Archestra README

Secure AI Platform

Built on a strong security and observability foundation: SSO and RBAC, sandboxed code execution, Lethal-Trifecta guardrails, OpenTelemetry traces, and Prometheus metrics — first-class, not bolted on.

Quickstart  ·  Docs  ·  Releases  ·  Slack

https://github.com/user-attachments/assets/912b85e2-ef14-4e83-a807-5e2a81457a88

What it does

Point your users — or your agents, or Claude / Codex / Cursor — at one URL. Archestra handles the rest:

• 💬 Chat for non-technical users. Internal AI assistant with projects, MCP apps, and Slack, MS Teams, and email front-ends.
• 🛠️ Developer LLM & MCP portal. One token for Claude Code, Codex, Cursor — see the proxy.
• 🚪 LLM gateway for any provider (Anthropic, OpenAI, Azure, Bedrock, DeepSeek, …) with cost limits, virtual API keys, and dynamic model routing.
• 🔌 MCP gateway with OAuth + On-Behalf-Of so tools run as the user, not a shared service account.
• 🤝 A2A gateway for agent-to-agent triggers.
• 📦 Private MCP registry so teams ship their own tools — see registry docs.
• 🎼 MCP orchestrator with a Kubernetes operator and self-serve promotion.
• 🤖 Agent runtime with scheduled / email / webhook triggers, sub-agent delegation, reusable skills, sandboxed code execution, and a K8s-native filesystem.
• 📚 RAG knowledge base plumbed via connectors to your existing stack.
• 🧩 Mini app builder — see apps.
• 🛡️ Deterministic guardrails for tool calls and Lethal Trifecta protections.
• 🪪 Identity & access with SSO (OIDC, SAML, Okta, Entra), RBAC with role mapping & team sync, and secrets management.
• 🌎 Environments with per-env egress policies and per-env cost limits.
• 🔭 Observability out of the box: OpenTelemetry traces, Prometheus metrics, logs, per-team cost tracking.

Already running dangerous single-tenant agents like Claude Cowork, OpenClaw, or Hermes in your enterprise? Migration Kit →

Quickstart

docker pull archestra/platform:latest

docker run \
  -p 127.0.0.1:9000:9000 -p 127.0.0.1:3000:3000 \
  -e ARCHESTRA_QUICKSTART=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v archestra-postgres-data:/var/lib/postgresql/data \
  -v archestra-app-data:/app/data \
  archestra/platform:latest

Open http://localhost:3000. Full Docker / Helm / Kubernetes instructions live in the quickstart docs.

Release channels

Archestra maintains two active release tracks:

• Stable releases (e.g. 1.3.51): Qualified, tested releases for production deployments. Archestra maintains one active stable release line at a time with security patches and bug fixes.
• Release candidates (e.g. 1.4.0-rc.22): Previews of upcoming features built directly from the main branch. They let you test new capabilities and provide feedback before they land in a stable release. The Docker tag archestra/platform:latest points to the newest release, so it usually runs a release candidate.

New features and bug fixes land on main first and ship in rolling beta releases. Fixes are then selectively backported to the supported stable branch. For production environments, pin an exact version tag or Helm chart version rather than tracking latest. See our Release guide for full release lifecycle details.

Ready for production

• ✅ $13.5M total funding
• ✅ Three Fortune-50 deployments
• ✅ 31 ms at p95 — performance benchmarks →
• ✅ Terraform provider →
• ✅ Helm chart →

Deeper docs

• 📖 Platform overview — what's in the box, how the pieces fit together.
• 📐 Deployment — Docker, Helm, Kubernetes, every env var, secrets management.
• 💰 Pricing model — Open Core, free for teams under 30 users, enterprise licensing.
• 🛡️ Security & bug bounty
• 🤝 Contributing — set up the dev env, run e2e tests, open a PR.
• Release guide — beta releases, stable patches, cutovers, and qualification.

Thank you for continuously making Archestra better — you're awesome 🫶