QuoxCORE · source-available core · self-hosted
The self-hosted control plane for AI agents.
Give agents real access to your systems while you control what they can do, approve what matters, and keep independently verifiable evidence of every governed action.
curl -fsSL https://get.quox.ai | shNeeds Git, Docker Compose and a Linux or macOS host.
Source opens at launch. Until then this command reaches private repos and will ask for access; it is shown so you can see exactly how install works.
your keys · your data · no card
In plain words
What it is, where it lives, when to reach for it
- What is it
- The self-hosted platform that runs your AI agents: a server stack, a web dashboard and a CLI.
- Where do I use it
- On a Linux server you own; you work in the dashboard in your browser.
- When would I use it
- When you want AI agents working for your team on your own hardware, under your own rules.
- How do I use it
- Run
docker compose up -don your server, then finish the Setup Wizard in your browser.
What it is
Five engines. One install.
QuoxCORE is not another chatbot wrapper. It is the layer your other AIs stand on: five engines sharing one graph, one policy plane and one evidence chain.
QuoxCORE is the platform beneath every agent you run: a harness for your models, an orchestrator for your fleet, a workflow engine, a long-running task engine, and a vault built for AI credentials.
01 · harnessA harness for your models
Bring keys for Anthropic, OpenAI, Gemini, Perplexity, Groq, Mistral, xAI, DeepSeek or Together, or point it at local inference. Every model call goes through the same governed door and comes back with evidence.
▸ 9 providers + local · one door02 · orchestratorAn orchestrator for your fleet
49 specialist agents, routed by intent. Hand-offs are policy-checked envelopes, not hopeful HTTP calls into the dark.
▸ AEE envelopes · routed03 · workflowsA workflow engine
QuoxFlow builds visually, previews live and attaches evidence to every run, and a template library is ready to import from.
▸ template library · live WireMap04 · objectivesA long-running task engine
Objectives decompose into tasks that run server-side with heartbeats, locks and an enforced state machine. Close the tab: the work carries on and reports back.
▸ server-side · approval-gated05 · vaultA vault built for AI
AES-256-GCM envelope encryption with per-credential data keys. Agents borrow credentials on scoped, expiring, use-capped leases with full audit. They never keep them. Bundled with the free core, no separate licence.
▸ leased · audited · AES-256-GCMCounted 2026-09-12. Integration types are provider credential schemas the vault can hold and test, not certified end-to-end connectors.
The problem it removes
Agents are easy to start. They are hard to trust.
Getting an agent to do something useful takes an afternoon. Letting one near production takes a year of arguments, and the arguments are always the same three: nobody can say exactly what the agent is allowed to touch, nobody is asked before it does something irreversible, and afterwards nobody can prove what actually happened. QuoxCORE exists to settle those three, once, for every agent you run.
The demonstration
Watch a request find its agent.
You ask in plain language. QuoxCORE reads the request, picks the right specialist from your fleet, and hands the work over inside a governed envelope. Here is one run, recreated in the order it happens: routed, checked against policy, given a credential that expires, held for a person, executed, then written to evidence.
Same door, right specialist, every time, and anything sensitive holds at the approval gate until a human decides. The pulses racing the constellation behind this page are these hand-offs in flight.
Multi-agent system
49 specialist agents.
Automatic delegation across the full roster. You ask, the right agent answers. Every one of these is a node in the graph behind this page. 37 of the 49 are named below; the agents page carries the complete roster with a per-agent capability verdict.
Everything the fleet learns lands in one persistent, shared memory, so what an agent works out today is still there next month and the rest of the roster can use it. How QuoxCORE remembers →
See the agents: the honest roster, with every tool's real status →
The roster is open. New agents register on the graph and become routable straight away.
General queries, coordination
CVE scanning, threat detection
Connectivity, VPN, firewalls
Deployments, CI/CD, containers
Classification, patterns
VMs, snapshots, Proxmox
CPU, memory, disk, alerts
Grafana, visualisations
Best practices, configs
SLA tracking, availability
GitHub issues, PRs, releases
Documents, summaries, comparisons
Self-diagnostics
Backup, restore, migrate
Testing, validation, QA
Builds agents, tools and teams
MikroTik, DHCP, routing
Tailscale devices, routes, ACLs
Host access, SSH audit trail
Wazuh alerts, CVE triage
Config changes, dependencies, audit
Publishing, engagement, page presence
Uploads, metadata, playlists
Todos, priorities, deadlines
Terminal AI, shell, vim
Image generation, editing, vision
Code review, large-context analysis
Web search, fact verification
Multi-host container management
Navigates and extracts from any site
Prioritises, recommends actions
Evidence chains, control mapping
Anomaly detection, spatial queries
Streams, phases, dependencies
Builds QuoxFlow workflows
Governed, sandboxed tool authoring
Tool discovery across ~3200 entries
Governance
Checked, gated, and on the record.
