The open-source AI Operating System
An agentic operating system decides what each AI agent may reach, on which sandbox, and who signs off before the work lands. Kortix is the open-source AI Operating System: your agents, their skills, your company memory, and every connector in one git repo you own, and it is built to survive a security review.
Self-host is free · Per-resource permissions for people and agents · Open source. Read it, fork it, audit it.
Tools · Northwind Billing
The Tools tab on the Northwind Billing connector sets a policy for each action: List invoices is Allow, Get an invoice and Send a payment reminder stay on Default so the connector's policy decides them, Delete an invoice is Block, and Record a payment and Refund a payment are Ask so each call waits for a person
agents:
kortix:
file: agents/kortix.mdhttps://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml
Session work reaches main through a change request. Merge is default-deny for agents.
Each file is what someone opens afterwards.
Operations
A cron trigger starts a session on Sunday night. The agent pulls the week's numbers from the connectors it was granted and returns a spreadsheet with the variance called out.
Work product
| Metric | This week | Last week |
|---|---|---|
| Signups | 412 | 388 |
| Activation | 61% | 58% |
| Churn | 1.9% | 2.2% |
Engineering
The agent reproduces the failing export on its session branch, patches the timeout, runs the checks and opens the change request with the diff attached, and a person merges it.
Work product
app/exports/worker.ts- await render(job, { timeout: 30_000 })+ await render(job, { timeout: 120_000 })Support
The agent reads the overnight tickets, groups them by cause, drafts the replies it can support and holds the rest for a person.
Work product
A company that owns the repo can read every grant, fork the whole project, and audit what its agents did without asking a vendor for a report. The permission model gets a diff, and a diff can be reviewed.
Read it, fork it, audit it. 20,000+ GitHub stars Read the source · How the grants work · Self-hosting
Where the compute runs, where configuration lives, and who can widen an agent's reach.
kortix.yaml and agents/*.md in your repoDirect answers to the three questions buyers ask first.
An agentic operating system is the layer that gives each AI agent an identity, a grant, a sandbox to work in and a record of what it did. Without that layer, a company has a chat window and no answer to who allowed the work.
Yes. Kortix is one: open source, self-hostable, with each agent's grant in a file a reviewer can read. OpenFang is another, a single Rust binary that runs scheduled agents and puts approval gates on sensitive actions.
Start where the grants live. Name each agent, list the connectors and secrets it may reach, and decide who approves a change. Then add the scheduler, the sandbox and the record, and keep the whole set in one repo.
Start on Kortix Cloud, or run the whole stack on your own network.