The agentic OS
you actually own.
EU-compliant by design.
A self-hosted operating system for AI agents: it runs the engines, personas, workflows and runtime-forged tools, meets your users on every messenger, drives a real browser, and keeps a hash-chained audit of it all — with compliance built into the architecture, not bolted on.
aiagentstore.ai
The chat runs the whole OS
The chat isn't a demo window — it's the shell. Personas, engines, workflows, the Forge, RAG, agentic compute and the A2A mesh are all reachable from one prompt. That's the idea behind voice‑to‑action: drive the whole OS end‑to‑end by voice — speak a request, CorvinOS transcribes it, routes it, does the work, and speaks the answer back — tuned to how you listen. And you don't even need the console open: every messaging bridge is a full control surface, so you can run the whole OS straight from a Telegram, WhatsApp or Signal thread.
Run it hands‑free
Hit the mic and talk. Speech is transcribed locally by default — the audio is deleted the moment it returns, and only metadata ever touches the audit chain.
One prompt reaches every layer
Built in, not bolted on.
Every compliance mechanism is a structural design constraint. There is no "compliance mode" you can accidentally leave off.
Every instance carries a verifiable identity.
A locally-generated Ed25519 key becomes a Corvin Labs-signed certificate at license activation — binding this specific installation to a license and account, offline-verifiable, optionally tethered to the machine's hardware. No new PKI, no phone-home required to check it.
Bot Disclosure
One-time AI-nature disclosure per user, structurally locked. Cannot be disabled via configuration.
Consent Gate
Deny-by-default consent for transcript sharing. Per-user, TTL-capped, re-validated at consume time.
Hash-Chained Audit
Every event appends to a SHA-256-linked chain. Tampering invalidates it. Offline-verifiable.
Data Residency
Compliance-zone routing and egress lockdown structurally prevent data from leaving the permitted zone.
Compute that adapts
to any problem
That's Agentic Compute: the worker owns the loop, the model owns the framing. The agent says what to optimise and when to stop; a sandboxed worker picks the strategy that fits the problem and turns the crank — from a quick tune to a Bayesian search over an 8 GB dataset, and never a raw byte in the context window.
N iterations run in the worker — the model is idle until the result returns.
Exhaustive coverage
Evaluates every combination in the grid. Pre-generated at submit — deterministic and fully reproducible.
Broad sampling
Uniform samples per batch from continuous ranges. One seed per run, stored for reproducibility.
Fewest evaluations
A Gaussian-Process surrogate picks the highest Expected-Improvement points — finds a good region in the fewest runs.
A single score for “how wrong is this — so far?”
Every sweep and every delegation round needs a way to compare two attempts and say which is better. That measure is the loss: one number where lower is better and 0 would be a perfect answer. The optimiser has no opinion about your problem — it only ever tries to push that number down.
Loss usually falls but not monotonically — the run keeps the best seen, not the last.
Distance from a good answer. A model that guesses well scores near 0; a bad fit scores near 1. It turns “better / worse” into something the machine can rank.
Each iteration reports its loss (in the console, 1 − confidence). The run tracks best_loss, watches the trend, and flags a spike when loss climbs three rounds straight.
Stop when loss reaches the target, the iteration budget runs out, or wall-time expires — whichever comes first. The same rule bounds a Bayesian sweep and a recursive delegation tree.
The same idea, all the way down
Everything in CorvinOS that improves an answer is a loop pushing a loss down — they differ only in what they tune, the parameter axis θ. The compute sweep tunes parameters; Loss-Driven Development (LDD) tunes the system that produces them, across three engineering axes. Loops 2–4 run always on, at full depth — no change is trusted until it produces a loss signal: a failing test, a behaviour gap, an error.
The sweep
Grid, random or Bayesian search drives the loss down over a hyperparameter space. This is Agentic Compute — seconds to minutes.
Inner loop ~60 s
Edit code, run the E2E, observe the loss. Mandatory for every edit — you can't skip straight to a claim.
Refinement ~5–30 min
Polish a good-enough deliverable with a real gradient; the budget halves each pass and stops on a plateau or regression.
Outer loop ~1 week
When the same failure recurs across tasks, evolve the skill or rubric itself — the loss on how the work gets done.
It keeps working until the answer is good enough
A manager engine plans the task, delegates pieces to parallel worker runs, scores every result, and iterates toward a loss target. The point of the recursion is adaptation: where a capability is missing, a worker forges the tool or skill it needs at runtime — so the same flow can tune a model, run a backtest, or analyse an 8 GB dataset straight from a prompt.
