deco Studio Open-source · TypeScript-first · Deploy anywhere Open-source private AI workspace for organizations. decocms.com/studio Studio packages the infrastructure behind an internal AI rollout: model routing, MCP authentication, agent configuration, SSO, RBAC, audit logs, and usage accounting. Your teams get chat. You keep control. Under the hood it's one control plane for your AI agents — one
Add this skill
npx mdskills install decocms/studio@decocms? Sign in with GitHub to claim this listing.Enterprise-grade MCP control plane with SSO, RBAC, vault, observability, and multi-tenancy
1<h1 align="center">deco Studio</h1>23<p align="center">4<em>Open-source · TypeScript-first · Deploy anywhere</em><br/><br/>5<b>Open-source private AI workspace for organizations.</b>6</p>78<p align="center">9<a href="https://docs.decocms.com/">Docs</a> ·10<a href="https://decocms.com/discord">Discord</a> ·11<a href="https://decocms.com/studio">decocms.com/studio</a>12</p>1314> **TL;DR:** Your team needs a secure internal vibecoding platform. You just found it. Configure agents with team context. Connect private MCPs once — share capabilities, not credentials. Keep the model layer interchangeable. Roll out across the organization with SSO, RBAC, audit logs, and cost controls — all through one MCP endpoint. Local-first. Self-host or use the cloud.1516---1718## What is deco Studio?1920Studio packages the infrastructure behind an internal AI rollout: model routing, MCP authentication, agent configuration, SSO, RBAC, audit logs, and usage accounting. Your teams get chat. You keep control.2122Under the hood it's one control plane for your AI agents — one MCP endpoint for all your agents, tools, and models. Agents package context, tools, and policy into something you publish to the organization. Connections give them governed access to your systems — GitHub, Slack, Postgres, Sentry, anything that speaks MCP — with tokens stored in an encrypted vault. Models stay interchangeable: OpenRouter or direct providers, chosen per agent and per tool.2324Start with one team. Standardize approved models, tools, and context. Expand across the organization without copying secrets or rebuilding the platform. Install locally and it stays private; sync to the cloud for remote access, team roles, and shared billing.2526```27┌─────────────────────────────────────────────────────────────────┐28│ Clients │29│ Cursor · Claude · VS Code · Custom Agents │30└───────────────────────────┬─────────────────────────────────────┘31 │32 ▼33┌─────────────────────────────────────────────────────────────────┐34│ DECO STUDIO │35│ Agents · Connections · Models · Vault · Observability │36└───────────────────────────┬─────────────────────────────────────┘37 │38 ▼39┌─────────────────────────────────────────────────────────────────┐40│ Tools & MCP Servers │41│ GitHub · Slack · Postgres · OpenRouter · Your APIs │42└─────────────────────────────────────────────────────────────────┘43```4445---4647## Quick Start4849```bash50bunx decostudio51```5253Or clone and run from source:5455```bash56git clone https://github.com/decocms/studio.git57bun install58bun run dev59```6061> runs at [http://localhost:4000](http://localhost:4000) (client) with API routes proxied to the Bun server6263---6465## What you get6667### Agents6869Package context, tools, and policy into an agent. Define instructions, add skills and files, grant approved MCP access, choose a model policy, then publish the agent to the organization. Each agent is its own MCP endpoint — callable from Cursor, Claude Desktop, your own code, or another agent. Agents compose, and every action is tracked with cost attribution.7071### Connections7273Connect private systems once, securely. Register MCP servers at the organization level through a web UI with one-click OAuth — no JSON configs. Tokens live in the encrypted vault, and you grant tool-level access by organization, role, or agent. Share MCP capabilities — not credentials.7475As tool surfaces grow, Studio exposes **Virtual MCPs** — one endpoint, different strategies for which tools to surface:7677- **Full-context:** expose everything (simple, deterministic, good for small toolsets)78- **Smart selection:** narrow the toolset before execution79- **Code execution:** load tools on demand in a sandbox8081### Models8283Keep