Self-hosted AI workspace.
Find a file
Amir Fathi 9d5c031914
Some checks failed
CI / Focused test guidance (report-only) (push) Has been cancelled
CI / Python syntax (compileall) (push) Has been cancelled
CI / JS syntax (node --check) (push) Has been cancelled
CI / Python tests (pytest) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
CodeQL / Analyze (python) (push) Has been cancelled
ci / docker publish / build (amd64) (push) Has been cancelled
ci / docker publish / build (arm64) (push) Has been cancelled
ci / docker publish / merge manifest + tag (push) Has been cancelled
fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215)
* fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to []

* test(mcp): pass every Form param add_server reads past args validation

CI's pytest run showed test_add_server_still_accepts_valid_json_args and
test_add_server_still_defaults_empty_args_to_empty_list failing with
TypeError: the JSON object must be str, bytes or bytearray, not Form.

Calling the endpoint function directly bypasses FastAPI's dependency
resolution, so an unpassed Form(...) parameter (url, oauth_file,
oauth_config) arrives as the Form marker object itself rather than its
declared default, and add_server's later `if oauth_file:` check reads
that marker as truthy. The malformed-args test never hit this because it
raises before reaching that code. Not a production bug: a real HTTP
request resolves these through FastAPI before add_server ever runs.

* fix(mcp): reject non-list args and surface the new 400 in the Admin panel

o3LL's review on #6215 found two gaps in the args validation this PR adds:
the Admin panel posts to the same /api/mcp/servers endpoint but never
validates Args client-side, so the new 400 falls into the generic failure
branch and shows "Added but connection failed: unknown". Mirror the same
JSON.parse guard settings.js already has.

Also add an isinstance(list) check next to the existing JSON parse, since
valid-but-wrong-shaped JSON (args=5) reaches StdioServerParameters(args=5)
and 500s in the error formatter. Pre-existing on dev, same validation site
this PR already touches.

* fix(admin): surface the server's 400 detail instead of a generic connection-failed message

