enforce hard per-run USD caps via LiteLLM cloud APIs or local Ollama / vLLM / LM Studio , or sign in with your personal Claude Pro/Max , ChatGPT Plus/Pro , or Gemini subscription inside an isolated container. - Autonomous Pipelines + Live Sandbox Rescue : Drop into any workspace from the persistent SessionDock persistent browser PTY terminal, Monaco, and isolated VS Code Web , leave inline diff comments, or @coder -steer an active run without losing progress. - 5-Stage SDLC or ⚡ Fast-Track + Self-Healing CI : Lock specs across Ideate → Plan → Execute → Review → Merge for complex features, ⚡ Fast-Track Execute → Review → Merge for quick fixes, auto-remediate failing PR CI checks, or sync against a zero-remote Local Folder . | Capability | Local Worktree Wrappers Desktop CLI Multiplexers | Cloud SaaS Agent Bots Managed Coding Services | GitSeed Control Plane | |---|---|---|---| | Execution & Trust Boundary | Local git worktree on your host OS shares host filesystem & credentials | Vendor-hosted cloud VM source code leaves your network | 3-phase prepare → agent → finalize containers on your infra; agent holds zero Git creds; :ro finalize enforces blocked paths & secret scan | | Model & Auth Freedom | Local CLI binaries installed on host | Tied to vendor credits & selected models | 6 CLI Runtimes opencode , claude-code , codex , antigravity , gemini , grok-build + Team LiteLLM APIs , Local Ollama/vLLM , & single-user Personal Mode OAuth | | Workflow & Second Opinions | Ad-hoc parallel prompts & manual branch comparison | Single-stage autonomous agent loop | 5-Stage SDLC or ⚡ Fast-Track + up to 3 parallel agent opinions per stage with locked specs | | Provenance & Auditability | Unstructured local terminal scrollback | Opaque vendor logs | Ed25519-signed Governance Receipts gitseed.receipt.v1 posted to PRs + CLI offline verification gitseed receipt verify | | Spend Controls | Passive token display after spend occurs | Subscription seat & usage credits | Enforced per-run LiteLLM virtual-key dollar caps API mode & Estimated token telemetry + hard timeout/turn caps Personal Mode | | Git & CI Automation | Single local repo per worktree | Remote cloud repos only | Multi-repo PRs GitHub/GitLab/Bitbucket , zero-remote Local Folder auto-sync , & self-healing CI remediation | | Interactive + Autonomous | Interactive split terminals | Asynchronous web ticket portal | Both : Autonomous pipeline plus docked Live Agent Sessions, Browser PTY, Monaco, & VS Code Web across Web, CLI/TUI, & MCP | php flowchart LR I "1. Ideate<br/ @ideator" -- P "2. Plan<br/ @planner" P -- E "3. Execute<br/ @coder" E -- R "4. Review<br/ @reviewer" R -- M "5. Merge<br/ @merger" | Stage | Default Agent | What the Agent & Broker Do | Human Gate & Output Contract | |---|---|---|---| | 1. Ideate | @ideator | Analyzes the seed prompt and repository structure to refine scope, edge cases, and testable acceptance criteria. | Validates IdeateStageOutput specification , acceptance criteria . Locks spec upon approval. | | 2. Plan | @planner | Decomposes the locked specification into ordered implementation tasks and identifies target repositories/files. | Validates PlanStageOutput plan , ordered tasks , target repositories . | | 3. Execute | @coder | prepare clones repos; agent writes code and runs tests in an isolated sandbox; finalize mounts /workspace:ro , enforces blocked paths & secret scanning, pushes gitseed/<project /seed-<N , and posts a signed Governance Receipt to the PR. | Validates ExecuteStageOutput + run.output "trusted" and opens/updates PRs on GitHub, GitLab, or Bitbucket. | | 4. Review | @reviewer | Audits branch diffs against the locked spec, plan, acceptance criteria, policy rules, and test results. | Validates ReviewStageOutput approved , findings . Supports Approve or Request Changes re-entry. | | 5. Merge | @merger | Confirms upstream gates and branch readiness, then merges the pull request into the target branch. | Final human sign-off MergeStageOutput , refreshed signed Governance Receipt, and automated remote PR merge. | Need to ship a straightforward bugfix? Toggle ⚡ Fast-Track to jump straight into Execute → Review → Merge while keeping clean-room finalize checks, signed Governance Receipts, and review gates intact. Read docs/concepts.md https://github.com/gitseed-dev/gitseed/blob/main/docs/concepts.md for a concise tour of Project , Seed , Run , Policy , and Agent . Every stage agent @ideator , @planner , @coder , @reviewer , @merger , @coordinator , or custom agents can be independently bound to a different CLI runtime and model backend, with transparent labeling of enforced vs. estimated spend controls: | Tier | Supported Providers & Engines | Agent Runtimes AgentRuntime | Spend Control & Governance Mode | |---|---|---|---| | Team & Enterprise Cloud APIs BYOK / LiteLLM | Anthropic Claude , OpenAI , Google Gemini , xAI Grok , LiteLLM , Custom OpenAI Gateways | opencode , claude-code , codex , antigravity , gemini , grok-build | Enforced enforced : Per-run LiteLLM virtual keys hard-capped at min monthly remaining, seed cap remaining, checkpoint remaining . | | Personal Mode Single-User Subscription OAuth | Claude Pro / Max , ChatGPT Plus / Pro , Gemini Code Assist , Google Antigravity , xAI Grok | claude-code , codex , antigravity , gemini , grok-build | Estimated estimated : Owner-bound owner user id single-user OAuth bundle encrypted at rest. Spend is estimated from CLI token telemetry and bounded by broker-enforced container timeouts timeout minutes and turn limits --max-turns where supported by the CLI . | | Local & Open-Weight LLMs Air-Gapped / On-Prem | Ollama :11434 , vLLM :8000/v1 , LM Studio :1234/v1 running open-weight models Qwen3-Coder , DeepSeek-V3 / R1 , Llama 4 , Codestral , Gemma 3 | opencode universal open-source agent runtime | Enforced enforced via LiteLLM gateway with zero marginal cloud token cost and full air-gapped data sovereignty. | Important Personal Mode cli oauth is strictly single-user and owner-bound. Consumer subscriptions Claude Pro/Max, ChatGPT Plus/Pro, personal Google accounts are licensed to one individual. GitSeed binds each Personal Mode backend to owner user id so other users cannot attach, run, or inspect it, and administrators can disable Personal Mode instance-wide with GITSEED ALLOW PERSONAL CLI OAUTH=false . For shared team projects or scheduled CI pipelines, use API keys via LiteLLM or local open-weight models. Runtime availability : opencode , claude-code , codex , antigravity agy , and gemini are pre-installed out of the box when building gitseed/runner locally docker compose up -d --build , where INCLUDE PROPRIETARY CLIS=true by default; pass --build-arg INCLUDE PROPRIETARY CLIS=false when building strictly FOSS-only or redistributed images . grok-build grok ships with a built-in runtime adapter in gitseed runner ready for custom layered binaries or GROK CLI INSTALL URL image builds. See apps/runner/README.md https://github.com/gitseed-dev/gitseed/blob/main/apps/runner/README.md third-party-agent-clis . GitSeed is architected around the principle that coding agents are untrusted SECURITY.md https://github.com/gitseed-dev/gitseed/blob/main/SECURITY.md : - 3-Phase Container Split prepare → agent → finalize : The agent container runs with CapDrop: ALL , no-new-privileges , non-root UID 1000 , no Docker socket, and zero Git credentials. All repository commits, blocked paths checks, and secret scans on added lines happen inside the separate finalize container, which mounts /workspace