the AI layer interchangeable. Use OpenRouter or connect Anthropic, OpenAI, Google, or any compatible provider directly — the best model for each agent and tool, behind one router. For coding work, engineers can link their own Claude Code or Codex session and use the subscription already authenticated on their machine.8485### Projects8687Projects bring agents and connections together around a goal. The project's UI adapts to what's inside — add a content agent and a CMS connection, the sidebar shows content management; add an analytics agent and a database, it shows dashboards and queries. The UI you see is the UI that's relevant for operating that project.8889### Observability9091Account for every model and tool call. Trace the user, agent, model, tools, latency, errors, tokens, and cost for every thread. Break usage down by agent, connection, organization, or teammate — one dashboard.9293### From your desktop to your org9495| | |96|---|---|97| **Local** | `bunx decostudio` on your desktop. Embedded PostgreSQL. Private. |98| **Cloud** | Log in to studio.decocms.com. Control local projects from any browser. |99| **Team** | Invite people. SSO and role-based access. Shared connections. Cost attribution. |100| **Enterprise** | Self-hosted. Organization isolation, tool-scoped API keys, audit logs. Your infra, your rules. |101102---103104## Core Capabilities105106| Capability | What it does |107|---|---|108| **Agents** | Package context, tools, and policy into publishable agents with cost attribution |109| **Connections** | Route MCP traffic through one governed endpoint with auth, proxy, and encrypted token vault |110| **Models** | Interchangeable AI layer — OpenRouter or direct providers, model policy per agent |111| **Projects** | Organize agents and connections around goals with an adaptive UI |112| **Virtual MCPs** | Compose and expose governed toolsets as new MCP endpoints |113| **Observability** | Traces, costs, errors, and latency per user, agent, and connection — one dashboard |114| **Access Control** | SSO + RBAC via Better Auth — OAuth 2.1 and tool-scoped API keys per workspace/project |115| **Multi-tenancy** | Organization/project isolation for config, credentials, policies, and audit logs |116| **Event Bus** | Pub/sub between connections with scheduled/cron delivery and at-least-once guarantees |117| **Bindings** | Capability contracts so tools target interfaces, not specific implementations |118| **Store** | Discover and install agents, tools, and templates |119120---121122## Define Tools123124Type-safe, audited, observable, callable via MCP.125126```ts127import { z } from "zod";128import { defineTool } from "~/core/define-tool";129130export const CONNECTION_CREATE = defineTool({131 name: "CONNECTION_CREATE",132 description: "Create a new MCP connection",133 inputSchema: z.object({134 name: z.string(),135 connection: z.object({136 type: z.enum(["HTTP", "SSE", "WebSocket"]),137 url: z.string().url(),138 token: z.string().optional(),139 }),140 }),141 outputSchema: z.object({142 id: z.string(),143 scope: z.enum(["workspace", "project"]),144 }),145 handler: async (input, ctx) => {146 await ctx.access.check();147 const conn = await ctx.storage.connections.create({148 projectId: ctx.project?.id ?? null,149 ...input,150 createdById: ctx.auth.user!.id,151 });152 return { id: conn.id, scope: conn.projectId ? "project" : "workspace" };153 },154});155```156157Every tool call gets input/output validation, access control, audit logging, and OpenTelemetry traces automatically.158159---160161## Project Structure162163```164├── apps/165│ ├── mesh/ # Full-stack deco Studio (Hono API + Vite/React)166│ │ ├── src/167│ │ │ ├── api/ # Hono HTTP + MCP proxy routes168│ │ │ ├── auth/ # Better Auth (OAuth + API keys)169│ │ │ ├── core/ # StudioContext, AccessControl, defineTool170│ │ │ ├── tools/ # Built-in MCP management tools171│ │ │ ├── storage/ # Kysely DB adapters172│ │ │ ├── event-bus/ # Pub/sub event delivery system173│ │ │ ├── encryption/ # Token vault & credential management174│ │ │ ├── observability/ # OpenTelemetry tracing & metrics175│ │ │ └── web/ # React 19 admin UI176│ │ └── migrations/ # Kysely database migrations177│ └── docs/ # Astro documentation site178│179└── packages/180 ├── bindings/ # Core MCP bindings and connection