Hezo

Run teams of AI agents like an organisation - self-hosted, sandboxed, with budget caps and your own model keys.

curl -fsSL https://hezo.ai/install.sh | sh

Quickstart · Features · Security · Docs · Website · X

_{⭐ If this is useful to you, a star helps other people find it.}

What is Hezo?

Hezo is a self-hosted server and web app for running teams of AI agents like an organisation. You stand up a CEO, a Captain, engineers, designers, researchers - whatever the work needs - with org charts, projects, budgets, and approvals built in. You manage goals and projects, not twenty terminal tabs.

Because those agents run real, often AI-written code, Hezo is secure by design: agents never see your real secrets, everything sensitive is encrypted behind a key only you hold, and every project runs sandboxed in its own container.

Quickstart

Agents always run inside a container, so this machine needs a Docker-compatible runtime (or point Hezo at a managed sandbox service and it needs none). Everything else is in the binary.

1. Install. One self-contained binary, nothing to compile.

curl -fsSL https://hezo.ai/install.sh | sh

Windows (PowerShell):

irm https://hezo.ai/install.ps1 | iex

2. Start the server.

hezo

3. Open http://localhost:3100. Follow the first-run setup to create your master key and connect a model, then build your first project.

_{Docker, Colima, Rancher Desktop, OrbStack and Lima all work, and Hezo finds the socket itself (see Container runtimes). Switch between local and managed containers at any time from Settings > Containers; see Containers. Prefer a manual download? Grab the binary from GitHub Releases, with full per-platform steps in Installation.}

Deploy to a cloud server

Want an always-on instance instead of running it on your laptop? Deploy to a cloud VM in a couple of minutes. Each provisions Docker, the binary, automatic HTTPS (a real cert via <ip>.sslip.io - no domain needed), systemd, and a locked-down firewall, and drops you at the in-browser setup.

Google Cloud and AWS are one-click today - Google Cloud opens Cloud Shell and runs the deploy, and AWS opens a CloudFormation Launch Stack (pick a size, then Create stack). DigitalOcean opens a short guide until its Marketplace image is listed. Any provider that takes cloud-init works too - see One-click deploy.

These buttons target VM providers because the default setup runs each project's agents on the host's own container-runtime socket, which needs a real VM - not a managed-container PaaS (Render, Railway, Cloud Run). Run the containers on a managed sandbox service instead and the server needs no runtime at all, so a much smaller VPS will do. See Deploying to the cloud.

How it works

1. Create a project and pick a team. Launch a ready-made team from the marketplace - App Team, Social Media Marketing or Investment Portfolio - start from a template, or ask the CEO to assemble one for the work.
2. Set the direction. Specify the project plan, shape the team's structure, hire or customize agents, and give any agent its own model.
3. The team gets to work. Agents pick up tasks and work autonomously, asking for your approval when needed. The project dashboard tells you where things stand without your having to read the board.

_{Ask the CEO from Slack, Telegram or Discord  ·  Nothing consequential happens without your approval}

Features

• Agents organised like a company. A global CEO and Coach above per-team Captains and workers, with org charts you reshape while a project runs.
• Tasks that run themselves. A task board with nested sub-tasks, heartbeat wake-ups, approval gates, and long runs that resume on their own.
• Works on your real repositories. Agents clone, commit and push over your connected GitHub account, and the signing key never enters the container, so commits land verified.
• One platform layer over every model. The meta-harness runs each model in its own first-party CLI, then levels the differences: the same tools, skills, memory and sandbox whichever you pick, plus a completeness check that will not let a run end on failing tests or an "out of scope" dodge on the runtimes whose CLI can block a turn (Claude Code, Codex and Kimi Code; Antigravity, Grok Build and OpenCode cannot, and fail open).
• Agents never hold your secrets. Every credential is a placeholder. The egress proxy swaps in the real value only for the hosts you allowed.
• Your models, your spend. Bring your own provider accounts, give any agent its own model, set budget caps, and see cost per run.
• Container hours, not just tokens. A ledger of how long every container was up, with a monthly allowance that stops new containers once it is spent.
• Sign in to a subscription from the UI. Guided sign-in runs inside a container, so an Anthropic or OpenAI plan works without pasting an API key.
• Self-hosted, one binary. Runs anywhere a Docker-compatible runtime does, or on a host with no runtime at all when containers live on a managed service. Configured by a .cjs config file.

