archestra-ai/archestra

*Built on a strong security and observability foundation: SSO and RBAC,
sandboxed code execution, Lethal-Trifecta guardrails,
OpenTelemetry traces, and Prometheus metrics — first-class, not bolted on.*
Quickstart  · 
Docs  · 
Releases  · 
Slack
https://github.com/user-attachments/assets/912b85e2-ef14-4e83-a807-5e2a81457a88
---
What it does
Point your users — or your agents, or Claude / Codex / Cursor — at one URL. Archestra handles the rest:
- 💬 **Chat for non-technical users.** Internal AI assistant with
projects,
MCP apps, and
Slack,
MS Teams, and
email
front-ends.
- 🛠️ **Developer LLM & MCP portal.** One token for Claude Code, Codex,
Cursor — see the proxy.
- 🚪 **LLM gateway** for any provider
(Anthropic, OpenAI, Azure, Bedrock, DeepSeek, …) with
cost limits,
virtual API keys,
and dynamic model routing.
- 🔌 **MCP gateway** with OAuth + On-Behalf-Of
so tools run as the user, not a shared service account.
- 🤝 **A2A gateway** for agent-to-agent triggers.
- 📦 **Private MCP registry** so teams ship their own tools — see
registry docs.
- 🎼 **MCP orchestrator** with a
Kubernetes operator and
self-serve promotion.
- 🤖 **Agent runtime** with scheduled / email / webhook triggers,
sub-agent delegation,
reusable skills,
sandboxed code execution, and a K8s-native filesystem.
- 📚 **RAG knowledge base** plumbed via
connectors to
your existing stack.
- 🧩 **Mini app builder** — see apps.
- 🛡️ **Deterministic guardrails** for tool calls and
Lethal Trifecta protections.
- 🪪 **Identity & access** with SSO
(OIDC, SAML, Okta, Entra), RBAC with role mapping & team sync,
and secrets management.
- 🌎 **Environments** with per-env egress policies
and per-env cost limits.
- 🔭 **Observability** out of the box: OpenTelemetry traces, Prometheus
metrics, logs, per-team cost tracking.
> Already running dangerous single-tenant agents like Claude Cowork,
> OpenClaw, or Hermes in your enterprise? **Migration Kit →**
Quickstart
Open . Full Docker / Helm / Kubernetes instructions
live in the quickstart docs.
Release channels
Archestra maintains two active release tracks:
- **Stable releases** (e.g. 1.3.51): Qualified, tested releases for production deployments. Archestra maintains one active stable release line at a time with security patches and bug fixes.
- **Release candidates** (e.g. 1.4.0-rc.22): Previews of upcoming features built directly from the main branch. They let you test new capabilities and provide feedback before they land in a stable release. The Docker tag archestra/platform:latest points to the newest release, so it usually runs a release candidate.
New features and bug fixes land on main first and ship in rolling beta releases. Fixes are then selectively backported to the supported stable branch. For production environments, pin an exact version tag or Helm chart version rather than tracking latest. See our Release guide for full release lifecycle details.