Open core, sovereign by default — fork everything but the liability.
The whole stack is open source: the local LLM core, retrieval, the governance layer, and the transports. One component is closed on purpose — Cloud Shield, the compliance umbrella that carries certification and the audit trail. Read the code, run the stack, and probe the trust boundary yourself.
Everything is open source — except one component
We draw the line where it is honest to draw it, and we name exactly which side every part lands on. The four blocks below are open under Apache-2.0; the single closed thing is Cloud Shield, because someone has to stand behind the compliance liability.
The local AI core
The locally-hosted LLM runtime and the agent that serves every knowledge base. One brain, many bases — running on your metal or an EU region you choose.
Retrieval & knowledge bases
Ingestion, chunking, embedding and retrieval over your own corpus. Default-private bases with sensitivity labels — the machinery, in the open, for you to read and tune.
The governance layer
The projection engine and the correction loop: how an internal superset becomes a governed public agent, and how human answers flow back into the base. The valuable part — open.
Transports & connection artifact
REST+OpenAPI and MCP server implementations, plus the droppable connection file that pairs an assistant to an instance. Wire it into anything.
Cloud Shield
The one closed component: Cloud Shield is a compliance umbrella that holds the live regulatory posture, the audit trail, and certification under DSGVO and the EU AI Act. It is a service we operate and insure, not a black box in your data path — your knowledge and inference stay local even when Cloud Shield is attached.
Open (Apache-2.0): the LLM core, retrieval, the governance layer, the transports, and the safety-adapter contract.
Closed (this card only): Cloud Shield. Nothing else.
- Live regulatory posture
- Tamper-evident audit trail
- Certification support
Run the Community tier entirely without it. Cloud Shield is what the Professional and Enterprise tiers add — the part no solo operator wants to build, run, or self-insure.
The trust boundary, stated for engineers
One rule governs the whole system, and it only points one way: the internal knowledge base is the superset; the public customer agent is a governed projection of it — never the reverse.
- Default-private. Every base starts closed. Nothing is public until a sensitivity label and a per-base policy explicitly allow it. Absence of a rule means deny.
- Projection, not replication. The public agent reads a filtered view, derived at query time from policy. It holds no standing copy of the internal corpus, so it cannot leak what it never had.
- One-way by construction. A customer-facing answer can never write back into the private superset on its own. The correction loop runs the other way — through human review.
public_view ⊆ internal_base # projection is one-way project(internal, policy) → public ∄ f : public → internal # no back-channel # default-private visible(chunk) ⟺ policy.allows(chunk.label) default = deny
Self-host it, fork it, audit it — for free
The full open-source core, no Cloud Shield, community support. The honest free path: everything you need to run a governed, sovereign AI core on your own hardware.
No telemetry by default
The core does not phone home. What leaves your network is something you configured on purpose — and can read in the open.
Local weights, local inference
The LLM runs on hardware you control. Prompts and knowledge never traverse a third-party model API.
Reproducible deploys
Container images and compose definitions you can pin, rebuild and diff. No mystery binaries in the data path.
Auditable retrieval
Trace every answer to the chunks and sources it was grounded in. The projection policy is code you can read, not a black box.
Community is free and self-hosted. Cloud Shield, a managed appliance and consultant onboarding live in the paid tiers.
Self-host in three commands
No engineer required to read this — clone, copy the example env, and bring the stack up with docker compose. The Community tier runs with local weights and local inference, no Cloud Shield.
- Open-source core. Everything below is Apache-2.0-licensed. Fork it, pin it, rebuild it.
- One brain, many bases. A single local LLM serves every knowledge base on the instance.
- Then connect. Point a REST+OpenAPI or MCP client at the instance with one connection artifact.
# 1 · clone the open-source core (Apache-2.0)
git clone https://github.com/wegenty/core.git wegenty
cd wegenty
# 2 · copy the example config — no secrets baked in
cp .env.example .env
# 3 · bring the stack up (LLM runtime + agent + retrieval)
docker compose up -d
# → console: http://localhost:8080
# → widget: http://localhost:8080/widget
# local weights · local inference · no Cloud ShieldTwo transports, one droppable connection artifact
Pair an assistant to an instance over the wire you prefer. The connection is a single file you drop in — no bespoke glue code.
REST + OpenAPI
A documented HTTP API with an OpenAPI spec. Generate a typed client in any language, or call it from whatever already runs in your stack.
MCP
A Model Context Protocol server, so MCP-aware agents and IDEs can talk to an instance natively — the governed agent as a first-class tool.