Everything else, with links into the docs

• Structure the team to the work - compose the roster, the reporting lines, and what each role is, change it while a project runs, and carry a structure you've tuned forward to the next one.
• Teams & projects - one team per project, launch a ready-made team from the marketplace or start from a template, hire and customize agents, snapshot a team to reuse, export one to share.
• Know where a project stands - a project dashboard leading with a summary the Captain keeps current on its own, with optional high-level goals and scheduled re-checks layered on top.
• Choose where containers run - on your own machine or a managed sandbox service, switchable either way at any time, with containers started on demand and a memory budget shared across every project.
• Secure by design - secret placeholders, encryption at rest, admin password sign-in, sandboxed containers, verified git commits, an audit trail.
• Teams that improve themselves - the Coach writes durable learned rules back onto agents after each finished task.
• Knowledge & memory - documents, skills, version history and restore, long-term chat memory, assets, full-text search.
• Connect your tools, both ways - drive Hezo from any MCP client via its built-in MCP server, and give agents the services you already use with connectors - hosted MCP servers or plain REST APIs - scoped to one project or shared across all of them.
• Chat from anywhere - run the CEO from Telegram, Slack, and Discord, as a private assistant or a coworker in your team channels.
• Your data, in your storage - embedded Postgres, optional hosted Postgres, local or S3-compatible asset storage, data-preserving upgrades.
• Speaks your language - the web app runs in 12 languages, picked from your browser on first run; date and currency formats are chosen independently.
• Easy to run - one-click cloud-init, secure remote access, safe-rollback backups, in-app self-update, a mobile-first web app.

_{The Coach reviews every finished task and writes back the lessons worth keeping  ·  Skills the whole team can use, per project or globally}

Agents never hold your secrets

This is the part most agent setups get wrong, and a big reason Hezo exists. Agents reference every credential by a placeholder - never the real value:

Authorization: Bearer __HEZO_SECRET_STRIPE__

The real key lives encrypted in Hezo's vault. When the request leaves the container, the egress proxy checks the destination against that secret's allowed hosts and swaps in the real value only if it matches - say, api.stripe.com. Send it anywhere else and the proxy blocks the request; the substitution simply never happens.

So a buggy, jailbroken, or outright malicious agent cannot leak what it never sees. It can only use a secret against the hosts you scoped it to, and the value is never written to a log line or to disk - diagnostics record the placeholder instead. The same posture runs end to end: encrypted at rest behind your master key, every project sandboxed in its own container, and an append-only audit trail of what people and agents did. See the security documentation for the full picture.

It's all yours: self-hosted, your model accounts, your spend, your data.

Works with your models

Bring your own provider accounts - connect as many as you like, and give any individual agent its own model. Each provider is driven through a first-party agentic command-line runtime inside the container, not a lowest-common-denominator wrapper. Anthropic, OpenAI, Google and xAI each run on their own CLI; the Anthropic-compatible providers run through Claude Code, and OpenRouter through OpenCode. Hezo's meta-harness levels the differences, so the tooling, memory and sandbox stay the same underneath whichever model you pick.

Provider	Models	Runtime	Auth
Anthropic	Claude	Claude Code	API key or subscription
OpenAI	ChatGPT / GPT	Codex	API key or subscription
Google	Gemini	Antigravity	API key
xAI	Grok	Grok Build	API key
Kimi (Moonshot)	Kimi	Claude Code or Kimi Code	API key
DeepSeek	DeepSeek	Claude Code	API key
Z.ai	GLM	Claude Code	API key
OpenRouter	Many, via one account	OpenCode	API key
Ollama	Whatever you run locally	Claude Code	Server URL (key optional)
LM Studio	Whatever you run locally	Claude Code	Server URL (key optional)

Where the Runtime column lists more than one, that credential chooses which CLI it runs on; the first is the default, so adding a key without touching the setting just works. You can change it later, or rotate the stored key in place, without re-adding the connection.

Ollama and LM Studio run agents entirely on your own hardware at no per-token cost - point Hezo at your server URL and leave the key blank.

Full details (subscriptions vs. API keys, mixing providers, per-agent overrides) in AI model support.

Development

Contributor setup, scripts, and the testing guide live in .github/CONTRIBUTING.md and AGENTS.md. You'll need Bun v1.3.14+ and a Docker-compatible runtime.

git clone https://github.com/hezo-ai/hezo.git
cd hezo
bun install
bun run dev        # server on :3100, web UI on http://localhost:5173
bun run test       # the full test suite

Community & license

⭐ If Hezo is useful to you, a star helps other people find it. It is the main way a self-hosted project gets discovered, and it costs you one click.

Questions and bug reports are welcome via GitHub Issues.

Copyright (C) 2026 Ramesh Nair.

Hezo is licensed under the GNU General Public License v3.0 or later.

X: @hezo_ai