$git clone https://github.com/decocms/studio> TL;DR: Your team needs a secure internal vibecoding platform. You just found it. Configure agents with team context. Connect private MCPs once — share capabilities, not credentials. Keep the model layer interchangeable. Roll out across the organization with SSO, RBAC, audit
| 1 | <h1 align="center">deco Studio</h1> |
| 2 | |
| 3 | <p align="center"> |
| 4 | <em>Open-source · TypeScript-first · Deploy anywhere</em><br/><br/> |
| 5 | <b>Open-source private AI workspace for organizations.</b> |
| 6 | </p> |
| 7 | |
| 8 | <p align="center"> |
| 9 | <a href="https://docs.decocms.com/">Docs</a> · |
| 10 | <a href="https://decocms.com/discord">Discord</a> · |
| 11 | <a href="https://decocms.com/studio">decocms.com/studio</a> |
| 12 | </p> |
| 13 | |
| 14 | > **TL;DR:** Your team needs a secure internal vibecoding platform. You just found it. Configure agents with team context. Connect private MCPs once — share capabilities, not credentials. Keep the model layer interchangeable. Roll out across the organization with SSO, RBAC, audit logs, and cost controls — all through one MCP endpoint. Local-first. Self-host or use the cloud. |
| 15 | |
| 16 | --- |
| 17 | |
| 18 | ## What is deco Studio? |
| 19 | |
| 20 | Studio packages the infrastructure behind an internal AI rollout: model routing, MCP authentication, agent configuration, SSO, RBAC, audit logs, and usage accounting. Your teams get chat. You keep control. |
| 21 | |
| 22 | Under the hood it's one control plane for your AI agents — one MCP endpoint for all your agents, tools, and models. Agents package context, tools, and policy into something you publish to the organization. Connections give them governed access to your systems — GitHub, Slack, Postgres, Sentry, anything that speaks MCP — with tokens stored in an encrypted vault. Models stay interchangeable: OpenRouter or direct providers, chosen per agent and per tool. |
| 23 | |
| 24 | Start with one team. Standardize approved models, tools, and context. Expand across the organization without copying secrets or rebuilding the platform. Install locally and it stays private; sync to the cloud for remote access, team roles, and shared billing. |
| 25 | |
| 26 | ``` |
| 27 | ┌─────────────────────────────────────────────────────────────────┐ |
| 28 | │ Clients │ |
| 29 | │ Cursor · Claude · VS Code · Custom Agents │ |
| 30 | └───────────────────────────┬─────────────────────────────────────┘ |
| 31 | │ |
| 32 | ▼ |
| 33 | ┌─────────────────────────────────────────────────────────────────┐ |
| 34 | │ DECO STUDIO │ |
| 35 | │ Agents · Connections · Models · Vault · Observability │ |
| 36 | └───────────────────────────┬─────────────────────────────────────┘ |
| 37 | │ |
| 38 | ▼ |
| 39 | ┌─────────────────────────────────────────────────────────────────┐ |
| 40 | │ Tools & MCP Servers │ |
| 41 | │ GitHub · Slack · Postgres · OpenRouter · Your APIs │ |
| 42 | └─────────────────────────────────────────────────────────────────┘ |
| 43 | ``` |
| 44 | |
| 45 | --- |
| 46 | |
| 47 | ## Quick Start |
| 48 | |
| 49 | ```bash |
| 50 | bunx decostudio |
| 51 | ``` |
| 52 | |
| 53 | Or clone and run from source: |
| 54 | |
| 55 | ```bash |
| 56 | git clone https://github.com/decocms/studio.git |
| 57 | bun install |
| 58 | bun run dev |
| 59 | ``` |
| 60 | |
| 61 | > runs at [http://localhost:4000](http://localhost:4000) (client) with API routes proxied to the Bun server |
| 62 | |
| 63 | --- |
| 64 | |
| 65 | ## What you get |
| 66 | |
| 67 | ### Agents |
| 68 | |
| 69 | Package context, tools, and policy into an agent. Define instructions, add skills and files, grant approved MCP access, choose a model policy, then publish the agent to the organization. Each agent is its own MCP endpoint — callable from Cursor, Claude Desktop, your own code, or another agent. Agents compose, and every action is tracked with cost attribution. |
| 70 | |
| 71 | ### Connections |
| 72 | |
| 73 | Connect private systems once, securely. Register MCP servers at the organization level through a web UI with one-click OAuth — no JSON configs. Tokens live in the encrypted vault, and you grant tool-level access by organization, role, or agent. Share MCP capabilities — not credentials. |
| 74 | |
| 75 | As tool surfaces grow, Studio exposes **Virtual MCPs** — one endpoint, different strategies for which tools to surface: |
| 76 | |
| 77 | - **Full-context:** expose everything (simple, deterministic, good for small toolsets) |
| 78 | - **Smart selection:** narrow the toolset before execution |
| 79 | - **Code execution:** load tools on demand in a sandbox |
| 80 | |
| 81 | ### Models |
| 82 | |
| 83 | Keep the AI layer interchangeable. |