eparch
GitHubGet started

OPEN SOURCE · SELF-HOSTABLE · APACHE-2.0

Own your agents.

Eparch is an open-source, self-hostable control plane for building, deploying, and governing AI agents on open-weight models — on infrastructure you own.

Get startedStar on GitHub
sh
$ make quickstart✓ secrets generated✓ monolith started (2 containers)→ open http://localhost:8080

Agent SaaS you can't run in your environment.

DIY plumbing that takes quarters to build.

Eparch: the platform layer, on your hardware.

ARCHITECTURE

Ten services. Your infrastructure. Nothing else.

Eparch architectureThe platform UI talks to two edge services, identity and gateway. The gateway fronts eight data-plane services which run under Postgres row-level security and use Postgres, Redis, MinIO and OPA as backing services.platform-uiREST / SSEEDGEidentity · OIDC / JWKSgateway · auth · OPA · budgets · LLM proxygRPCDATA PLANE · eparch_app ROLE · POSTGRES RLSagent-configagent-runtimeragevaltool-registrytenantevent-brokerauditBACKING SERVICES · YOUR INFRASTRUCTUREPostgres + pgvectorRedisMinIO / S3OPA
Ten Go services. Every data-plane query runs under Postgres row-level security; the model backend is any OpenAI-compatible endpoint you own.

Eparch runs entirely on components you operate: PostgreSQL with pgvector for state, events, vectors, and encrypted secrets; Redis for rate-limit and budget counters; MinIO or any S3 store for documents; and OPA for authorization. The model backend is an OpenAI-compatible endpoint you point at your own inference — vLLM, Ollama, or any compatible provider. No managed cloud dependency; a single VM or an air-gapped network is enough.

GOVERNANCE

Every request governed, before it reaches a model.

Authenticated, policy-checked, rate-limited, budget-checked, cached, audited — by default.

CAPABILITIES

The plumbing every serious agent deployment needs.

LLM gateway

OpenAI-compatible chat, embeddings, and rerank proxy with rule-based routing, fallback, a semantic response cache, budgets, and rate limits.

Hybrid RAG

pgvector similarity search plus object-store document storage; embeddings and reranking flow through the gateway.

Tool registry + MCP

Register tools and MCP servers with an AES-256 encrypted secret store — secrets encrypted at rest in Postgres.

Canary + evals

Versioned agent definitions with canary deploys gated by eval runs, enforced server-side before promotion.

Hard multi-tenancy

Postgres row-level security scoping on every data-plane query, connected as a non-superuser role.

Immutable audit

Per-tenant audit logging plus usage and cost accounting for every request that touches a model.

QUICKSTART

Running in one command.

sh
$ git clone https://github.com/eparchai/eparch && cd eparch && make quickstart# requires only Docker + openssl — no model server, no accounts✓ secrets generated✓ monolith started (2 containers)→ open http://localhost:8080 and register the first account (it becomes the admin)

To wire up a real model backend or enterprise SSO, follow theself-host walkthrough.

ENTERPRISE

Deploying somewhere the cloud can't go?

Air-gapped networks, regulated industries, sovereignty requirements — Eparch was designed for the environments other agent platforms can't enter.

Request a private architecture briefing

Ship governed agents on hardware you control.

Get startedStar on GitHub