pinchy

Pinchy is a self‑hosted AI agent platform that lets you give each team function, support, sales, operations, onboarding, finance, a dedicated assistant. The system runs inside Docker containers on any Linux host, and a single `docker compose up -d` command starts the web UI, database, and OpenClaw runtime. Because the whole stack can be air‑gapped, no data leaves your premises, which is useful for organizations with strict compliance requirements.

The core idea is to create one agent per role and then lock that agent down with three layers of boundaries. First, role‑based access controls decide which users can see or interact with a given agent. Second, an allow‑list of data directories determines exactly which files or databases the agent may read; the default stance is deny‑everything unless you explicitly grant read permission. Third, scoped plugins define which external tools the agent can call, such as Odoo, Gmail, Outlook, Telegram, or a web‑search service. Every request, whether reading a PDF, drafting a quote, or pulling a purchase order, is logged in a per‑row HMAC‑SHA256 signed audit trail that can be exported to a SIEM for further analysis.

In practice, a sales agent might receive a CSV of prospects, query a local OpenAI or Ollama model for pricing suggestions, and then write a draft quote into Odoo using the `odoo.draft` permission. The draft is saved but not sent until a human approves it, and the audit log records who triggered the draft and which data sources were consulted. A support agent can read a knowledge‑base directory, generate a reply in Gmail or Outlook, and present the draft to a human reviewer; the reply is never sent automatically because the `gmail.send` permission is blocked. Finance can run an invoice‑matching bot that reads incoming invoices, compares them to purchase orders in Odoo, and flags mismatches without ever initiating a payment.

Pinchy ships with pre‑built agent templates for Odoo 16, Telegram channels, and common email clients, so you can start with a ready‑made configuration and then adjust the allow‑list and permissions to match your policies. The platform also supports web search per agent, with each query logged, and a knowledge‑base feature that cites the source of every answer.