Secure AI Platform
Built on a strong security and observability foundation: SSO and RBAC,
sandboxed code execution, Lethal-Trifecta guardrails,
OpenTelemetry traces, and Prometheus metrics — first-class, not bolted on.
Quickstart ·
Docs ·
Releases ·
Slack
https://github.com/user-attachments/assets/912b85e2-ef14-4e83-a807-5e2a81457a88
What it does
Point your users — or your agents, or Claude / Codex / Cursor — at one URL. Archestra handles the rest:
- 💬 Chat for non-technical users. Internal AI assistant with
projects,
MCP apps, and
Slack,
MS Teams, and
email
front-ends.
- 🛠️ Developer LLM & MCP portal. One token for Claude Code, Codex,
Cursor — see the proxy.
- 🚪 LLM gateway for any provider
(Anthropic, OpenAI, Azure, Bedrock, DeepSeek, …) with
cost limits,
virtual API keys,
and dynamic model routing.
- 🔌 MCP gateway with OAuth + On-Behalf-Of
so tools run as the user, not a shared service account.
- 🤝 A2A gateway for agent-to-agent triggers.
- 📦 Private MCP registry so teams ship their own tools — see
registry docs.
- 🎼 MCP orchestrator with a
Kubernetes operator and
self-serve promotion.
- 🤖 Agent runtime with scheduled / email / webhook triggers,
sub-agent delegation,
reusable skills,
sandboxed code execution, and a K8s-native filesystem.
- 📚 RAG knowledge base plumbed via
connectors to
your existing stack.
- 🧩 Mini app builder — see apps.
- 🛡️ Deterministic guardrails for tool calls and
Lethal Trifecta protections.
- 🪪 Identity & access with SSO
(OIDC, SAML, Okta, Entra), RBAC with role mapping & team sync,
and secrets management.
- 🌎 Environments with per-env egress policies
and per-env cost limits.
- 🔭 Observability out of the box: OpenTelemetry traces, Prometheus
metrics, logs, per-team cost tracking.
Already running dangerous single-tenant agents like Claude Cowork,
OpenClaw, or Hermes in your enterprise? Migration Kit →
Quickstart
docker pull archestra/platform:latest
docker run \
-p 127.0.0.1:9000:9000 -p 127.0.0.1:3000:3000 \
-e ARCHESTRA_QUICKSTART=true \
-v /var/run/docker.sock:/var/run/docker.sock \
-v archestra-postgres-data:/var/lib/postgresql/data \
-v archestra-app-data:/app/data \
archestra/platform:latest
Open http://localhost:3000. Full Docker / Helm / Kubernetes instructions
live in the quickstart docs.
Release channels
Archestra maintains two active release tracks:
- Stable releases (e.g.
1.3.51): Qualified, tested releases for production deployments. Archestra maintains one active stable release line at a time with security patches and bug fixes.
- Release candidates (e.g.
1.4.0-rc.22): Previews of upcoming features built directly from the main branch. They let you test new capabilities and provide feedback before they land in a stable release. The Docker tag archestra/platform:latest points to the newest release, so it usually runs a release candidate.
New features and bug fixes land on main first and ship in rolling beta releases. Fixes are then selectively backported to the supported stable branch. For production environments, pin an exact version tag or Helm chart version rather than tracking latest. See our Release guide for full release lifecycle details.
Ready for production
Deeper docs
- 📖 Platform overview —
what's in the box, how the pieces fit together.
- 📐 Deployment —
Docker, Helm, Kubernetes, every env var, secrets management.
- 💰 Pricing model —
Open Core, free for teams under 30 users, enterprise licensing.
- 🛡️ Security & bug bounty
- 🤝 Contributing —
set up the dev env, run e2e tests, open a PR.
- Release guide —
beta releases, stable patches, cutovers, and qualification.
Thank you for continuously making Archestra better — you're awesome 🫶
