Octorato: an open-source AI agent OS with built-in per-client FinOps

A developer has released Octorato, an open-source AI agent operating system designed to solve per-client cost attribution and workspace isolation in multi-tenant deployments. The system uses a single "brain" of plain-markdown files—containing rules, skills, and specialist agents—that operates across sealed client "arms," with built-in per-client token metering and opt-in budget caps. Octorato aims to address Gartner's prediction that over 40% of agentic AI projects will be canceled by 2027 due to unmanaged costs.

Most agent frameworks assume one agent, one app, one bill. The moment you run agents for many clients, two problems appear that no runtime solves for you: you can't prove which client burned which tokens , and nothing stops one client's workspace from leaking into another's . I built Octorato to fix exactly that. Octorato is an open-source AI agent operating system: one file-native "brain" — rules, 190+ skills, 180+ specialist agents, all plain markdown under git — that a single operator runs across many sealed client "arms," with per-client token attribution and opt-in budget caps. It's not a runtime you import. It's the agent's self as files you can read, diff, fork, and own — runtime-agnostic it runs on Claude Code today . One brain , many arms . The brain holds the shared self: rules the constitution , skills HOW to do things , agents WHO does them . Each arm is a sealed deployment serving exactly one client. Knowledge flows down generic skills cascade to every arm and lessons flow up anonymized patterns get distilled back into the brain . Like a real octopus, most of the neurons live in the arms, not the head. Your agent's identity, skills, and memory normally live trapped inside vendor code and a cloud console — you can't read the whole self, diff a change, or move it. Octorato keeps all of it as plain markdown under version control. Identity becomes diffable, reviewable, portable, and ownable . Text outlives runtimes. Because each arm is a sealed cell that no other arm can see, every token an arm spends is attributable to exactly one client by construction. Cellular isolation is per-client FinOps — the wall that seals a client is the wall that meters it. Concretely: per-arm USD rollup estimated from local session logs at list price , cost-spike alerts, and an opt-in PreToolUse budget gate — wire the hook and set a client's cap in budgets.yaml , and it refuses the tool call exits non-zero once the cap is hit. Gartner predicts over 40% of agentic AI projects will be cancelled by 2027 https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027 over unmanaged cost. The boring discipline — attribute every token, cap every client — is what keeps you on the right side of that statistic. CrewAI, LangGraph, and AutoGen are excellent Python agent-runtime frameworks : you define agents and graphs in code and they execute in-process. They have far larger communities. Octorato lives at a different layer — the self as files — and its defensible difference is multi-tenant arm isolation plus built-in FinOps , which runtime frameworks don't target. If you're building one app, use a runtime framework. If you're an operator or agency serving many clients from one brain, that's the gap Octorato fills. It's MIT-licensed and public: https://github.com/CarlosCaPe/octorato https://github.com/CarlosCaPe/octorato Read the white paper https://github.com/CarlosCaPe/octorato/blob/master/WHITEPAPER.md for the full model, or the FAQ https://github.com/CarlosCaPe/octorato/blob/master/FAQ.md for the short version. Contributions welcome — every contributor is credited.