Self-hostable · TypeScript · PostgreSQL · Prisma · MCP
A self-hostable control plane for teams running AI agents across many separate systems — each with its own credentials, policies, approvals, and audit. The control plane decides what's allowed. Edges execute inside the environment that holds the access.
Credentials from environment A shouldn't touch environment B. But agents need both, and long-lived secrets get threaded through shared context. One compromised run can expose more than its own environment.
One environment needs manager sign-off for billing access. Another blocks weekend runs. A flat approval model can't represent per-environment risk profiles.
An agent stalls inside a remote environment at 3 AM. Without a reconstructable timeline of tool calls, credential access, and policy decisions, explaining the failure means restoring live access.
Every new environment adds targets, identities, and concurrent runs. One gateway host can't absorb unbounded growth without becoming the bottleneck.
Every environment is a workspace. Policy, credentials, memory, approvals, and audit are scoped to the workspace that owns them. A leaked token, a bad approval, or a noisy run in one workspace does not broaden access in another.
sequenceDiagram
autonumber
participant U as User
participant C as Core
participant H as Approver
participant V as Vault
participant S as Scorer
participant E as Edge
U->>C: Submit task
C->>C: Resolve identity, workspace
C->>C: Evaluate policy
alt approval required
C-->>H: Block run, attach evidence
H-->>C: Approve or deny
end
C->>V: Resolve credentials (JIT)
V-->>C: Scoped material
C->>S: Select placement
S-->>C: Best edge
C->>E: Lease execution
E-->>C: Progress, checkpoints, artifacts
E-->>C: Terminal result
C-->>U: Reconstructed run timeline
An edge is a worker process that runs inside the environment reaching the target — a local machine, a sandbox, a VPC, or a hosted browser service. One task can fan out across multiple edges in parallel. The fleet scales without manual coordination.
flowchart LR
T["Task"] --> P["Parent run"]
P -->|spawn| C1["Child A\nEdge: sandbox"]
P -->|spawn| C2["Child B\nEdge: VPC"]
P -->|spawn| C3["Child C\nEdge: fixed host"]
C1 --> JG["Join group"]
C2 --> JG
C3 --> JG
JG --> R["Reducer\n(optional)"]
R --> P2["Parent\nresumes"]
JG -.-> P2
Sandbox leases hold browser state, cookies, and auth across runs. Agents stay logged into a target portal without re-authenticating.
Pin execution to a specific edge — the machine with the desktop session, the VPN route, or the local app already installed.
Fresh sandbox per run, VPC-routed edge, or cloud provider (Browserbase, Browserless, Cloudflare BR, CDP attach).
Three things must survive between runs: what an agent learned, the state of multi-step work, and the boundary between one environment's knowledge and another's. All three are workspace-scoped and persisted in Postgres.
Agents reuse prior context inside the same environment without inheriting context from unrelated work.
Child agents get only the context they need. Long runs survive restarts. Operators resume or audit work without reconstructing state manually.
Core decides. The edge fleet executes. Console and Desk expose the same run state, approvals, and audit to different operator roles.
flowchart TB
subgraph ingress[" Ingress "]
direction LR
U["User"] ~~~ A["Agent"] ~~~ CH["Channel"] ~~~ CLI["CLI"] ~~~ MCP["MCP Client"]
end
subgraph core["Octvex Core"]
direction TB
AUTH["Auth / workspace"] --- POL["Policy / approvals"]
POL --- ORCH["Orchestration / harness"]
ORCH --- VAULT["Credential vault"]
VAULT --- BK["Broker / routing"]
BK --- MEM["Memory"]
MEM --- AUD["Audit"]
end
subgraph surfaces[" Operator surfaces "]
direction LR
CONSOLE["Console\nweb"] ~~~ DESK["Desk\nlocal HITL"]
end
subgraph edge["Edge fleet"]
direction LR
E1["local"] ~~~ E2["sandbox"] ~~~ E3["VPC"] ~~~ E4["hosted"]
end
ingress --> core
core --> surfaces
core --> edge
edge -. "progress / artifacts / telemetry" .-> core
Orchestration, policy, credentials, MCP, audit. MCP server upstream, client downstream.
Runs in the trust boundary that can reach the target. Enrolls, leases work, streams progress.
Workspace admin, run management, policy editing, approval queue, audit logs, fleet monitoring.
Desktop client for HITL approvals, MCP client auto-config (Claude, Cursor, VS Code), biometric vault.
Two common reference points. Octvex is the right fit when hosting, credentials, execution placement, and approval workflows need to stay under operator control.
Claude Managed Agents is a fully managed Claude-native service on Anthropic's infrastructure — built-in sandboxing, tool execution, long-running sessions. Octvex is for teams running agents across many isolated environments where tenancy, execution, and credentials stay under operator control.
| Claude Managed Agents | Octvex | |
|---|---|---|
| Operating model | Fully managed cloud service hosted by Anthropic | Self-hosted control plane on your own infrastructure |
| Model support | Claude models on Anthropic's cloud | Model-agnostic; works with any LLM through MCP |
| Isolation | Session-based execution managed by Anthropic | Workspace-scoped isolation per environment; multi-tenant by design |
| Execution placement | Centralized sandbox with built-in code and tool execution | Distributed edge fleet across local, sandbox, VPC, and hosted environments |
| Credentials | Anthropic-managed auth with scoped permissions | JIT credential vault with per-run leases; never placed in prompts |
| Governance | Scoped permissions and managed governance tools | RBAC/ABAC policy engine with approval gates and HITL |
| Orchestration | Long-running sessions; multi-agent coordination in research preview | Parent/child fan-out across parallel edges with join groups |
| Memory & audit | Session persistence; memory tooling in research preview | Persistent sandbox leases, fixed-host pinning, full audit trail, hybrid memory per workspace |
If you know OpenClaw: it's a single-gateway agent runtime — typed protocol, Markdown memory, skills, cron, webhooks. Octvex starts from similar primitives but targets multi-environment, multi-edge operation where the workspace is the trust boundary.
| OpenClaw | Octvex | |
|---|---|---|
| Trust boundary | Single gateway, single operator | Workspace-scoped isolation per environment |
| Execution | Runs on the gateway host | Control plane / edge fleet split across trust boundaries |
| Fan-out | Single-process agent loop | Parent/child sprawl across parallel edges with join groups |
| Scaling | Vertical: one host | Horizontal: auto-scaler provisions edges on demand |
| State | Local disk directory | Postgres-backed durable runs, artifacts, audit |
| Memory | Markdown + optional QMD | Markdown-in-Postgres, hybrid retrieval, scope-aware |
| Credentials | In-memory snapshot | Workspace-isolated vault, per-run JIT leases |
| Migration | — | Importer for OpenClaw exports |
OpenClaw is the direct inspiration for the typed protocol, channel model, skills, and memory philosophy. Octvex takes that model and makes it safe to share across environments and hosts.