Forge and SkillForge run inside the loop. A worker calls forge.create_tool() and the tool is instantly available to every later worker; another calls skill.create() and the skill is injected on the next turn. That runtime generation is the adaptation engine — how a plain-language question turns into a working analysis over data far too big for any context window.
The manager never touches your data. Every spawn passes the data gate, so only clean, redacted summaries flow back up the tree — bounded by a shrinking budget.
Query 8 GB. Leak nothing.
Register a dataset once. The same file is presented two ways — a redacted snapshot to the model, the real bytes to the sandbox.
- →A 22-char opaque
data_handle - →Schema + redacted sample, capped at 4,000 tokens
- →Stats via HyperLogLog & P5/P95 — never raw extremes
- →The real file path, read-only-bound into bwrap
- →Every row readable —
pandas.read_csv(path)just works - →Structured queries & SQL sources via the DSI protocol
Point it at the databases you already run — the model queries them by name over the DSI protocol, and the raw rows never move.
Describe the outcome. Ship the whole thing as one file.
You never draw the boxes and arrows. You describe an outcome in plain language — the manager delegates the run, and the execution graph discovers itself. Save that graph as a repeatable workflow, then export everything it needs — logic, tools, skills, personas and data bindings — into a single portable .awpkg bundle.
Freezes the exact graph the run discovered — same nodes, same order — for a faithful re-run.
Generalises the graph into a reusable blueprint with parameters — point it at new inputs and run again.
A whole agentic-compute delegation tree — sub-managers, workers and their iteration loops — captures as one .awpkg, ready to re-run the sweep.
Everything the workflow needs, in one archive
An .awpkg is a signed ZIP — the whole capability, not just the recipe. Install it into any tenant with one command and the tools, skills, personas and delegation logic all light up together. It declares; the runtime installs — no scripts, no binaries, eight fail-closed checks before a single byte is extracted.
The full AWP topology — agent steps, parallel fan-out/fan-in and recursive delegation_loop nodes — plus triggers and delivery targets.
Every custom tool the run built, each pinned to a sandbox with network: deny unless the manifest grants it.
Reusable skill bodies, linted before install and injected into the workers' future turns.
The roles the workers assume — so the packaged team behaves the same on any machine.
RAG-provider and datasource references travel; secret names are declared but their values stay in the vault — never in the package.
Your datacenter. The whole org just asks.
Run CorvinOS on one machine in your datacenter — it's just another node in the mesh, the one that happens to do the heavy agentic compute over your confidential data. Every team pairs with every other over A2A: no hub, no center. Anyone sends plain-language tasks, answers flow back, but the raw data never leaves the building.
Every connection is a Friendship Token — a shared HMAC key exchanged out-of-band. No platform sits in the middle; each node authenticates the other and audits every envelope on its own hash chain.
It grows into your setup
CorvinOS isn't a fixed product you conform to. It learns how you like to work, it builds the capabilities it's missing while it runs, and it opens cleanly to whatever else you need to plug in.
Voice & Profile tunes how each listener is spoken to — vocabulary, jargon level, depth — and personas route every turn to the right voice, tools and engine. Your overrides always win.
Hit a gap and a worker forges the tool and writes the skill — at runtime, mid-task. Each one persists and is instantly available to every later turn, so the system keeps getting more capable the more you use it.
Install external MCP servers from the catalog, add vendor layers through the Extension API, or drop in custom compute engines. The corvin.* core stays cryptographically locked — an extension can add a guardrail, never weaken one.
Extend anything. Share it. Install it.
CorvinOS is a platform, not a product — you extend it by dropping files into a config tree. Seven extension surfaces, most hot-reloading on the next message, every event written to the hash-chained audit log. The corvin.* core stays cryptographically locked — an extension can add a guardrail, never weaken one. Everything the community builds lives in one open, MIT-licensed marketplace.
AI identities, tools & engine choice
Sandboxed, MCP-callable tools
Self-grading reasoning patterns
Custom Layer System bundles
New messaging channels
Signed .corvin-pkg bundles
Pluggable compute engines, Fabric backends & optimisation strategies
Everything for production AI agents
From multi-channel messaging to runtime tool generation, CorvinOS ships production-grade infrastructure out of the box.
Seven Bridges
Native daemons for Discord, Telegram, WhatsApp, Slack, Email, Teams and Signal. Hot-reload settings, per-chat profiles, rate limiting.
