# obop

> obop is an open-source business platform: CRM, sales, invoicing and more on one data model, with AI agents that propose and humans who approve, and a marketplace of modules. Open source, written in Rust, runs on SQLite or PostgreSQL. Status: beta; see the roadmap for what is built.

Each link below is the Markdown version of a page. Every page of the site also exists as Markdown at its address with .md instead of the trailing slash. Prices on the site are planned and not charged yet.

## When to use obop

Reach for obop when the job is running a small or mid-sized business on one shared database: contacts, leads and quotes, sales orders, invoices, stock, purchasing, HR, projects, support tickets, a web shop. It fits when you want an AI agent to read and draft business records safely: an agent works under a scoped token, sees personal and financial fields masked, and can only propose irreversible steps (post an invoice, pay an expense, delete a record) for a human to approve.

How an agent should call obop:

- Use the instance REST API (`POST /api/<model>/<command>`, with `list`, `search`, `get`, `create`, `update`, `delete` and per-model actions), described by the OpenAPI document at `/api/openapi.json` on the instance, or connect over MCP with `obop mcp --token <agent token>`.
- Ask `GET /api/meta` first: it lists exactly the models, fields and actions your token may use.
- Treat a 202 `approval_required` response as a proposal: stop and ask the human to approve the plan.
- The control plane API (sign up, create and delete instances) is described at `/openapi.json` on this site.

Do not use obop for payments processing, payroll filing, or workloads that need row-level permissions or computed fields: see the roadmap for what is built.

## Documentation

- [Documentation](https://obop.dev/docs.md): Documentation for obop: get started, learn the concepts, set up AI agents over MCP, REST and the CLI, and look up the reference.
- [Getting started](https://obop.dev/docs/getting-started.md): Get your first obop instance: sign up for the hosted beta, self-host with Docker and PostgreSQL, or run it locally with SQLite. Then install an app, create records and invite an agent.

## Concepts

- [Concepts](https://obop.dev/docs/concepts.md): The building blocks of obop: apps and modules, instances, data classes and masking, permission groups, workflows and approvals.
- [Apps and modules](https://obop.dev/docs/concepts/apps-and-modules.md): In obop an app is a module: a file that declares models, fields, data classes, permission groups and workflow actions. The API, agent tools and screens are generated from it.
- [Instances](https://obop.dev/docs/concepts/instances.md): An obop instance is one business: its own database, its own users and its own address. How the control plane creates instances and how self-hosting compares.
- [Data classes and masking](https://obop.dev/docs/concepts/data-classes-and-masking.md): Every obop field has a data class. Agents see personal data as stable placeholder tokens and sensitive classes not at all, and can write tokens back without seeing the real value.
- [Permission groups](https://obop.dev/docs/concepts/permission-groups.md): Permission groups in obop are names like crm.user and invoicing.manager. Models, fields and actions each name the group that may use them, and agent tokens can only narrow their owner's groups.
- [Two-factor authentication](https://obop.dev/docs/concepts/two-factor-authentication.md): How two-factor sign-in works in obop: a 6-digit code from an authenticator app, recovery codes, the policy that requires it for administrators, the break-glass reset and what it does not cover.
- [Workflows and approvals](https://obop.dev/docs/concepts/workflows-and-approvals.md): State changes in obop are named actions such as qualify or post. Irreversible actions need approval: an agent only proposes them, and a person with the right group approves.
- [Connectors and compliant data flows](https://obop.dev/docs/concepts/connectors.md): How obop connects other systems and lets people connect their own accounts: a recorded legal basis, a field allowlist, pseudonyms by default, withdrawable consent, a log without payloads and a generated processing register. Technical controls that support GDPR compliance, not legal advice.

## Agents: set up AI agents to work with obop

- [Agents](https://obop.dev/docs/agents.md): How to set up AI agents to work with obop: the agent model, scoped tokens, masked personal data, and approvals that keep a person in charge of anything irreversible.
- [Create an agent token](https://obop.dev/docs/agents/tokens.md): Create a scoped obop agent token over REST (POST /api/auth/agent-token) or with the CLI (obop agent-token). The token is shown once and can only narrow its owner's permission groups.
- [Connect over MCP](https://obop.dev/docs/agents/mcp.md): Connect Claude Code, Cursor, VS Code, Windsurf, Codex or Gemini CLI to an obop instance by URL with the remote MCP server (Streamable HTTP, bearer token), or run obop mcp over stdio. Exact configuration per client.
- [Use the REST API](https://obop.dev/docs/agents/rest.md): Call obop's REST API as an agent with curl: list, search, create and update records, run workflow actions, see masked data and handle approval plans. Examples run against a real local instance.
- [Use the CLI](https://obop.dev/docs/agents/cli.md): Use the obop command line as an agent: obop commands lists what a token may do, obop call runs a command with key=value arguments, and approvals are reported without running.
- [The approval loop](https://obop.dev/docs/agents/approvals.md): How obop keeps a person in charge: an agent proposes an irreversible step, the server returns a plan id and changes nothing, and a person approves it. Examples over REST and MCP.
- [Masking tokens](https://obop.dev/docs/agents/masking.md): How an obop agent reads personal data as placeholder tokens such as EMAIL_1 and passes them back to refer to a value it never sees. Stability, limits and what to tell the agent.
- [Safety best practices](https://obop.dev/docs/agents/safety.md): Practical rules for running AI agents against obop: least privilege, one token per task, keeping tokens secret, reviewing approvals, and what to do when a token leaks.
- [Example workflows](https://obop.dev/docs/agents/workflows.md): Example prompts and agent workflows for obop: triage new helpdesk tickets, draft quotations, prepare invoices for approval, and keep a CRM pipeline tidy, each with the token scopes it needs.
- [Troubleshooting](https://obop.dev/docs/agents/troubleshooting.md): Fix common problems when connecting agents to obop: MCP client shows no tools, 401 and 404 answers, invalid token, unknown field on filters, approval required, and database path mistakes.

