Questions, answered plainly.

The software is MIT licensed and every feature is in it. Nothing is held back for a paid tier. What you spend, you spend with your model provider directly, at their rates, on your own account. Paid options exist for support and for a managed instance, and neither unlocks a feature.

Whatever your models cost, and nothing else. Idle employees are database rows rather than processes, so a company that is not working costs nothing at all — the cost driver is wake-ups, not headcount. If you point it at a coding subscription you already pay for, it spends that instead of money.

No. You can drive a CLI agent you already subscribe to — Claude Code, Codex or the Gemini CLI today. That consumption is recorded as quota with no monetary amount, because a subscription produces no invoice line to reconcile against.

No, and not as a matter of policy. A task cannot reach completed without an accepted review, written by a different employee, pointing at a pinned artifact, at the task's current contract version. It is a database trigger, so it does not care who is asking. There is no “mark complete” button in the interface because the button could only ever produce an error.

Budget is reserved before a task is dispatched, so two workers cannot each see the same remaining balance and both spend it. Ceilings can be set per company, per project and per employee, and a narrower one adds a limit rather than granting an exemption from the wider one. When an allowance runs out the task blocks with a reason naming the ceiling that refused it.

Only to the model provider you configured, in the requests you cause. There is no telemetry, no analytics on your instance and no hosted control plane. The application runs on your machine against your database.

A framework gives you a loop and trusts what comes out of it. This gives you a company: employees with managers and permissions, work with versioned acceptance criteria, and a database that refuses to record work as finished without independent evidence. The interesting part is not what it can do — it is what it will not let itself claim.

Yes. MIT permits commercial use, modification and redistribution. You are responsible for your own compliance with the terms of whichever model providers you configure.

For real use, yes — the runner is what isolates agent code. There is a local mode so a first run does not require it, but it executes commands on your machine with your privileges and no sandbox, and it says so loudly.

Not yet, and the reason is worth knowing because it is a design position rather than a gap in the backlog. The CLI agents it drives each support MCP, but agi-cos runs them with no tools granted at all — it uses them to get a structured proposal back, not to run an agent session, and every file change is applied afterwards by code we control. An MCP tool that could act directly would route around exactly that. When MCP does land it will be as permissioned connections whose calls come back as proposals like everything else, because a model gaining the ability to act without a check is the one thing this architecture is built to prevent.

Only through something you have granted and that code validates. An employee asks to run a command and deterministic code decides: programs are limited, git is read-only, paths are re-resolved against the worktree, and the runner has no network at all. Anything without a matching grant raises an approval request bound to a hash of the exact command, so approving one thing is not approving something adjacent to it.

Any the provider serves. The model field is free text rather than a dropdown, so something released this morning works this morning. A model with no published rate still runs — its usage is recorded as pending with the tokens kept, for whoever holds the invoice.