The operating system for
AI-native platforms.
faros is the open-source substrate you build your platform on — not another portal bolted over it. Workspaces are the isolation boundary, providers are the drivers, and every capability is a tenancy-scoped MCP tool.
Agents get a platform. Not root.
$ curl -fsSL https://downloads.faros.sh/install.sh | sh$ faros login
✓ authenticated · workspace root:faros:tenants:acme:web is yours alone
$ faros mcp url --mcpserver-name default
https://hub/…/mcp · every enabled provider's tools · scoped to this workspace
claude> provision postgres for billing on the home-lab cluster
→ infrastructure__provision template=postgres target=home-lab
✓ instance running · HTTPRoute published · OIDC in front
claude> now delete namespace kube-system on prod
✗ denied — outside workspace scope · recorded as an API eventKernel
Four primitives. Everything else is userspace.
An OS isn't a bigger app — it's a small set of primitives everything else is written against. faros has four, and they behave the same whether a human, a controller, or an agent is calling.
Workspaces are the isolation boundary
Every team, project, or environment gets a kcp logical cluster: its own API surface, its own RBAC, its own quota. Nothing leaks sideways because there is no sideways — an agent can't see what its workspace was never granted. Isolation isn't a setting; it's the address space.
Providers are drivers
A capability — databases, git repos, edge clusters, hosted agents — ships as a provider: its own pod, its own repo, its own release cycle. It plugs into the kernel through five sockets: an API, controllers, a proxied backend, a portal micro-frontend, and MCP tools. Enable one per workspace; the platform grows without a fork.
MCP is the syscall interface
One MCP endpoint per tenant federates every enabled provider's tools — and each tool inherits that workspace's permissions automatically. No god-mode gateway token, no second catalog of tools to govern separately. The platform and the agent interface are the same authority.
Edges are the I/O layer
Clusters, bare metal, home labs, Raspberry Pis — agents dial out to the hub over a reverse tunnel, so the hub is the only public endpoint in the system. No VPNs, no inbound rules, no kubeconfig juggling. Real hardware, addressed like a device file.
In action
Agents, running on your platform.
Declare an agent, give it a budget and a tool policy, and it works inside your workspace — under the same guardrails as everything else.
Drivers
Batteries included. Sockets exposed.
Everything above the kernel is a provider — including everything we ship. Each brings its own API, controllers, portal UI, and MCP tools, and is enabled per workspace.
Edges
Kubernetes clusters, Linux servers, and the apps beside them. kubectl and SSH through the tunnel, fleet-wide workload placement, and discovered services — Home Assistant, Grafana, Jellyfin — turned into tools.
Application Templates
Provision databases, caches, workers, and full apps from a curated kro template catalog — Gateway API exposure and per-app OIDC included, plus live development sandboxes with preview, logs, and file sync.
AI Agents
Long-running agents as platform resources: schedules, triggers, durable memory, budgets, approval inboxes, and Telegram/Slack channels — using every other provider's tools inside the same guardrails.
Code
Git repositories, commits, checkouts, deploy keys, collaborators, and published packages as declarative resources. GitHub first, other hosts pluggable behind the same API.
Kuery
One structured query across every object in the fleet, plus impact traversal — "who consumes this Secret, is it safe to rotate?" — instead of N kubectl round-trips through N tunnels.
Build a driver
Your capability, your pod, your release cycle — plugged into the kernel's tenancy, proxies, and guardrails. Copy the quickstart provider, rename it, ship it. The docs walk the whole contract.
Protection rings
Guardrails as architecture, not policy docs.
Agents operating real infrastructure today get one of two things: nothing, or a god-mode kubeconfig. Operating systems solved this forty years ago — you give them userspace.
Isolated by construction
Tenancy is the substrate, not a filter applied late. An agent physically cannot address resources outside the workspace it was issued — the request never reaches a place where the answer exists.
Everything is an API resource
Provisioning, repos, agents, edges — declarative objects, not imperative side doors. Every action an agent takes is something you can list, diff, audit, and revert. No mystery mutations.
Tools inherit permissions
MCP tools derive from the same RBAC that governs the API, so "what can this agent do?" has exactly one answer — and you change it in one place, not in a tool allowlist that drifts.
I/O
Agents dial out. You log in.
The hub is the only thing with a public endpoint. Clusters and servers behind NAT, corporate firewalls, or a home router dial outward and become part of your platform.
Agents dial out — NAT and firewalls stop being your problem.
Native access to every cluster and host, through one endpoint.
Orgs and workspaces, each an isolated logical cluster.
One URL — Claude and any MCP client drive the whole platform.
Time to platform
An evening. Not a quarter.
The platform market makes you choose: rent something closed in minutes, or spend months assembling something you own. faros refuses the trade.
Portal frameworks
Scaffold the app, wire the database, pick the plugins, staff the team. Months to first value — and at the end you have a catalog that describes your infrastructure, not a control plane that runs it.
Per-seat platform SaaS
Live in minutes — but closed source, priced per seat or per month in the thousands, and the control plane your platform depends on belongs to someone else.
faros
Hosted hub: two commands, free. Self-hosted: two Helm charts on any Kubernetes cluster, running by tonight. Open source top to bottom — kernel, portal, and every provider.
Boot sequence
Four commands to a live platform.
Install the CLI
One binary — macOS, Linux, WSL.
$ curl -fsSL https://downloads.faros.sh/install.sh | shLog in
Authenticate to the hosted hub — your isolated workspace is created on the spot.
$ faros loginAttach an edge
Get a one-time join command and run it on the cluster or host.
$ faros edge create my-cluster
$ faros edge join-command my-clusterHand it to your agents
A kubeconfig for kubectl, SSH for shells, and one MCP URL that gives Claude every provider's tools — scoped to this workspace.
$ faros kubeconfig edge my-cluster > kc.yaml
$ faros mcp url --mcpserver-name defaultFree forever. Open source by design.
Kernel, portal, and every provider are open source. Self-host it anywhere — a VPS, a home server, behind a Cloudflare Tunnel. No paywalled features, no usage limits, unlimited edges, and no per-seat pricing — platforms shouldn't tax headcount. Fork it, audit it, ship it.