The Admin add-server handler read needs_oauth/connected/error but never
res.ok, so a request rejected by the isinstance(list) check added for
#6211 (args=5, a valid-JSON-but-non-list value the client-side JSON.parse
guard cannot catch) fell into the same-shape else branch as a successful
add whose connection attempt failed, and the form fields were cleared as
if the server had accepted it.
2026-09-11 15:36:41 +02:00
.github refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
assets/branding refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
companion fix(companion): honor configured pairing address (#6060) 2026-08-15 21:11:10 +02:00
config/searxng Generate SearXNG secret on first boot 2026-06-01 11:03:02 +09:00
core Merge commit from fork 2026-09-05 19:20:49 +02:00
docker fix(docker): repair app cache parent ownership (#6158) 2026-09-05 18:05:38 +02:00
integrations Add Codex and Claude document draft integration 2026-06-09 14:27:53 +09:00
licenses perf(static): vendor KaTeX and Mermaid, and load them on first use (#5994) 2026-08-16 22:43:12 +01:00
mcp_servers refactor(model-routing): centralize explicit foreground fallback policy (#6020) 2026-08-14 08:10:30 +01:00
routes fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215) 2026-09-11 15:36:41 +02:00
scripts refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
services fix(docs): map live VectorRAG result shapes (#5960) 2026-08-17 00:07:12 +01:00
specs docs: bootstrap specs ground truth (#5794) 2026-08-25 14:18:44 +02:00
src Merge commit from fork 2026-09-05 19:21:12 +02:00
static fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215) 2026-09-11 15:36:41 +02:00
swift/odysseus-mlx-image-bridge Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00
tests fix(mcp): reject malformed Args on Add MCP Server instead of silently defaulting to [] (#6215) 2026-09-11 15:36:41 +02:00
website refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
.dockerignore refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
.env.example fix(auth): derive the session cookie Secure flag from the request scheme (#6048) 2026-08-16 22:56:36 +01:00
.gitattributes perf(static): vendor KaTeX and Mermaid, and load them on first use (#5994) 2026-08-16 22:43:12 +01:00
.gitignore refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
ACKNOWLEDGMENTS.md perf(static): vendor KaTeX and Mermaid, and load them on first use (#5994) 2026-08-16 22:43:12 +01:00
app.py Merge pull request #6081 from ydonghao/refactor/routes-task-to-subdir 2026-08-16 22:29:43 -06:00
build-macos-app.sh refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
build-windows-portable.ps1 feat(launcher): add portable windows launcher (#976) 2026-06-16 04:58:16 +01:00
CONTRIBUTING.md chore: update repository URLs after organization transfer (#5622) 2026-07-20 16:43:47 +02:00
docker-compose.gpu-amd.yml fix(auth): derive the session cookie Secure flag from the request scheme (#6048) 2026-08-16 22:56:36 +01:00
docker-compose.gpu-nvidia.yml fix(auth): derive the session cookie Secure flag from the request scheme (#6048) 2026-08-16 22:56:36 +01:00
docker-compose.yml fix(auth): derive the session cookie Secure flag from the request scheme (#6048) 2026-08-16 22:56:36 +01:00
Dockerfile Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00
install-service.sh Odysseus v1.0 2026-05-31 23:58:26 +09:00
launch-windows.ps1 fix(mcp): stop assuming http://localhost:7000 for the OAuth callback (#6032) 2026-08-15 23:09:01 -06:00
launcher.py Merge commit from fork 2026-09-05 19:21:12 +02:00
LICENSE chore: backport main-only changes to dev AGPL relicense + Cookbook serve fix (#3704) 2026-06-09 23:20:34 +02:00
odysseus-ui.service fix: systemd service should serve on port 7000 to match Docker/setup/README (#1297) 2026-06-03 02:04:37 +09:00
Odysseus.spec feat(launcher): add portable windows launcher (#976) 2026-06-16 04:58:16 +01:00
package-lock.json build(deps-dev): bump @antithesishq/bombadil (#6026) 2026-08-25 14:03:11 +02:00
package.json build(deps-dev): bump @antithesishq/bombadil (#6026) 2026-08-25 14:03:11 +02:00
pyproject.toml test: add fast lane and duration visibility (#3659) 2026-06-09 20:11:47 +02:00
README.md refactor(docs): separate Pages site source (#6176) 2026-08-27 10:20:36 +02:00
requirements-optional.txt fix(speech): define the Kokoro optional install contract (#5962) 2026-08-16 23:39:12 +01:00
requirements.txt fix(deps): switch psycopg2 to psycopg2-binary (#5937) 2026-09-01 17:49:21 +02:00
ROADMAP.md Merge verified Odysseus fixes 2026-07-23 14:49:02 +00:00
SECURITY.md fix(auth): derive the session cookie Secure flag from the request scheme (#6048) 2026-08-16 22:56:36 +01:00
setup.py Merge commit from fork 2026-09-05 19:21:12 +02:00
start-macos.sh fix(mcp): stop assuming http://localhost:7000 for the OAuth callback (#6032) 2026-08-15 23:09:01 -06:00
THREAT_MODEL.md feat(auth): define Default/Local owner contract (#5795) 2026-08-15 20:27:26 +01:00
update_windows.bat Windows: add Docker update script 2026-06-02 20:45:32 +09:00

Odysseus

A self-hosted AI workspace for chat, agents, research, documents, email, notes, calendar, and local model workflows.

Quick Start · Setup Guide · Contributing · Roadmap

Packaging status

Odysseus interface


Quick Start

dev is the default branch and gets the newest changes first. Use main if you want the more curated branch.

git clone https://github.com/odysseus-dev/odysseus.git
cd odysseus
cp .env.example .env
docker compose up -d --build

Open http://localhost:7000 when the containers are healthy. The first admin password is printed in docker compose logs odysseus.

Native installs, GPU notes, Windows/macOS instructions, HTTPS, and configuration live in the setup guide.

Features

  • Chat + Agents — local/API models, tools, MCP, files, shell, skills, and memory.
  • Cookbook — hardware-aware model recommendations, downloads, and serving.
  • Deep Research — multi-step web research with source reading and report generation.
  • Compare — blind side-by-side model testing and synthesis.
  • Documents — writing-first editor with AI edits, suggestions, Markdown, HTML, CSV, and syntax highlighting.
  • Email — IMAP/SMTP inbox with triage, tags, summaries, reminders, and reply drafts.
  • Notes, Tasks + Calendar — reminders, todos, scheduled agent tasks, and CalDAV sync.
  • Extras — gallery/image editor, themes, uploads, web search, presets, sessions, and 2FA.

Demo

A full hover-to-play tour lives on the Odysseus landing page. Its source lives under website/.

Contributing

Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, docs, and small focused refactors. See CONTRIBUTING.md and ROADMAP.md.

Security

Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model/service ports publicly.

  • Keep AUTH_ENABLED=true for any network-accessible deployment.
  • Keep LOCALHOST_BYPASS=false outside local development.

Deployment details are in the setup guide.

Star History

Star History Chart

License

AGPL-3.0-or-later -- see LICENSE and ACKNOWLEDGMENTS.md.