## Reference

- [CLI reference](https://obop.dev/docs/reference/cli.md): Every obop command line command and option: serve, platform serve, mcp, call, commands, admin create, agent-token, modules check, install, uninstall and market.
- [REST API reference](https://obop.dev/docs/reference/rest-api.md): obop's REST API: sign in, agent tokens, commands, meta, the generated get, list, search, create, update and delete endpoints, workflow actions, approvals, filters, errors and status codes.
- [Module manifest reference](https://obop.dev/docs/reference/module-manifest.md): How to write an obop module: the obop.toml format for models, fields, data classes, permission groups and workflow actions, with a tutorial, validation errors, limits and publishing.
- [Environment variables](https://obop.dev/docs/reference/environment.md): The environment variables obop reads: database URL, agent token, marketplace URL, and the settings of the control plane and Sliplane provisioner.
- [Self-hosting and operations](https://obop.dev/docs/reference/self-hosting.md): Run obop yourself: Docker image, PostgreSQL, the control plane, Sliplane deployment, serving this website, and what is missing: backups, migrations, upgrades and monitoring.
- [Security and privacy](https://obop.dev/docs/reference/security.md): How obop protects data today: Argon2id passwords, hashed tokens, data classes, masking for agents, approvals, one database per business, and the limits and gaps stated plainly.
- [FAQ](https://obop.dev/docs/reference/faq.md): Frequently asked questions about obop: status, licence, pricing, data, agents and MCP, apps, hosting, languages and how it compares.

## Product

- [Platform](https://obop.dev/platform.md): How the obop platform works: instances with one database per business, modules and the marketplace, permission groups, data classes and masking, approvals, and the MCP, REST and CLI surfaces.
- [Marketplace](https://obop.dev/marketplace.md): The obop marketplace: 22 bundled packages you can install in a click, and how to publish your own catalog as a static host with an index.json file and obop.toml packages.
- [Pricing](https://obop.dev/pricing.md): Planned obop pricing: Free, Team (€49), Growth (€249) and Scale (from €899) per organisation per month. Planned only, nothing is charged during the beta. Self-hosting is free.
- [Apps](https://obop.dev/apps.md): All 28 obop apps: 6 built in (CRM, Sales, Invoicing, Products, Contacts, Connectors) and 22 installable from the marketplace. Each page lists models, fields, data classes, workflows and what agents can do.
- [Roadmap](https://obop.dev/roadmap.md): An honest roadmap for obop: what is built today, what is partly built, what is not built, and the planned waves from the product plan, with the decisions that are still open.
- [Changelog](https://obop.dev/changelog.md): What changed in obop, newest first, generated from the project's commit history.

