archestra

Archestra is an open‑source platform that adds a production‑grade layer between large language models and the systems they interact with. It is positioned for enterprise teams that need to run AI agents, LLM calls, and tool integrations while keeping data access, identity, and actions under control.

The platform provides a single gateway that all AI clients, such as Claude, Codex, Cursor, n8n, or custom internal agents, use to reach your models and tools. Through this gateway you can register models from providers like OpenAI, Anthropic, Azure OpenAI, Vertex AI, Bedrock, or self‑hosted instances, and enforce policies before any request is executed. Policies can restrict which tools are callable, require approvals, isolate network egress, and block unsafe data flows. Identity is tied to Entra ID, Okta, OIDC, or SAML, and each request is logged with the initiating user's credentials, giving you an audit trail that can be exported via OpenTelemetry or Prometheus.

Archestra is built to fit into existing infrastructure. You can run it locally from source, launch a Docker container, or deploy the Helm chart to a Kubernetes cluster that already hosts your PostgreSQL and observability stack. The quickstart scripts set up the platform in a few minutes, after which you can sign in with a default admin account. Once running, you can create projects, chat interfaces, or RAG applications that share the same control layer, and you can add your own models or knowledge bases. The MCP (Model Control Plane) registry, gateway, and orchestrator are modular, so you may adopt only the pieces you need.

The platform's licensing is AGPL‑3.0, meaning you can self‑host at no cost. All core components, including the LLM proxy, MCP gateway, identity integration, policy engine, execution audit, and cost control, are included in the free tier. Enterprise‑only features such as SSO/OIDC, RBAC, white‑labeling, and advanced knowledge‑base access control are opened up for teams under 30 users without a separate license; larger teams must request an enterprise license via email.

Key features

• Unified gateway for LLMs and tool calls with policy enforcement
• Identity integration with Entra ID, Okta, OIDC, or SAML, recording user context per request
• Observability hooks for OpenTelemetry, Prometheus, Grafana, and Splunk
• Deployment options: local source, Docker, or Helm chart on Kubernetes
• Support for multiple model providers and self‑hosted models