# Octorato: an open-source AI agent OS with built-in per-client FinOps > Source: > Published: 2026-05-31 00:42:23+00:00 Most agent frameworks assume one agent, one app, one bill. The moment you run agents for *many* clients, two problems appear that no runtime solves for you: **you can't prove which client burned which tokens**, and **nothing stops one client's workspace from leaking into another's**. I built Octorato to fix exactly that. **Octorato is an open-source AI agent operating system: one file-native "brain" — rules, 190+ skills, 180+ specialist agents, all plain markdown under git — that a single operator runs across many sealed client "arms," with per-client token attribution and opt-in budget caps.** It's not a runtime you import. It's the agent's *self* as files you can read, diff, fork, and own — runtime-agnostic (it runs on Claude Code today). One **brain**, many **arms**. The brain holds the shared self: rules (the constitution), skills (HOW to do things), agents (WHO does them). Each arm is a sealed deployment serving exactly one client. Knowledge flows *down* (generic skills cascade to every arm) and lessons flow *up* (anonymized patterns get distilled back into the brain). Like a real octopus, most of the neurons live in the arms, not the head. Your agent's identity, skills, and memory normally live trapped inside vendor code and a cloud console — you can't read the whole self, diff a change, or move it. Octorato keeps all of it as plain markdown under version control. Identity becomes **diffable, reviewable, portable, and ownable**. Text outlives runtimes. Because each arm is a sealed cell that no other arm can see, every token an arm spends is *attributable* to exactly one client by construction. Cellular isolation **is** per-client FinOps — the wall that seals a client is the wall that meters it. Concretely: per-arm USD rollup (estimated from local session logs at list price), cost-spike alerts, and an **opt-in** `PreToolUse` budget gate — wire the hook and set a client's cap in `budgets.yaml` , and it refuses the tool call (exits non-zero) once the cap is hit. Gartner predicts [over 40% of agentic AI projects will be cancelled by 2027](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) over unmanaged cost. The boring discipline — attribute every token, cap every client — is what keeps you on the right side of that statistic. CrewAI, LangGraph, and AutoGen are excellent **Python agent-runtime frameworks**: you define agents and graphs in code and they execute in-process. They have far larger communities. Octorato lives at a different layer — the self as files — and its defensible difference is **multi-tenant arm isolation plus built-in FinOps**, which runtime frameworks don't target. If you're building one app, use a runtime framework. If you're an operator or agency serving many clients from one brain, that's the gap Octorato fills. It's MIT-licensed and public: [https://github.com/CarlosCaPe/octorato](https://github.com/CarlosCaPe/octorato) Read the [white paper](https://github.com/CarlosCaPe/octorato/blob/master/WHITEPAPER.md) for the full model, or the [FAQ](https://github.com/CarlosCaPe/octorato/blob/master/FAQ.md) for the short version. Contributions welcome — every contributor is credited.