Comp AI

Comp AI is an open-source, agentic-first CRM licensed under MIT and self-hostable. Where Salesforce and HubSpot are database-with-a-form products that bolt an AI chat onto the side, Comp AI is built around the agent first — the CRM is the database the agent writes to. The agent runs on its own schedule, decides what to look at next, books its own follow-ups, and stops when the research budget runs out, rather than waiting for a human to drive it through a UI.

It means the API has no intelligence in it at all: the NestJS service just reports that something happened by writing a row to a queue, and the agent — running on Vercel's eve framework — leases that row and decides what it means. The agent ships with 18 tools (read_crm_history, search_crm, identify_contact, research_person, enrich_company, record_fact, schedule_recheck...) and 4 skills (evidence, identity matching, data boundaries, writing a brief) that are versioned like code. It runs inside a network-isolated sandbox with deny-all egress, and it has no DATABASE_URL, so a shell command cannot exfiltrate customer data.

Yes — it is single-tenant and self-hostable by design. The quickstart needs Bun and Docker; docker compose up -d brings up Postgres on :5432, then bun run db:deploy applies the Prisma migrations and bun run dev starts the app on :3000 and the API on :3001. Production deploys are three independent Vercel projects (app, API, agent) plus a Postgres, and the only shared secrets are DATABASE_URL and BETTER_AUTH_SECRET.

Most contacts and companies are created by the Gmail + Google Calendar sync, not typed in by a human — the agent pulls in threads, attendees, and signature blocks, which the README calls "the best evidence there is." Outside data sources (LinkedIn via RapidAPI, web research via Perplexity, company brand data via Context.dev) are all optional and each is gated behind an API key, so the agent plans around what this install actually has and runs fine with no keys at all. Every outside fact goes through an evidence ledger, and the rule the agent never breaks is nothing about a person is guessed — tools report what they observed (crm.signature-block, github.account-identity) rather than returning a confidence score.

Comp AI is internal-by-design: Google sign-in is the only way in, an ALLOWED_SIGN_IN env var (a domain or comma-separated list of addresses) is the entire authorisation model, and an unset value means nobody can sign in. There is no per-user permissions layer and no org/team concept — everyone who gets in sees everything, by design. The agent's sandbox has deny-all egress and no database credentials, so even a malicious prompt cannot leak data through shell commands, and you should read SECURITY.md before pointing it at real customer data.