Governance is not a module you bolt on afterwards. Every request travels the eleven AOCL layers, ingress to audit, and each layer emits an observable event. AEE envelopes carry the work between agents, the WARD chain witnesses every step, and what comes out the far end is a trace somebody outside your company can read.
01 · approvalsA human gate on anything sensitive
Approvals queue in one inbox with search, filters and bulk actions. TRIAGE-Q sits in it with you, summarising what needs attention first, and you move through the queue with j and k.
▸ hitl inbox · approval-gated02 · credentialsCredentials agents borrow, never keep
QuoxVault holds eight typed credential kinds, from API keys to SSH keys and TLS certificates, under AES-256-GCM envelope encryption. Leases are scoped, expiring and use-capped, and every grant and every use is audited.
▸ leased · audited · AES-256-GCM03 · tenancyOrganisations, divisions, teams
Real multi-tenancy with RBAC and capability-based permissions. Each organisation gets its own assistant, its own scoped memory and its own scoped skills, so one install serves many teams without leaking between them.
▸ rbac · scoped per org04 · evidenceProof you can hand to an auditor
VOLT hash-chains every governed run as it happens, and WARD witnesses it. Drop a bundle in and verify a chain yourself, without having to trust us.
▸ volt · hash-chained · witnessedSometimes you need to prove what happened and when and why.
The real thing
Not a mock-up. This is what you just watched.
QuoxCORE running an infrastructure health check across the fleet, with the AOCL layer trace open beside it, live, from ingress to audit. Most platforms show you an answer. This shows you the answer, the route it took, the policies it passed, the memories it used and what it cost, then lets you export the proof.
- 1Switch org and hit E-STOP if neededThe org switcher, a kill switch and the live DEFCON state all sit in the same bar you use everywhere else on the platform.
- 2Running jobs queue in the goal laneEvery active run gets its own card and a live status dot, so nothing in flight goes unnoticed.
- 3Pick the agent, model and credentialCommanderQ, Claude Opus 4.6 and a named key are chosen per conversation, no code required.
- 4Watch the AOCL pipeline executeLayers L4 through L10 run in view, each with its own timing, so the route from plan to audit is never a black box.
- 5CommanderQ names itself and its next moveThe identity card states which agent answered and why, with live suggestions when nothing needs attention.
Captured from the real command centre, not a mockup.
- 1Every trace has its own addressThe conversation ID sits in the breadcrumb, so any run can be found and shared directly.
- 2Export with the control mapping attachedJSON, Markdown or CSV, each carrying the SOC2 control tags the run actually touched.
- 3Read the run header at a glanceComplete status, elapsed time, layer count and decision count, before you read a single layer.
- 4A plain-English summary up topModel used, policy checks passed, memories retrieved, cost and verification status, in one sentence.
- 5The Policy layer shows its workingFour checks ran and the decision was ALLOW in 33ms, an enforcement step made visible rather than assumed.
- 6The chain says exactly what it can proveVOLT integrity verified 32 events; WARD witnessing was not available on this run. The trace states the gap instead of hiding it.
Captured from a real run trace, not a mockup.
A one-line request turned into a governed plan: title, description, token and tool-call budgets, and an approval checkpoint, before anything runs.
AI Studio, where you teach the fleet what to do: assistants, agents, teams, workflows, prompts, skills and crystals, configured in one workshop.
Ask a question, get an answer, keep the proof. Every trace exports to JSON, Markdown or CSV with its SOC2 control mapping.
The dashboard
Built for operators, not admins.
Every surface above is functional, navigable and keyboard-first. You have watched it work; this is what your hands learn.
Command palette ⌘K
⌘K opens instant search across every page, agent and tool. Navigate the entire platform without touching a mouse.
HITL inbox jk
Sensitive actions wait for a human. Search, filter, bulk approve or deny, and move through the queue with j and k. Urgent items pulse in the sidebar.
Keyboard shortcuts 1–9?/
Number keys 1 to 9 for instant navigation. Question mark for help. Slash for quick filter. Every list supports j and k, Enter, and Escape.
Design system
Consistent tokens for colour, spacing, and typography. Collapsible sidebar sections with persistent state. WCAG 2.1, aria labels, accessible by default.
The orchestration graph
Every node governed.
Every filament recorded.
QuoxCORE doesn't just connect your agents, it makes every route between them a governed, witnessed event. What you see behind this page is what your fleet actually looks like.
01 · routedOrchestration
Route work across your whole fleet from one plane. Hand-offs between agents are first-class, policy-checked events, not hopeful HTTP calls into the dark.
▸ AEE envelopes · routed02 · governedTools and powers
Grant each agent scoped powers over real tools: short-lived, least-privilege, revocable in one click. Credentials are leased through the vault, never handed over.
▸ scoped powers · governed03 · witnessedTelemetry
Watch the graph light up in real time: every run, retry and decision streamed to a tamper-evident chain your auditors can verify without trusting you.
