Skip to content
Architecture

One binary. One database. One gate.

OrchStack is the operating system for the AI-native company. At its core is OrchKernel. Agents propose. Rules decide. The kernel applies.

Become a design partnerSee how it works
The shape

Every agent asks the kernel first

Once an agent can act, two questions follow: who is it acting for, and who said it could? The kernel answers both, before every action.

People and agents

Who does the work

PeopleAgents you buildAgents you already useTools

The gate

Every action is a request the kernel checks

Kill switchesArgumentsDelegationBudgetsRulesRisk against trust

The kernel

What it owns

IdentityWho acts for whomTrustPolicyEvent logDurable runsCompany memory

Storage

Where it lives

One binaryOne database fileYour servers
How a request flows

From an ask to the log

Work starts from a person's ask, a schedule, a webhook, a changed record, a mention or a handoff. From there, the path is always the same.

  1. 01
    Work is scheduled

    The kernel turns the trigger into work and hands it to the right agent.

  2. 02
    The agent proposes

    It plans from its playbook. Each step that touches anything is a request to the kernel.

  3. 03
    The gate decides

    Allowed, needs approval or denied, with the reason.

  4. 04
    Approval, when it is needed

    Your rules auto-approve the routine. Otherwise the run waits, durably, and a reviewing agent or a person sees the exact payload. On approval, the run resumes.

  5. 05
    The kernel applies

    It runs the action once, with its own credentials. Agents never hold your vendor keys.

  6. 06
    Everything lands in the log

    Each event is chained to the one before. Any run can be replayed.

Around the kernel

What connects to it

Modules bring the work. Adapters and MCP reach your systems. The context layer feeds company memory. The gateway lets outside agents in.

01

Modules

A module brings agents with their playbooks, tools, rules and scorecards. Enable it in one click and map it to your teams. Your own modules are reviewed by a second admin before install.
The module catalog
02

Adapters and MCP

Any MCP server, built-in adapters for Zendesk, Salesforce, Stripe, GitHub, Google, Slack and Google Drive, and declarative adapters for any REST API.
Integrations
03

The context layer

Captures meetings, email, documents and chat. The Curator files and links each item. New knowledge waits until a person accepts it.
Company memory
04

The gateway

Outside agents get their own identity and act only through the gate. It brings a governed actions API with TypeScript and Python clients, and an MCP gateway.
The MCP gateway
Deploy

Runs where your data lives

Self-hosted: one binary and one database file, with Docker and Kubernetes assets. OrchKernel is source-available.

  • You choose your model providers. Each model is cleared for a data class.
  • Secrets are sealed at rest.
  • Every outbound request is checked against allowed hosts.
  • Multi-tenant hosting runs a kernel per tenant, under a commercial license.
docker compose
# Configure, create the first admin, then start.
$ cp .env.example .env
$ docker compose run --rm orchkernel init --admin root
$ docker compose run --rm orchkernel --as root token issue --for root
$ docker compose up -d

Frequently Asked Questions

Put an agent on real work, with people in charge

Design partners run one real workflow on OrchKernel and work directly with the engineers building it.

Become a design partnerSee how it works
OrchKernel is source-available and self-hosted.