One droppable file
A single artifact pairs an assistant to an instance over REST+OpenAPI or MCP. Drop it in to connect — hand it off, version it, revoke it.
What a connection artifact looks like
A small, signed JSON document — JWT-shaped, with a header, scoped claims, and a signature. It names the instance, the transport, and the exact bases and scopes it may reach. Secrets are redacted below; the real token is the one you revoke. Absence of a scope means deny.
audthe instance it pairs totransportrest+openapi or mcpscopesleast-privilege, per-baseexp · jtiexpiry and a revocable id
{
"alg": "EdDSA",
"typ": "JWT",
"kid": "wg-2026-06",
"iss": "https://acme.wegenty.local",
"aud": "wegenty:instance:acme-support",
"transport": "rest+openapi", // or "mcp"
"assistant": "public-customer-agent",
"scopes": [
"base:handbook:read", // projected, public view
"base:pricing:read" // — never the internal superset
],
"exp": 1782000000,
"jti": "cna_3f9…b21", // revoke by id
"sig": "<redacted — signed, single-use on pairing>"
}The safety-adapter SDK: caged capability
Third-party tools are powerful and dangerous. Safety adapters cage them: declared permissions, no knowledge-base access by default, and controlled egress. An adapter can only do what it has explicitly declared — and nothing touches your corpus unless you grant it.
The SDK and its contract are open (Apache-2.0) and ship in a later roadmap phase; a gated marketplace comes after that. Track the milestone before you build against it.
No open-washing
“Open” has been stretched until it means nothing. We refuse the usual tricks: no source-available license dressed up as open; no crippled core that only works once you buy the “real” edition; no telemetry you cannot switch off.
The core is genuinely open
A real OSI-approved license — Apache-2.0 — on the parts that matter: the LLM core, retrieval, governance and transports. Fork it, run it in production, never call us.
One closed thing, named plainly
Cloud Shield is the only closed component, and we say so on every page. It is a compliance service we insure — not a paywall around basic function.
No hidden phone-home
The core ships without telemetry. Anything that leaves your network is something you turned on, and you can read exactly what it sends.
Sovereignty is the default, not the upsell
Local weights and local inference are the baseline of the free tier — not a feature reserved for the enterprise SKU.
Open vs. closed — the questions developers ask
What exactly is open, and what is the one closed component?
Everything that makes Wegenty work is open source under Apache-2.0: the locally-hosted LLM core, retrieval and knowledge bases, the governance layer (the projection engine and correction loop), the REST+OpenAPI and MCP transports, and the safety-adapter contract. The single closed component is Cloud Shield — a compliance service we operate and insure, carrying the live regulatory posture, the audit trail, and certification under DSGVO and the EU AI Act. It is not a black box in your data path: your knowledge and inference stay local even when Cloud Shield is attached.
Can I self-host the whole thing for free?
Yes. The Community tier is the full open-source core with no Cloud Shield, on hardware you control. Clone the repository, copy .env.example to .env, and run "docker compose up -d" — the LLM runtime, agent and retrieval come up together with local weights and local inference. The console is on http://localhost:8080 and the public widget on /widget. You can run it in production and never call us.
Which license is it, and can I fork it commercially?
The core is licensed Apache-2.0, an OSI-approved permissive license. You can fork it, modify it, run it in production and build on top of it commercially — the only thing you cannot fork is the liability: Cloud Shield, the closed compliance umbrella we stand behind. That is the meaning of "fork everything but the liability."
Where is the security boundary between the public agent and my private corpus?
The internal knowledge base is the superset; the public customer agent is a governed projection of it, never the reverse. The public agent reads a filtered, query-time view derived from policy and holds no standing copy of the internal corpus, so it cannot leak what it never had. Every base is default-private — absence of a rule means deny — and customer-facing answers can never write back into the private superset on their own; the correction loop runs the other way, through human review.
How does an external client connect, and how do I revoke access?
A connection artifact — a small, signed, JWT-shaped JSON document — pairs an assistant to an instance over REST+OpenAPI or MCP. It carries the audience (instance), transport, least-privilege per-base scopes, an expiry, and a revocable id (jti). Drop it in to connect; revoke by id to cut it off. Scopes are read-only against the projected public view, never the internal superset.
Read the code. Run the stack. Probe the boundary.
The Community tier is free, Apache-2.0-licensed and self-hostable today. Clone it, audit the trust boundary, and see a governed projection answer for yourself — fork everything but the liability.