▸ WARD chain · witnessedThe platform
One platform. Every tool you need.
Start with QuoxCORE and add what you need. Every product below lands its actions on the same evidence chain, so the whole system stays provable.
QuoxCORE
The command centre
The platform every capability runs on: agents, memory, workflows and the evidence chain, in one place you host.
Open QuoxCORE →Install
Self-hosted. Source-available. Free to start.
You have seen the command twice already. Here it is properly, three steps.
git clone https://github.com/quoxai/quox.git && cd quoxNeeds Git, Docker Compose and a Linux or macOS host.
What it costs
Included is the floor. This is the ceiling.
Not a trial tier. The full platform, self-hosted, with everything in this list bundled into the free install. These ship free for self-hosted installs:
Self-hosted, your keys, your data, no card to start.
curl -fsSL https://get.quox.ai | shNeeds Git, Docker Compose and a Linux or macOS host.
Source opens at launch. Until then this command reaches private repos and will ask for access; it is shown so you can see exactly how install works.
Then it expands
The same install keeps growing.
Everything above ships in the box. This is how one install grows around your work without becoming a different product.
01 · connectPlug in LLMs, APIs and MCPs
Paste a running MCP endpoint, or a GitHub repo that QuoxCORE clones, builds and spawns, then introspects into governed tools. Through QuoxMCP the platform speaks MCP the other way too, so your Claude can drive the governed tools on your own install.
▸ mcp endpoint + hosted · beta02 · powersGrant tools and powers
Scoped, revocable, least-privilege grants per agent, backed by vault leases.
▸ scoped powers · governed03 · workflowsBuild workflows
Start from the template library or a blank canvas, with a live preview of the wire map as you build.
▸ quoxflow · evidence attached
04 · objectivesRun objectives
Autonomous goals with a human gate: plan, approve, start, track. Runs survive the closed tab and report back.
▸ objectives · approval-gated
05 · skillsDevelop skills
49 seed skills across 12 categories, and the engine proposes new ones as your agents work. Skills earn patches by succeeding, and promotion is gated.
▸ qskl · 49 seeds06 · crystalsFreeze crystals
A proven run frozen for deterministic replay and signed with your organisation's Ed25519 crystal key. Same outcome, fewer tokens, evidence attached.
▸ frozen · signed · replayedThe plugins marketplace
Where the platform actually grows.
The real plugins dashboard: what is installed on your QuoxCORE anchor, what is available from the marketplace, and which type each one is.
- 1Three clicks from the home screenHome, Platform, Plugins: the real marketplace lives inside the dashboard, not a separate site.
- 2Every plugin lists a real tier and priceQuoxMind Complete is Premium at $49, active on this install right now.
- 3A most-popular ribbon, not a vibes claimQuoxMemory Implant carries the badge because it is the highest-adoption plugin, not marketing copy.
- 4Some plugins are free outrightCognitive Topology carries no tier gate at all, just a Free badge.
- 5New arrivals get flaggedA New ribbon marks OpsDeck as the most recent addition to the marketplace.
- 6Enterprise pricing goes well beyond freeAOCL Compliance Suite runs $599 a year, the top of the range sitting beside the free tier above.
Captured from the real plugins dashboard, not a mockup.
Where it stands
What's proven, what's not yet.
- 49-agent registry and delegation router, live and routing in production (additive keyword/capability scoring, not an LLM judge)STATUS_AND_LIMITS_AGENTS.md · Stable
- AOCL eleven-layer trace, audit-log UI and per-run export to JSON, Markdown or CSV with SOC2 control tagsSTATUS_AND_LIMITS_AOCL.md · Beta
- HITL inbox, bulk approve/deny and the SLA escalation runner, live in the auth serviceSTATUS_AND_LIMITS_HITL.md · Beta
- Server-side VOLT witness for every approval decision, with a durable retry queue if the collector is briefly unreachableSTATUS_AND_LIMITS_HITL.md · Beta
- Core memory store: CRUD, full-text search and per-org quotasSTATUS_AND_LIMITS_MEMORY.md · Stable
- Cross-org claim verification checks a counterparty’s name against an admin-seeded list today, not an Ed25519 signature; cryptographic verification is a queued follow-on
- Sub-agent creation from chat: ARCHITECT can propose an agent configuration, applying it still needs a human to wire it in
- The vector leg of hybrid memory search needs the Qdrant tier, which is not guaranteed running in every environment; without it, search still works, just keyword-only
- A live HTTP soak of the response-contract honesty guards through the real chat endpoint, at volume, is deferred to a later release
Each line above names the STATUS_AND_LIMITS file it comes from and the band that file gives it. Read Beta as built and unit-tested, not yet soaked at volume in production. Read Stable as proven on the real thing. The detail behind every line lives in those files, not just in this copy.
Ready when you are
Ready to command your infrastructure?
QuoxCORE works standalone, or with QuoxAgent and QuoxBastion for full coverage.
Go deeper