Most agent frameworks assume one agent, one app, one bill. The moment you run agents for many clients, two problems appear that no runtime solves for you: you can't prove which client burned which tokens, and nothing stops one client's workspace from leaking into another's. I built Octorato to fix exactly that.
Octorato is an open-source AI agent operating system: one file-native "brain" — rules, 190+ skills, 180+ specialist agents, all plain markdown under git — that a single operator runs across many sealed client "arms," with per-client token attribution and opt-in budget caps.
It's not a runtime you import. It's the agent's self as files you can read, diff, fork, and own — runtime-agnostic (it runs on Claude Code today).
One brain, many arms. The brain holds the shared self: rules (the constitution), skills (HOW to do things), agents (WHO does them). Each arm is a sealed deployment serving exactly one client. Knowledge flows down (generic skills cascade to every arm) and lessons flow up (anonymized patterns get distilled back into the brain). Like a real octopus, most of the neurons live in the arms, not the head.
Your agent's identity, skills, and memory normally live trapped inside vendor code and a cloud console — you can't read the whole self, diff a change, or move it. Octorato keeps all of it as plain markdown under version control. Identity becomes diffable, reviewable, portable, and ownable. Text outlives runtimes.
Because each arm is a sealed cell that no other arm can see, every token an arm spends is attributable to exactly one client by construction. Cellular isolation is per-client FinOps — the wall that seals a client is the wall that meters it. Concretely: per-arm USD rollup (estimated from local session logs at list price), cost-spike alerts, and an opt-in PreToolUse
budget gate — wire the hook and set a client's cap in budgets.yaml
, and it refuses the tool call (exits non-zero) once the cap is hit.
Gartner predicts over 40% of agentic AI projects will be cancelled by 2027 over unmanaged cost. The boring discipline — attribute every token, cap every client — is what keeps you on the right side of that statistic.
CrewAI, LangGraph, and AutoGen are excellent Python agent-runtime frameworks: you define agents and graphs in code and they execute in-process. They have far larger communities. Octorato lives at a different layer — the self as files — and its defensible difference is multi-tenant arm isolation plus built-in FinOps, which runtime frameworks don't target. If you're building one app, use a runtime framework. If you're an operator or agency serving many clients from one brain, that's the gap Octorato fills.
It's MIT-licensed and public: https://github.com/CarlosCaPe/octorato Read the white paper for the full model, or the FAQ for the short version. Contributions welcome — every contributor is credited.