Graph OS

The process you run to open the Knuckles agent platform.
_{MCP · REST · A2A · identity policy · fleet supervision · hosted interfaces}

Documentation · Capabilities · Interfaces · Status

Overview

Run Graph OS when an MCP client, HTTP application, A2A peer, or hosted interface needs one authenticated way into the platform. One serving lifecycle composes the same application services across transports, applies identity and tenant policy, and keeps tool discovery tied to the live fleet catalog.

Graph OS is the platform edge and composition root. It is not the agent harness, the durable database, a connector implementation, or the browser UI.

Key Capabilities

• Serve local MCP over stdio and authenticated MCP over streamable HTTP.
• Project the same governed operations through REST and unary A2A.
• Discover, admit, supervise, and route the MCP connector fleet.
• Apply identity, tenant, action-policy, idempotency, and provenance controls.
• Host Agent Web UI and coordinate terminal, desktop, messaging, and attended browser capabilities.
• Generate deployment configuration and report live readiness through /health.

Documentation

Start with the visual platform guide, then use the task-oriented references:

• Start Graph OS
• Review capabilities
• Choose an interface
• Understand the architecture
• Check live status
• Configure a deployment

Architecture

Layer	Authority	Relationship to Graph OS
Agent Web UI	Browser experience and local interaction state	Graph OS hosts it and supplies governed application routes.
Agent Terminal UI	Terminal and headless interaction	Uses the governed Graph OS REST interface.
Geniusbot	Desktop cockpit	Uses the governed Graph OS gateway for its primary panels.
Messaging channels	Chat and voice entrypoints	Graph OS hosts and supervises them; agent-utilities owns adapters and routing.
Graph OS	MCP, REST, A2A, identity policy, fleet supervision	The running process and public door.
agent-utilities	Agents, workflows, evaluation, and skills	Graph OS invokes its typed control-plane services.
epistemic-graph	Durable graph, SQL, RDF, vector, time, reasoning, and provenance	Graph OS uses its generated client contracts.
agent-connector-sdk	Connector servers, source synchronization, and governed effects	Graph OS discovers and routes SDK-based connector services.

The boundary is deliberate: Graph OS authenticates, composes, routes, supervises, and projects. Each sibling remains the source of truth for its own domain.

Quick Start

Requires Python 3.12–3.14 and uv. Install the bundled runtime, generate the local profile, and register its stdio launcher with Codex:

uv tool install "graph-os[webui]"
setup-config generate --profile tiny
setup-config doctor --profile tiny
setup-config codex

The doctor command is the first observable result: it reports whether the local profile and required authorities are ready before a listener starts. Graph OS then appears as the graph-os MCP server in Codex. Other MCP clients can launch the same local transport directly:

graph-os --transport stdio

Network deployments use the identity, TLS, and authorization settings in the deployment guide.

Contributing

Issues and pull requests are welcome. Read AGENTS.md for source boundaries and quality gates. Report vulnerabilities through GitHub Security Advisories.

Development

Create a branch, install the test extra, and run the focused tests plus repository hooks described in AGENTS.md.

License

Graph OS is released under the MIT License.