OrgAI

Self-hosted policy enforcement for AI-written code.

One policy source. Every AI agent. Every commit. Proven in an append-only audit trail.

orgai.dev · Quick start · How it works · Features · Developer setup · Contact

---

Your developers ship code written by Claude Code, Cursor, Copilot (agent mode), and Windsurf. OrgAI lets the organization define coding policies once — centrally, per role — and enforces them across every agent, every commit, and every CI run.

	Layer	How	Guarantee
①	Agent steering	MCP server — any MCP-compatible agent	Policy checked before code is written; violations caught at the source
②	Commit gate	Git pre-commit hook	Violating commits blocked; COMPLY_SKIP bypass is logged, never silent
③	Build gate	CI check over the diff range	Final backstop — violating builds fail

• Deterministic — checks are pattern rules, not model calls: milliseconds, zero tokens, same code in → same verdict out. No LLM in the check path.
• Private — runs in your VPC or fully air-gapped. Your code never leaves your network.
• Auditable — every check, violation, and bypass lands in an append-only trail, attributed to a person via developer-bound API keys. Evidence for SOC 2 / ISO 27001 / HIPAA / DPDP reviews — evidence, not certification.
• Safe to roll out — new policies (and the HIPAA / PCI DSS / DPDP starter packs) start in shadow mode: evaluated and logged, never blocking. Watch the noise, then enforce.
• Org-shaped — policies attach to roles, roles inherit, and a member can hold multiple roles across departments: they get the union, strictest wins.

Where it sits

flowchart LR
    subgraph DEVM ["Developer machine"]
        direction TB
        DEV([developer]) -->|prompt| AGENT["AI agent
        Claude Code · Cursor · Copilot · Windsurf"]
        AGENT -->|code| REPO[(local repo)]
        REPO -->|commit| HOOK[pre-commit hook]
    end

    subgraph ORG ["Your infrastructure · self-hosted / air-gap"]
        direction TB
        DASH[dashboard] --- API["OrgAI API · MCP"]
        API --- DB[("Postgres
        policies · roles · audit")]
    end

    ADMIN([admin]) -->|policies & roles| DASH
    AGENT -.->|"① check before writing"| API
    HOOK ==>|"② blocks the commit"| API
    REPO -->|push| CI[CI pipeline]
    CI ==>|"③ fails the build"| API

Loading

Dotted = advisory steering (the agent asks first). Thick = hard gates (the answer is enforced). An agent — or a human — that ignores the steering is stopped at commit, and again at build. Full walkthrough: HOW_IT_WORKS.md.

Quick start

One command — starts PostgreSQL (Docker/Podman), runs migrations, boots API + dashboard with hot reload:

git clone https://github.com/MrKuros/orgai-platform
cd orgai-platform
./dev.sh
# API:       http://localhost:8080
# Dashboard: http://localhost:3000
# Stop:      ./dev.sh --down

Or with docker-compose: cp .env.example .env && docker-compose up.

Connect a developer

One command per developer — configures their MCP clients and installs the pre-commit hook:

curl -fsSL https://<your-orgai-host>/setup.sh | bash -s -- --key oai_xxx --role backend-dev

With a developer-bound key (issued in the dashboard), skip --role — the server already knows their roles and attributes every check to them.

Manual MCP configuration (Cursor, Claude Code, Windsurf — any MCP client):

{
  "mcpServers": {
    "orgai": {
      "url": "https://<your-orgai-host>/mcp",
      "headers": { "x-api-key": "oai_your_key_here" }
    }
  }
}

For Copilot agent mode, the setup script writes .vscode/mcp.json automatically.

Full onboarding: DEVELOPER_SETUP.md · complete feature list: FEATURES.md

Architecture

orgai-platform/
├── packages/core/   Policy engine + evaluator (the single implementation)
├── api/             REST API + MCP server (Express + Prisma + PostgreSQL)
├── dashboard/       Admin dashboard (Next.js)
├── mcp/             Standalone MCP CLI (orgai-comply)
└── extension/       VS Code extension (optional, cloud-LLM based — outside the self-hosted enforcement path)

Production deployment

Self-hosted bundle — one tarball with images, compose file, and installers (Linux/Windows), fully air-gap capable:

./selfhost/build-bundle.sh

Operator guide: selfhost/README.md

CI

Every push builds and tests everything: API against a real PostgreSQL, MCP, dashboard build + lint, browser e2e suite, VS Code extension. CI is build + test only — no deployments run from this repository.

---

MIT licensed — use it, fork it, run it inside your company.

Running this in your company? Paid deployment, policy tuning, and support: kashish.patel@orgai.dev · orgai.dev