Build under containment
Agents work in an OS-sandboxed workspace with two-axis permissions and argument-level tool scopes. Every consequential action is a checkpoint a human can see, and stop.
The governance plane for small software
An agent builds the software. OpenCatalyst governs the fleet it leaves behind.
Ship, share, and run agent-built apps as easily as a Google Doc. Every release is published through five evidence-bearing gates, metered with its own keys and spend caps, and recorded on a signed audit chain. Wherever it was built. Wherever it runs.
Coming soon
Play with the demo
5 gates at publish · evidence persisted
per-app keys · meters · spend caps
signed audit · hash-linked chain
provider-neutral · cloud + local + BYOK
The premise
The bottleneck moved. The product follows it.
Small software, the purpose-built tools that will only ever have one user or a handful, used to be hard to write. Not any more: an agent builds one in an afternoon, and every team has an endless backlog of them. The workflow tracker shaped like how you actually work. The sprint board. The intake form. The dashboard for the one number that matters. The prototype three colleagues need to try.
The incumbent clouds were designed for Big Software, and carry Big Software's complexity. And the hard part now is everything after the build: reviewing what the agent produced, deciding who may open it, knowing what it costs, proving what it touched, and turning it off when it misbehaves. Across a fleet of apps nobody read, that's the whole job.
“Small software should be as easy to share with your colleagues as a Google Doc.”
Publish through evidence
Five gates run at publish and attach persisted evidence to an immutable release. A bundle with no dependency audit fails closed. Absence of proof is not proof.
Operate as a fleet
Every app carries its own scoped, separately-metered key, a spend cap, a deploy target, and a signed audit trail, so a thousand of them stay legible.
The workbench
Build like you would in Cowork or Codex.
OpenCatalyst is an agent workbench first. Brief a task, and one model or a team of them plans, writes, and tests inside an OS-sandboxed workspace, pausing at approval checkpoints before anything consequential. The motion you already know. The difference is what sits behind the composer.
- Every frontier model, one composer. Anthropic, OpenAI, Google, and xAI, plus local models through Ollama.
- Auto-routing that learns. It picks a model per task from what you actually keep, and agent teams draft in parallel and merge through a judge.
- No vendor lock-in. Your keys, your hardware if you want it, and swapping providers never means rebuilding your fleet.
The demo · scripted, honest
Don't take the pitch. Take the controls.
A faithful slice of the product, three acts long: brief the agent, gate the release, govern the fleet. It pauses where the real thing pauses, on a human. And everything you press lands in the audit strip at the bottom, because that is the product.
invoice-reconcilermodel · auto → opus · write root ~/oc/invoice-reconciler
streaming
A·O
Build a reconciler that matches our bank export against open invoices and flags anything it can't pair. Keep it a single package with tests. The export is in ~/exports.
auto → opus · turn 1Plan: read the export header for the real column names, scaffold the package, write the matcher, run the suite. Three vendors bill a flat $1,200.00, so amount-only matching collides. I'll add a date window plus a reference token.
read_file ~/exports/bank-export-2026-07.csv
run_bash npm init -y && npm i -D vitest
edit_file src/match.ts+11 −4
- invoice: open.find((i) => i.amount === row.amount)+ const near = open.filter((i) => Math.abs(i.amount - row.amount) < 0.005)+ return near.length === 1 ? near[0] : byReference(near, row.memo)
To verify against the real export I need to run the CLI over ~/exports. That's outside my write root, so it's your call.
Approval required
approval-7f2c · run paused · mode: ask · tier: os_sandbox
node dist/cli.js --in ~/exports/bank-export-2026-07.csv --out ./out/unmatched.csv
the run is paused on you, and that's the product
run_bash node dist/cli.js --in ~/exports/… --out ./out/unmatched.csv
Done. Two unpaired rows flagged, both flat-amount vendors. The grant was once, so it's already expired.
denial returned as a tool error, not a crashUnderstood. I'll validate against a redacted fixture inside the workspace instead.
run_bash node dist/cli.js --in fixtures/sample.csv
Matcher verified on the sample. The real export stays untouched.
Apps / invoice-reconcilerdraft → v0.1.0 · workspace billing-tools · cost gate $50/mo
- G1 · Secrets scansecrets.scan · persisted
- G2 · Dependency auditdeps.audit · persisted
- G3 · Data-scope checkscope.grants · persisted
- G4 · Cost estimatecost.forecast · persisted
- G5 · Recorded review human approval · recorded · you
Release v0.1.0 · sealed
immutable · evidence bundle attached · one-click rollback
ed25519 9f2c…c41a
link token minted · app-scoped · hash stored at rest
A gate that can't produce evidence fails closed. The release never exists.
Fleet142 apps · 37 builders · every key scoped & metered
App · targetSpend vs capStatus
invoice-reconcilerour cloud · v0.1.0 · scoped key oc-app-7f…
$4.20 / $50 cap
healthy
sprint-dashboardyour VPC · v2.3.1 · scoped key oc-app-b1…
$18.75 / $25 cap
healthy
claims-triagelocal · air-gapped · v1.0.4 · local-only routing
$0.00 · never leaves the machine
healthy
vendor-intakeour cloud · v0.9.2 · scoped key oc-app-2c…
$49.80 / $50 cap
healthy
Signed audit · hash-linked
- #4177session.start · invoice-reconciler · a.okonkwo
- #4178policy.load · managed · workspace
Deny an agent's command and it revises. Fail a gate and the release never exists. Enforcement isn't a report. It's the shape of the pipeline.
Access denials are audit events too. What was refused is as much of the record as what ran.
Portable governance
From anywhere. To anywhere. Same rules.
Governance that only works on apps built inside one tool is a feature. Governance that follows the app, wherever it was built and wherever it runs, is a plane.
Bring an app
- Built on-platform by agent teams. Parallel drafts, a judged merge, test-verified
- Imported from Claude Code, v0, Cursor, or any git repo
- One model or many. Auto-routing picks per task and learns from what you keep
Run it
- Our cloud. Share a link, it just works
- Your VPC or tenant. Same gates, same audit, your perimeter
- Local, even air-gapped. Local-only model routing, enforceable workspace-wide
The claim this product rests on is not that we can run inside your network. Everyone can, now. It's that running ungoverned software inside your network is the actual problem, and the governance has to follow the app.
Which is why we spend as much on gates, meters, audit, and revocation as on the agents that write the code.
Early access
Be first in the fleet.
We're onboarding a small group of design partners, agencies and platform teams that operate fleets of internal tools.
Coming soon
Govern the fleet
Evidence at publish
Per-app keys + caps
Deploy to approved targets