abstractions181 ├── runtime/ # MCP proxy, OAuth, and runtime utilities182 ├── ui/ # Shared React components (shadcn-based)183 ├── std/ # Isomorphic async primitives (sleep, retry, backoff)184 ├── sandbox/ # Isolated per-agent containerized environments185 ├── mesh-sdk/ # SDK for external apps integrating with Studio186 └── create-deco/ # Project scaffolding (npm create deco)187```188189---190191## Development192193```bash194bun install # Install dependencies195bun run dev # Run dev server (client + API)196bun test # Run tests197bun run check # Type check198bun run lint # Lint199bun run fmt # Format200```201202### Studio commands (from `apps/mesh/`)203204```bash205bun run dev:client # Vite dev server (port 4000)206bun run dev:server # Hono server with hot reload207bun run migrate # Run database migrations208```209210### Worktrees211212`dev:worktree` routes `http://<WORKTREE_SLUG>.localhost` via Caddy — useful for running multiple workspaces without port conflicts.213214```bash215# One-time setup216brew install caddy && caddy start217218# Start219WORKTREE_SLUG=my-feature bun run dev:worktree220221# Conductor adapter (sets WORKTREE_SLUG from CONDUCTOR_WORKSPACE_NAME)222bun run dev:conductor223```224225---226227## Deploy Anywhere228229```bash230# Docker (embedded PostgreSQL)231docker compose -f deploy/docker-compose/docker-compose.yml up232233# Docker (PostgreSQL)234docker compose -f deploy/docker-compose/docker-compose.postgres.yml up235236# Bun237bun run build:client && bun run build:server && bun run start238239# Kubernetes (Helm)240helm install deco-studio oci://ghcr.io/decocms/chart-deco-studio --version <version> -n deco-studio --create-namespace241```242243No vendor lock-in. Runs on Docker, Kubernetes, AWS, GCP, or local runtimes.244245### What you need to run it246247| Tier | Footprint |248|---|---|249| **Laptop** | Nothing. One process, embedded PostgreSQL. |250| **Docker** | The published image. Bring PostgreSQL or use the embedded one. |251| **Production (Helm)** | PostgreSQL you bring, plus optional NATS (event bus wake-up), ClickHouse + OTel Collector (traces and analytics), and the sandbox operator (isolated agent environments on Kubernetes). Your identity provider, your model keys, your storage. |252253### Production topology254255```mermaid256graph TB257 clients["MCP clients — Cursor · Claude · VS Code · your code"]258259 clients -->|"one MCP endpoint · SSO · RBAC · audit"| api260261 subgraph k8s ["Kubernetes (Helm)"]262 api["Studio API + Admin UI"]263 api --> sandbox["Agent sandboxes<br/>(sandbox-operator)"]264 api -->|"notify"| nats["NATS"]265 api -->|"traces · costs"| otel["OTel Collector"]266 nats -->|"wake"| worker["Workers<br/>event bus · schedules"]267 otel --> ch[("ClickHouse")]268 end269270 pg[("PostgreSQL")]271 api --> pg272 worker --> pg273274 subgraph upstream ["Models & tools"]275 models["Anthropic · OpenAI<br/>OpenRouter · Ollama"]276 mcps["GitHub · Slack · Postgres<br/>your MCP servers"]277 end278279 api -->|"model routing · vaulted credentials"| upstream280```281282Every box is optional except Studio and PostgreSQL — start small, turn on the rest as the rollout grows.283284---285286## Tech Stack287288| Layer | Tech |289|---|---|290| Runtime | Bun / Node |291| Language | TypeScript + Zod |292| Framework | Hono (API) + Vite + React 19 |293| Database | Kysely → embedded PostgreSQL / PostgreSQL |294| Auth | Better Auth (OAuth 2.1 + API keys) |295| Observability | OpenTelemetry |296| UI | React 19 + Tailwind v4 + shadcn |297| Protocol | Model Context Protocol (MCP) |298299---300301## Roadmap302303- [ ] Agent marketplace — discover, hire, and compose agents304- [ ] Declarative planning engine305- [ ] Cost analytics and spend caps306- [ ] Remote access from any browser307- [ ] Live tracing debugger308- [ ] Workflow orchestration with guardrails309310---311312## License313314**MIT** — see [LICENSE.md](./LICENSE.md).315316Questions? [builders@decocms.com](mailto:builders@decocms.com)317318---319320## Contributing321322```bash323bun run fmt # Format324bun run lint # Lint325bun test # Test326```327328See `AGENTS.md` for coding guidelines.329330---331332<div align="center">333 <sub>Made with care by the <a href="https://decocms.com">deco</a> community</sub>334</div>335
Full transparency — inspect the skill content before installing.