olivares

Beta, in active development. The first tagged release, v26.8.0, ships signed archives, native packages and container images. APIs and the module surface may still change before 1.0; what runs today, what is on-demand and what is design-stage is stated in Honesty & limits and, per module, in the modules catalog.

What it is

What you run now is an estate — coding agents, MCP servers, model endpoints, service accounts, scheduled jobs — spread across machines that were never one system. Olivares AI is the single self-hosted Go binary, console included, that holds it together: it gives the AI what it needs to work (context, access to resources, managed sessions) and gives you the permissions, policies, budgets and evidence to know what is running, who launched it, what it reached, what it cost, and who agreed to it.

Multi-provider by design. Claude Code is integrated at the deepest level — the PreToolUse/PostToolUse hook, managed settings, console launch and stop, per-subject model access — with Codex and Grok Build as first-class command surfaces alongside, and gemini-cli, Cursor, opencode, goose, cline, OpenHands, OpenClaw and Hermes as their own connectors, each stating what it can enforce and what it can only observe. Ollama and other self-hosted endpoints are inventoried through the local connector, which is read-only by design.

Who runs it. The same build at every size: a home server (one binary, SQLite, loopback-bound); a freelancer with a tenant per client and budgets that deny before the invoice does; an engineering team with shared work items, SSO and an audit trail nobody assembles by hand; a regulated enterprise with Postgres row-level security, HA, air-gapped installs and WORM archival. The open build is the whole platform, and the commercial add-ons are additive code on top of it, never features removed; SSO, HA, WORM and budgets that actually deny are things you provision, not first-boot defaults.

There is no mandatory telemetry and no control-plane egress by default: what crosses your perimeter is what you configure to cross it — calls to your model APIs, the SIEM/webhook outputs you wire, an embedding provider if you provision one. Collectors read from the systems you already run, so a failing collector never stands in the data path of production.

_{The same open build from a homelab to a regulated enterprise.}

What it does

_{Access map — what each agent reads and writes across your estate, read and write by colour.}

• See it. Inventory of every discovered agent, session, model, MCP server, tool and identity; a read/write access map of what each one actually reaches, with a Permitted-vs-Observed drift view; live sessions, the orchestration graph, health and SLA. What it cannot see is marked unknown, never guessed.
• Run the work. Durable work items with ownership, dependencies, acceptance criteria and decisions; fenced leases, so two agents — or two people — cannot hold the same work at once; sessions launched, attached to and stopped from the console; delegation to authorized peers over A2A. Shadow mode and final authority are not built and are listed as absent: The work plane.
• Govern and enforce it. A Cedar authorization engine and four deny-closed enforcement points — the Claude Code hook, an inline /v1/messages inference proxy, an MCP tools/call gate and an A2A delegation gate — so an unauthorized action is blocked, held for two-person approval or, in the hook, rewritten before it runs; a point counts only while a test drives its unconfigured path and asserts the refusal. Budgets that deny or throttle spend, break-glass with dual control, and an estate kill-switch that fails closed.
• Feed it, governed. Content sources (SharePoint, Confluence, Google Drive, Notion, Salesforce, Snowflake, S3, Azure AI Search, SAP OData, PostgreSQL, a root-confined filesystem) into governed retrieval: zero-egress lexical retrieval out of the box, model-backed semantic retrieval when you provision an embedder, clearance enforced deny-closed at retrieval time.
• Prove it. A hash-chained, Ed25519-signed audit ledger; sealed evidence mapped to 26 framework catalogs (EU AI Act, NIST AI RMF, ISO 42001, SOC 2, ISO 27001, GDPR…) — self-assessed control families, not certifications; SIEM/ITSM push (CEF/LEEF/syslog/OTLP/OCSF). Configured per deployment: human and non-human identity (WebAuthn/FIDO2, PIV/CAC, single-IdP SSO, SCIM reconciliation, agent-identity federation), inline guardrails, DLP, BYOK/CMEK encryption and right-to-erasure with verified key-shredding.

30 modules, one console, 158 integrations — counts derived from code and enforced on every push by scripts/check-public-counts.sh. An integration is a connector directory with Go code, and twelve of them are shared library packages: connectors/README.md has the breakdown. Every module with its maturity: the modules catalog; the wired connectors by fidelity tier: the connectors reference.

_{Agents share one durable work plane. What is not built is drawn as absent.}

A look inside the console

Claude Code — create, attach to and govern sessions from the console, no SSH.	Work — the durable cross-session backlog: items, ownership, acceptance, decisions.
Orchestration & A2A — who delegates to whom, derived from observed signals.	Inventory — every agent, session, MCP server, model and identity discovered.
Least-privilege drift — observed but not permitted, and grants nobody uses.	Security & forensics — guardrail findings, anomalies, tamper-evident forensics.
Kill switch — one click halts every governed actuation surface; recovery takes two accounts.	Session recording — agent activity and governance evidence on one timeline, chain verified.

Every still is a capture of the seeded demo estate served by the running binary (bash scripts/docs-captures.sh regenerates the raw set). The full map of screens: the console reference.

Install

Every release ships under a cosign-signed trust chain, verified by artifact type: a cosign-signed checksums manifest covering the archives, packages and per-archive SBOMs it lists, an SPDX SBOM sidecar with an in-toto attestation per archive, cosign signatures on the container image with its own SBOM attestation, and OpenVEX statements and SLSA build provenance for the set. For a security product the supply chain is part of the trust model: verify it before you run it.