Runtime Tool Generation
Forge generates schema-bound, sandboxed tools at runtime via MCP with a four-scope workspace hierarchy.
Runtime Skill Learning
SkillForge injects markdown skills into future turns, with automatic grading, promotion gates and an injection linter.
Multi-Engine Support
Swap between Claude Code, Codex, OpenCode, local Hermes/Ollama and GitHub Copilot — no bridge changes. Adaptive Haiku/Sonnet model selection built in.
Conversation Memory
FTS5 SQLite recall with PII-redacted indexing and GDPR Art. 17 erasure via /forget.
Databases & Data Sources
Register SQL and vector stores through the DSI protocol. The model queries them by name — raw rows never enter its context.
Browser Control
Drive a real Chromium — navigate, fill, click, read — while you watch live and approve sensitive actions. It acts by element index, not pixels; secrets come from the vault and never reach the model or the audit log.
Extensions & MCP
Install external MCP servers from the catalog, or ship vendor layers through the Extension API — scoped per project, tenant or user. The corvin.* core stays cryptographically locked; extensions add, never weaken.
Tamper-proof Audit
Every action — model call, tool run, message, browser click — lands on a hash-chained log that's verified daily. Metadata only: never transcript text, typed secrets or raw rows.
Nine ways it goes to work
The same runtime — bridges, voice, RAG, workflows, agentic compute, the data firewall and the A2A mesh — shows up very differently depending on who is asking. From one person on a laptop to a whole organization.
A personal assistant that lives in your chats
Talk to a single agent from Telegram, WhatsApp, Signal or the web — by text or voice. It carries your persona and profile across every channel, so it always sounds like your assistant.
Ask your own notes and files
Point retrieval at your documents and get grounded answers with sources. Everything is self-hosted on your own machine — no third-party inbox, no data handed to a SaaS.
Send a note, hear an answer
Fire off a voice message and get a spoken reply tuned to how you like to listen. Speech is transcribed locally by default and the audio is deleted the instant it returns.
Query your warehouse by asking
Connect the Postgres or Snowflake you already run. The team asks in plain language, the sandbox works on the real bytes, and only redacted, audited answers come back — raw rows never leave.
Automate the recurring work
Design a multi-step AWP pipeline in guided natural language, run it on demand or on a schedule, and export the whole thing as one .awpkg to share or re-run.
Answer customers, grounded and logged
An agent handles your support channels, grounded in your own docs, with redaction always on and every action written to a hash-chained audit log you can actually verify.
Every team run on one fabric
Legal, support and data each run their own agent and delegate to one another over HMAC-signed envelopes — no hub, no central owner. Peers are scoped Observer or Executor.
The whole org just asks the datacenter
A datacenter node runs 100-iteration sweeps, tuning and backtests over confidential data. Everyone sends a request and gets an answer back — the data stays put, the models stay idle while workers turn the crank.
Governed by construction, extensible by design
EU-AI-Act and GDPR controls are structural, local-only engines keep CONFIDENTIAL tenants zero-egress, and you extend through the Extension API and MCP — while the corvin.* core stays cryptographically locked.
Every bridge is a full control surface
Anything you can do in the console you can do from the messenger — pin a persona, run a workflow, kick off an agentic-compute sweep, query a database — by text or voice. CorvinOS meets your users where they already are.
Install on
your platform
Start free. Unlock everything for €10.
Self-host the whole thing under Apache-2.0, forever. Upgrade only when you need to lift the limits.
Self-hosted & open source. Everything runs on your own infrastructure.
Clone on GitHub- ✓All 7 messaging bridges
- ✓Hash-chained audit & full compliance
- ✓1 tenant · 1 concurrent workflow
- ✓1 RAG provider · 1 A2A peer
- ✓1 compute unit / day · 1 Space domain
Everything unlocked. No feature gates, no seat math. Cancel anytime.
Get Member- ✓Everything in Free, unlimited
- ✓Unlimited tenants & concurrent workflows
- ✓Unlimited compute units
- ✓Unlimited RAG providers & A2A peers
- ✓Unlimited Space domains · cancel anytime
For organizations that need governance, residency and a support agreement.
Contact us- ✓Everything in Member
- ✓SSO & multi-tenant governance
- ✓Data-residency & compliance-zone controls
- ✓Enterprise portal · roadmap
- ✓Priority support & SLAs
Own your agents.
From the first commit.
Open source under Apache-2.0. Star it, fork it, self-host it — no vendor lock-in, ever.