## Apps

- [CRM](https://obop.dev/apps/crm.md): Leads and pipeline. Keep track of prospective deals from first contact to won or lost.
- [Sales](https://obop.dev/apps/sales.md): Quotations and orders. Write quotations for customers and turn them into confirmed orders.
- [Invoicing](https://obop.dev/apps/invoicing.md): Drafts, posting, numbering. Prepare customer invoices as drafts and post them to give each one its gapless legal number.
- [Products](https://obop.dev/apps/products.md): Prices, SKUs, cost. The catalogue of what you sell: name, SKU, list price and unit cost.
- [Contacts](https://obop.dev/apps/contacts.md): People and companies. One record for every person and organisation you deal with, shared by all other apps.
- [Connectors](https://obop.dev/apps/connectors.md): Connect systems, with GDPR controls. Connect other systems to the instance and let people connect their own accounts, with the controls that support GDPR compliance built in.
- [Project](https://obop.dev/apps/projects.md): Projects and tasks. Plan work as projects, milestones and tasks with assignees and deadlines.
- [Helpdesk](https://obop.dev/apps/helpdesk.md): Support tickets. Receive and work through customer support requests with priority, severity and service-level targets.
- [Fleet](https://obop.dev/apps/fleet.md): Vehicles and drivers. Keep a register of company vehicles, who drives them and their service history.
- [Inventory](https://obop.dev/apps/inventory.md): Stock and warehouses. Describe warehouses and locations, record stock levels and log stock moves.
- [Purchase](https://obop.dev/apps/purchase.md): Vendors and purchase orders. Keep vendors and the purchase orders you send them, with order lines and a draft to received flow.
- [Manufacturing](https://obop.dev/apps/manufacturing.md): Bills of materials. Define what a product is made of and plan manufacturing orders through draft, confirmed, in progress and done.
- [HR](https://obop.dev/apps/hr.md): Employees and leave. A register of employees, departments and leave requests, with strict data classes: pay, bank details and national id are visible to managers only and health or union data only to a special reader group.
- [Timesheets](https://obop.dev/apps/timesheets.md): Time and billing. Record time spent on project tasks in minutes, mark it billable and run it through an approval step.
- [Planning](https://obop.dev/apps/planning.md): Shifts and resources. Plan shifts for employees from reusable templates.
- [Field Service](https://obop.dev/apps/field-service.md): Jobs on site. Schedule on-site jobs for customers: who does the work, where, when, which parts were used and whether the customer must sign off.
- [Point of Sale](https://obop.dev/apps/pos.md): Retail and restaurants. Model a shop till: configuration, cash-controlled sessions, orders with lines and payment lines per method.
- [eCommerce](https://obop.dev/apps/ecommerce.md): Online store. Store the data of an online shop: listings, shipping methods, discount codes and web orders with a fulfilment flow.
- [Website](https://obop.dev/apps/website.md): Pages and forms. Hold the content of a public website: pages, menus, blog posts and the form submissions visitors send.
- [Email Marketing](https://obop.dev/apps/email-marketing.md): Campaigns. Keep mailing lists with each contact's consent status and date, and prepare campaigns.
- [Documents](https://obop.dev/apps/documents.md): Files and folders. A register of business documents with folder, kind, owner, expiry and confidentiality.
- [Sign](https://obop.dev/apps/sign.md): E-signatures. Manage templates and signature requests through draft, sent, signed, declined and expired, and record the document hash that was signed.
- [Subscriptions](https://obop.dev/apps/subscriptions.md): Recurring billing. Define recurring plans and track customer subscriptions with trial, active, past due and cancelled states, including the next invoice date.
- [Dashboards](https://obop.dev/apps/dashboards.md): Reports and charts. Store dashboards and widgets as data (KPI, bar, line, pie and table definitions) for a client to render.
- [Accounting](https://obop.dev/apps/accounting.md): Ledger and reports. A chart of accounts, journals, tax rates, journal entries with debit and credit lines, fiscal periods and bank statement lines.
- [Knowledge](https://obop.dev/apps/knowledge.md): Articles and guides. A wiki of articles arranged in a tree, with draft, published and archived states and tags.
- [Appointments](https://obop.dev/apps/appointments.md): Bookable resources. Describe bookable people, rooms and equipment and record appointments with a date, start and end.
- [Expenses](https://obop.dev/apps/expenses.md): Claims and approvals. Employees file expense claims that move through draft, submitted, approved and paid.

## Company and trust

- [About](https://obop.dev/about.md): About obop: an open-source business platform built by SpaceCorps for people and AI agents, with privacy, permissions and open hosting as the starting point.
- [Security](https://obop.dev/security.md): Security at obop: how to report a vulnerability, what we do with a report, and a summary of the protections that exist today and the gaps that remain.
- [Privacy](https://obop.dev/privacy.md): Draft privacy notice for the obop website and hosted beta: what is collected, why, how long, and your rights. A draft for review by counsel, not legal advice.
- [Terms](https://obop.dev/terms.md): Draft terms for using the hosted obop beta and this website. A draft for review by counsel, not legal advice, to be replaced before any paid plan starts.
- [Contact](https://obop.dev/contact.md): How to contact the obop project: GitHub issues for bugs and ideas, private security advisories for vulnerabilities, and the community forum for questions.
- [Brand](https://obop.dev/brand.md): The obop brand in brief: name, logo with downloads, colour, typography, voice and accessibility. A public summary of the brand book.
- [Community](https://obop.dev/about/community.md): The obop community: where to ask questions and share ideas in the community forum, the ground rules, and how to contribute.
- [Status](https://obop.dev/about/status.md): Service status for the hosted obop beta: where to see whether the control plane and instances are up, and what the status page does and does not promise.

## Optional

- [Deutsch](https://obop.dev/de/index.md): the site in Deutsch
- [Français](https://obop.dev/fr/index.md): the site in Français
- [Polski](https://obop.dev/pl/index.md): the site in Polski
- [Suomi](https://obop.dev/fi/index.md): the site in Suomi
- [Svenska](https://obop.dev/sv/index.md): the site in Svenska
- [Español](https://obop.dev/es/index.md): the site in Español
- [Source code](https://github.com/SpaceCorps/obop): the repository
- [Full documentation in one file](https://obop.dev/llms-full.txt): the text of every English page