Your first company, step by step.

1 · Install and migrate

If you use your own PostgreSQL instance, set DATABASE_URL in .env and skip npm run db:up. Keep the database port in that URL consistent with POSTGRES_PORT when using the supplied container.

npm run migrate is the only way migrations are applied — they are deliberately not mounted into the container’s init directory. Applied files are recorded with a checksum, and editing one that has already run is refused. Add a new migration instead.

2 · Start the interface

Open http://localhost:3000. The welcome page reports installation readiness, including dependencies it cannot confirm yet. The interface alone does not start model work. Keep this operator console on localhost or a trusted private network: it has no sign-in boundary. Public clients use the separate portal below.

3 · Create a company

Choose Create company. The four steps cover its name and mission, country and legal form, currency and spending ceiling, then a final review. Only the name is required. Nothing is created until you submit the final step. Leaving the budget blank means no configured ceiling, not a zero budget.

The template provisions 27 roles across these departments, with employee records and reporting relationships. This creates the team; model work still needs the worker. The organisation page lets an operator add template roles missing from an older company. Employee profiles hold status, model configuration, permissions and work history. Explore the team controls.

Settings records your company details, including country-specific identifiers such as an Indian CIN or GSTIN, a US EIN or a UK company number. Supported format and check-digit checks catch some entry errors. They do not incorporate a business or verify it with a registry. Explore company settings.

4 · Give it model access

Set the adapter, provider and model on each employee profile. Changes are versioned, so earlier attempts retain their configuration. Put only the API credentials those choices need in .env, or authenticate the CLI used by an employee.

The model field accepts a provider model identifier; it must support the protocol and response features required by the selected adapter. A compatible endpoint uses the OpenAI adapter with your base URL, rather than a separate integration for each vendor. Unknown API pricing stays pending with reported tokens retained. CLI subscription usage is tracked as quota, separately from money.

Anthropic, OpenAI, Google and xAI are the native API providers. The xAI adapter uses the fixed official endpoint and defaults to grok-4.6. Claude Code and Gemini CLI can be used as CLI adapters when their required isolation controls are available. Codex CLI execution is temporarily disabled pending verified no-tool isolation; use the OpenAI API for OpenAI employees. Additional CLI providers remain planned. MCP is a separate tool connection configured below. Check available connections and limits.

Claude Code must expose --safe-mode, --strict-mcp-config and --tools; these controls were verified with version 2.1.269. Gemini CLI currently requires the verified 0.47 release family and no managed system settings or policies that override employee isolation. The worker refuses incompatible installations and directs you to an API adapter. Supported CLI runs use your existing account sign-in without copying its credentials.

5 · Run the company

Before starting, put the company ID from the dashboard in COMPANY_ID. Document-only work does not require a repository. For repository delivery, supply a project repository path or set PROJECT_REPO_PATH as the worker fallback; repository tasks cannot run without one. The worker also needs database access and the API credentials or authenticated CLI required by its employees. npm run dev:all starts the interface and worker together; it does not start the client portal.

Create a project in the console and choose its solution type: software, marketing, content, design, research, data, operations or a custom brief. Choose repository delivery for executable work or document delivery for written outputs. Enter expected outputs and editable acceptance criteria, or request a requirements discussion first. Suggestions become part of the agreement only when you deliberately add them. Compare all 13 solution types and prerequisites. npm run seed:brief is an optional sample brief for the company selected in .env. Explore project planning and delivery and review.

RUNNER_MODE=local exists so a first run does not require Docker. It warns, and it refuses any instruction it cannot honour — it runs commands on your machine with your privileges and no sandbox, so use it only against repositories you already trust.

6 · Enable the client portal when you need it

The portal is a separate application with client sign-in. Add a client and its contacts in the console, link the appropriate projects and invite the contacts who need access. Their role controls what they can view or change, including projects, files, support requests, commercial documents and their own client team.

Set PORTAL_URL to the portal’s actual address; use HTTPS for a public deployment. Configure the mail delivery settings in .env.example if invitations and approved replies should be emailed. Publish the portal on a separate origin while keeping the operator console private. Explore portal access and client management.