HTTPS convenience path. The script body arrives over HTTPS and is not pre-verified by the pipe; once running, it detects your OS and architecture, requires cosign, verifies the signed checksum manifest and the archive SHA-256, installs only the binary, and never invokes sudo. Pin the version when piping it into a shell:

curl -fsSL https://raw.githubusercontent.com/olivaresai/olivares/main/scripts/install.sh | sh -s -- --version v26.8.0
olivares quickstart        # TLS on, loopback-only, no default credentials; prints the console URL + a one-time setup token

High-assurance path. Download first, verify, then execute: the archives, packages and the checksums manifest are on the release page, and scripts/verify-release.sh verifies whatever is present and says what it skipped — keyless by default, --key … --offline on a disconnected host. The installer trust contract states both paths; the signed, versioned installer with its opt-in service adapter starts with the first release cut after it landed, and v26.8.0 predates it.

The engine is secure by default: it binds to loopback, serves HTTPS with a self-signed certificate on first boot, ships with no default credentials and prints a single-use setup token; in a container or a pod the process listens on its own network and the host mapping or the Service keeps it private. Windows is not built yet — run the Linux container or WSL2 (plan). The per-OS matrix and production setup: INSTALL.md; the deployment guides (Compose, Kubernetes, air-gapped) and upgrades: docs-site/.

Quickstart

Explore a synthetic estate, or start it for real. Both run the same binary.

# a deterministic demo estate — loopback-only, no real data
olivares serve --seed-demo --insecure --listen 127.0.0.1:8901 --grpc-listen 127.0.0.1:8902 --data-dir "$(mktemp -d)"
# open http://127.0.0.1:8901 — inventory, work, orchestration, access map + drift, policies, FinOps

# the real thing — TLS on, loopback; create the first administrator with the printed token
olivares quickstart

The demo seed is for learning only (public source-tree password): never point it at real data. CI walks the same path with task smoke:quickstart and asserts the access-map and drift counts (20 nodes / 13 edges, with 8 unexpected accesses and 2 unused grants), so this page cannot quietly drift from the code. The full quickstart wires a real pgAudit connector and links the production install paths.

Editions

_{Editions by composition. Packaging and pricing on request.}

The AGPL build is the whole platform and is never feature-capped from within; the commercial add-ons are additive code, never features removed from the open product. A subscription is the credential for downloading signed module packs — a distribution-style model, not a key that unlocks code already on your disk. User accounts are unlimited in the self-hosted engine, and all four deny-closed enforcement points are open. The area-by-area matrix of open, commercial and planned capabilities: LICENSING.md and Open core & licensing.

Architecture

One static Go binary embeds the console and exposes four surfaces with documented coverage: the REST API (primary), a focused gRPC mirror of the stable core, the olivares CLI and a Terraform provider. Collectors run inside your infrastructure in three modes; the store is SQLite or Postgres with row-level security, enforced once in the store API and again by Postgres. Details, including the work plane piece by piece: ARCHITECTURE.md.

Documentation

docs.olivares.ai — tested install tutorials (single node, Docker Compose, Kubernetes/Helm, air-gapped), connector guides with real console captures, a cookbook (deny-closed policies, budgets, approvals, kill-switch drills, SIEM push), API reference and a glossary. Start at What is Olivares AI and Honesty & limits.

Security

Report a vulnerability privately through SECURITY.md, never as a public issue. The engine is read-first and minimal-data: the access map stores edges, not payloads, and opening it is a recorded action. Advisory flow: docs/security-advisories.md; supply-chain evidence map: docs/openssf-badge.md.

Community

CONTRIBUTING.md (setup, DCO/CLA, SPDX, the connector boundary) · CODE_OF_CONDUCT.md (Contributor Covenant 2.1) · SUPPORT.md · GOVERNANCE.md · CHANGELOG.md (Keep a Changelog 1.1, CalVer vYY.M.PATCH).

License

core/, modules/ and web/ are AGPL-3.0-only; sdk/, connectors/ and clients/ are Apache-2.0, and a connector never imports the engine. The commercial add-ons are separate, optional and closed — built only with -tags enterprise, never in this repository or the open binary; for commercial licensing contact [email protected] — LICENSING.md. Contributions require a DCO sign-off (git commit -s) and the CLA.

No warranty, no liability. The software is provided as is, with no warranty of any kind and no liability for loss of data, business interruption or lost profits. On a control plane that is not a formality: a misconfiguration can block legitimate work or let through exactly what you meant to stop. AGPL-3.0-only §§15–16, Apache-2.0 §§7–8 and this project's supplemental term apply — DISCLAIMER.md.

Support the project

The core is free and stays free; keeping every release signed, verified and current is sustained work. If Olivares AI is useful to you, you can sponsor it through GitHub Sponsors — github.com/sponsors/olivaresai or github.com/sponsors/fran-olivares — or one-off on Ko-fi. Sponsorship is not a support contract and buys no priority (SUPPORT.md); sponsors who ask to be named are listed in SUPPORTERS.md.

_{Ground truth for enterprise AI. · olivares.ai · AGPL-3.0 + commercial}