read-only :ro and commits via a clean .git directory outside the workspace. - Socket & Egress Proxies : Control-plane services communicate with Docker through a restricted docker-socket-proxy never mounting raw /var/run/docker.sock into api or scheduler , and runner containers reach external APIs only through an SSRF-hardened egress-proxy that blocks RFC1918 private networks, loopback, and cloud metadata 169.254.169.254 after DNS resolution. - Ed25519 Governance Receipts gitseed.receipt.v1 : Verify any Seed's provenance directly from the CLI online or completely offline against a pinned PEM key : gitseed receipt get my-project 1 -f receipt.json gitseed receipt verify receipt.json --public-key-file pubkey.pem See SECURITY.md https://github.com/gitseed-dev/gitseed/blob/main/SECURITY.md for the complete Threat Model, Enforced vs. Estimated Controls table, Known Residual Risks, and the test evil agent redteam.py https://github.com/gitseed-dev/gitseed/blob/main/apps/core/tests/test evil agent redteam.py adversarial verification suite. Install the CLI & interactive TUI gitseed tui via uv or pip or invoke via docker compose exec api gitseed : Authenticate against your control plane gitseed login http://localhost:8420 Inspect projects, seeds, runs, and governance policies gitseed get projects gitseed get seeds -p my-project gitseed describe seed my-project 1 Create or sync seeds from declarative Markdown manifests or Fast-Track straight to Execute gitseed create seed -f seed.md gitseed create seed "Fix OAuth callback timeout" -p my-project --summary "Increase timeout to 15s" --fast-track gitseed apply -f .gitseed/manifests/ Stream live container logs, inspect diffs, and steer, fast-track, or approve stages gitseed logs my-project 1 -f gitseed diff my-project 1 gitseed steer my-project 1 "Also add rate-limit headers to the response" -a @coder gitseed advance my-project 1 --fast-track gitseed approve my-project 1 -m "LGTM, spec and task plan look solid" Fetch and cryptographically verify a Seed's Ed25519-signed Governance Receipt online or offline gitseed receipt get my-project 1 -f receipt.json gitseed receipt verify receipt.json --public-key-file pubkey.pem Spin up an interactive sandbox or live coding agent session gitseed sandbox start -p my-project --seed my-project 1 -c "pytest -q" gitseed session start -p my-project --agent @coder -m "Investigate flaky auth test" Ask @coordinator to triage blocked seeds or summarize spend gitseed ask "Which seeds are awaiting review and what is our spend this week?" Launch the interactive split-pane Terminal UI k9s / lazygit style gitseed tui All inspection commands support -o table default , -o wide , -o json , and -o md GitHub-Flavored Markdown for CI summaries . See apps/cli/README.md https://github.com/gitseed-dev/gitseed/blob/main/apps/cli/README.md for the complete command reference. Connect Claude Code , Cursor , Windsurf , or Antigravity directly to GitSeed so your IDE agent can inspect seeds, read run logs, manage live agent sessions, and approve stage gates: stdio transport local CLI binary claude mcp add gitseed \ -e GITSEED API URL=http://localhost:8420 \ -e GITSEED TOKEN=gsp your pat token \ -- gitseed-mcp Or connect to the running Docker Compose loopback HTTP endpoint: URL: http://127.0.0.1:8422/mcp Header: Authorization: Bearer gsp ... Every MCP tool includes explicit ToolAnnotations readOnlyHint , destructiveHint , idempotentHint , openWorldHint , plus optional --toolsets and --read-only scoping so MCP clients can automatically allow read-only queries while prompting before state mutations. See apps/mcp/README.md https://github.com/gitseed-dev/gitseed/blob/main/apps/mcp/README.md for all 65 available MCP tools, resources, and prompts. - Inbound GitHub, GitLab & Bitbucket Webhooks services/webhooks.py https://github.com/gitseed-dev/gitseed/blob/main/apps/core/src/gitseed core/services/webhooks.py : - Issue-to-Seed Trigger : Labeling or opening an issue with the configured trigger label default gitseed automatically creates and queues a Seed linked back to the source issue. - PR Comment Steering : Commenting @coder , @planner , or @reviewer on a GitHub Pull Request or GitLab Merge Request syncs the comment into the Seed timeline and either steers the active container run in place or queues a remediation pass. - Self-Healing CI Remediation : When a GitHub Actions workflow or GitLab CI pipeline fails on a Seed branch check run / workflow run / pipeline , GitSeed automatically creates a remediation task with the failure details and dispatches @coder back to Execute to fix the build. - Zero-Remote Local Folder Git Sync services/local git.py https://github.com/gitseed-dev/gitseed/blob/main/apps/core/src/gitseed core/services/local git.py : - Create projects backed by a local directory on disk with no GitHub, GitLab, or Bitbucket account required. - GitSeed manages a refname-hardened bare Git repository exposed over internal Git Smart HTTP /api/v1/local-git/<slug .git for container runners and installs a sanitized post-receive hook that auto-stashes uncommitted local IDE changes, fast-forwards your working tree when a Seed merges, and restores your stash. flowchart TB subgraph Surfaces "Operator & IDE Surfaces" Web "apps/web<br/ React 19 Control Plane UI :8421 " CLI "apps/cli<br/ gitseed Terminal CLI & TUI" MCP "apps/mcp<br/ 65-Tool MCP Server :8422 " end subgraph ControlPlane "GitSeed Control Plane apps/core " API "FastAPI REST, SSE, Receipts & PTY Server :8420 " Sched "Background Scheduler & 3-Phase Reconciler" Common "packages/common<br/ Shared Pydantic v2 Schemas & Receipt Contracts" end subgraph Infra "State, Proxies & Model Routing" PG "PostgreSQL 16" DF "Valkey / Redis" LLM "LiteLLM Proxy :4000 " SockProxy "docker-socket-proxy" EgressProxy "egress-proxy DNS/IP Guard " end subgraph Compute "Isolated Compute apps/runner on gitseed-runners " Prep "1. prepare Container<br/ Trusted Clone & Hook Strip " Agent "2. agent Container<br/ Untrusted CLI Sandbox " Fin "3. finalize Container<br/ :ro Mount · Blocked Paths · Secret Scan · Push " Sandbox "Interactive Sandbox & Live Agent Session" end Web & CLI & MCP -- API API & Sched -- PG & DF & LLM Sched -- |Container API via| SockProxy SockProxy -- |Spawns| Prep -- Agent -- Fin API -- |Manages PTY / VS Code / Turns via| SockProxy -- Sandbox Agent & Sandbox -- |Filtered Egress| EgressProxy Prep & Fin -- |Single-Use Broker Tokens| API Agent -- |Scoped Agent Token + Model Calls| API & LLM | Workspace Path | Package | Description | |---|---|---| | apps/core https://github.com/gitseed-dev/gitseed/blob/main/apps/core/README.md | gitseed-core | FastAPI control plane API, 3-phase stage scheduler, Ed25519 governance receipts, Docker/K8s runtime supervisor, live agent sessions, PTY/VS Code proxy, and Alembic migrations. | | apps/runner https://github.com/gitseed-dev/gitseed/blob/main/apps/runner/README.md | gitseed-runner | 3-phase container supervisor prepare , agent , finalize executing opencode , claude-code , codex , antigravity , gemini , and grok-build with clean-room git finalization. | | apps/web https://github.com/gitseed-dev/gitseed/blob/main/apps/web/README.md | web | React 19 + TypeScript + Vite + Tailwind CSS v4 frontend with Kanban & table views, live stage timelines, diff review, governance receipts, and persistent SessionDock . | | apps/cli https://github.com/gitseed-dev/gitseed/blob/main/apps/cli/README.md | gitseed-cli | gitseed terminal CLI and split-pane gitseed tui for managing seeds, verifying signed