7 · Set up MCP Connectors

Open Company → MCP Connectors. Choose GitHub, Playwright, Figma, Notion, Atlassian or Canva, or enter a custom Streamable HTTP endpoint. The preset fills connection details; it does not connect an account or grant employees access.

Account sign-in needs MCP_CREDENTIAL_KEY: a random 32-byte base64 installation key supplied to the console and worker, outside the repository. MCP_OAUTH_REDIRECT_URL identifies the local console callback, normally http://localhost:3000/api/integrations/mcp/callback. The callback is local; keep the operator console private.

Canva custom clients need redirect-URI allowlisting before users can authorize the design connector. Figma requires a client listed in its MCP Catalog; a new client needs provider approval. Configure those provider prerequisites first. Neither service is connected by installing Nucovo. Read the MCP Connectors setup notes.

Where to go next

8 · Prepare a service workflow

Open Company → Service playbooks and choose Website launch, Marketing campaign or Research report. Write the project brief, edit the suggested criteria and explicitly accept them. This creates draft tasks with owners, independent reviewers, delivery formats and dependencies.

A mixed project gives each task a concrete repository or document format. Document tasks need no checkout. Scripted checks belong to repository tasks. Large, missing or changed handoff files stop the transfer instead of being silently shortened.

After an agreement change, map the current criteria to the existing playbook steps and explicitly accept the revised plan. This preserves history and valid assignments, then returns steps to draft, including previously completed steps. Active work and reviews must settle first. Start the revised drafts separately; old evidence does not automatically satisfy a new agreement.

9 · Keep brand guidance and campaign decisions clear

Record outcome measurements from a real HTTPS source or project artifact, including the value, unit and period. These are operator-reported entries, not independently verified analytics. Void a mistake with a reason and enter its correction; historical values remain visible. Document attachments are checked against their recorded checksum when approved in the console. Other source metadata does not independently establish file integrity or publication.

10 · Inspect the release handoff

Open Project → Release handoff to review the current agreement, its accepted criteria and local verification of accepted document or commit pins. Missing, changed or unchecked sources remain visible; download the snapshot as Markdown when you need to hand it to another person.

Compare the accepted references with recorded deployment targets and their last HTTP health observations. A recorded source match is not proof of the version currently served. Earlier accepted pins are recovery references that still need availability, backup and compatibility checks. The handoff performs no deployment or rollback and does not run a new HTTP check.

11 · Add skills your team can reuse

As the operator, open Company → Skills. Browse the Marketplace, search public GitHub sources, or add a public GitHub repository, folder or file URL. Direct public HTTPS addresses ending in /SKILL.md are also supported. Private authenticated sources are not supported by this importer.

Installation policy defaults to Off, which requires approval. Trusted sources permits compatible versions only from enabled sources an operator explicitly trusts. Automatic installation also requires skill.install permission. Public discovery queries are fixed by the server for the operator-selected capability, so task, company, client and secret text cannot enter the GitHub or Brave request.

The Marketplace shares public source listings across companies within this installation. Imported snapshots, assignments and history belong to their company. Importing never publishes a listing; sharing public metadata is a separate operator action. Explore Skills, supported sources and controls.

12 · Work with teammates and routines

Open Company → Teammates and create a direct conversation with one employee or a group with two to six. Choose the project and coordinator, then send a prompt. The prompt and its ready task are saved together, with an active participant as owner, a different active reviewer and the project’s current contract.

Open Company → Routines to add a schedule or event trigger. Start the worker for due schedules and new events to be processed. Routines create ordinary governed tasks and do not grant models, skills, MCP tools or publication authority. Explore teammate conversations and routines.

See it refuse bad work

The demo is two acts against a real database, a real git repository and the real container. In the first, a model implements a function and QA’s scripted check passes. In the second, a defect is injected and committed as real evidence with the claim that everything works — the same check runs, fails, and the task does not complete.

It uses the company selected by COMPANY_ID in .env and needs model access and the runner image. Its temporary repository and artifact directories are removed afterwards.

Running the tests

Keep PostgreSQL running. Database tests use a separate agicos_testdatabase created on demand. Use one worker on a smaller machine; if memory remains tight, run suites in sequential batches. Do not start simultaneous test runs against that shared test database: they reset the same fixtures. See the repository’s contributor instructions for the current checks.