receipts gitseed receipt verify , streaming logs, approving gates, and running sessions. | | apps/mcp https://github.com/gitseed-dev/gitseed/blob/main/apps/mcp/README.md | gitseed-mcp | gitseed-mcp server exposing 65 annotated tools readOnlyHint , destructiveHint , --toolsets , --read-only , 5 resources, 2 resource templates, and 4 workflow prompts over stdio , Streamable HTTP, and SSE. | | packages/common https://github.com/gitseed-dev/gitseed/blob/main/packages/common/README.md | gitseed-common | Shared Pydantic v2 schemas, stage output contracts STAGE OUTPUT SCHEMAS , GovernanceReceipt gitseed.receipt.v1 , and domain enums. | | charts/gitseed https://github.com/gitseed-dev/gitseed/blob/main/charts/gitseed/README.md | Helm Chart | Production Kubernetes Helm chart with dedicated sandbox namespace isolation, RBAC, and NetworkPolicies. | See docs/architecture.md https://github.com/gitseed-dev/gitseed/blob/main/docs/architecture.md and docs/concepts.md https://github.com/gitseed-dev/gitseed/blob/main/docs/concepts.md for deeper architectural documentation. The root Dockerfile https://github.com/gitseed-dev/gitseed/blob/main/Dockerfile packages the entire control plane into gitseed/gitseed , selectable via container command api | web | scheduler | egress-proxy | mcp | cli | migrate | help : docker build -t gitseed/gitseed:dev . docker build -t gitseed/runner:dev ./apps/runner docker run --rm gitseed/gitseed:dev help For local workspace development Python 3.12+ with uv https://docs.astral.sh/uv/ and Node.js 22+ with pnpm : 1. Install all Python & Web workspace dependencies uv sync --all-packages pnpm --filter web install 2. Run Python tests, linting & typechecking uv run python -m pytest uv run ruff check . uv run mypy packages/common apps/core apps/cli apps/mcp apps/runner 3. Run Web UI lint, unit tests & production build pnpm --filter web lint pnpm --filter web test pnpm --filter web build - License : Copyright 2026 Trent Seed. The GitSeed Control Plane, Runner, Web UI, CLI/TUI, MCP Server, Shared Schemas, and Helm Chart in this repository are 100% open source under the Apache License, Version 2.0 https://github.com/gitseed-dev/gitseed/blob/main/LICENSE see NOTICE https://github.com/gitseed-dev/gitseed/blob/main/NOTICE , free to self-host, modify, and deploy for personal or commercial use. - Trademarks : "GitSeed" and the GitSeed logo are trademarks of Trent Seed. The Apache License, Version 2.0 does not grant permission to use the GitSeed name, brand, or logo for derivative products or hosted services. See TRADEMARKS.md https://github.com/gitseed-dev/gitseed/blob/main/TRADEMARKS.md for what's allowed. - Privacy : Self-hosted GitSeed sends zero telemetry; your code, prompts, and credentials stay on your infrastructure. See PRIVACY.md https://github.com/gitseed-dev/gitseed/blob/main/PRIVACY.md . - Contributions : External pull requests require accepting the GitSeed Contributor License Agreement https://github.com/gitseed-dev/gitseed/blob/main/CLA.md one PR comment, handled by a bot . See CONTRIBUTING.md https://github.com/gitseed-dev/gitseed/blob/main/CONTRIBUTING.md and the Code of Conduct https://github.com/gitseed-dev/gitseed/blob/main/CODE OF CONDUCT.md . - Third-party agent CLIs & model providers : GitSeed orchestrates third-party tools e.g., Claude Code, Codex, Gemini CLI and model APIs that have their own licenses and terms of service. Claude Code is proprietary installed locally at image build time unless INCLUDE PROPRIETARY CLIS=false and is not part of GitSeed's Apache-2.0 source distribution; redistributed container images must omit proprietary vendor CLIs. You are responsible for complying with each provider's terms, including any restrictions on using consumer subscriptions with third-party tools.