The Studio, module by module.
Everything a team needs to operate an agent is in the Community edition. What a company needs to operate a hundred of them, with a security officer and an auditor looking on, is in Enterprise. That is the whole rule.
- 34
- Model providers
- 3 174
- Models in the price registry
- 9
- Services to operate
- Air-gap
- Supported deployment
Versions you can point at, months later
Validated JSON output schemas, with bounded retry on drift Input and output guardrails: scope, content, format Image, PDF, Office and CSV attachments that announce truncation instead of staying silent A playground on any version, with a live trace, without polluting production metrics Test suites with evaluators, and a blocking publish gate below a pass threshold (Enterprise)
Allow-listed per server, then tool by tool
Three embedded MCP servers, for files, shell and browser, off by default Each run gets its own confined space under a dedicated system identity; the shell has no network A circuit breaker and a health probe per server Large outputs offloaded to object storage and re-read on demand Tool media carried as artifacts, never as bytes in a log
A guardrail is not a paragraph in the prompt.
Templates run outside the model, are pinned to the agent version, and cannot be talked out of their job by the conversation. They compose: one agent can carry a scope gate, a redactor and a semantic judge at once, in a defined order.
Personal data
Detected on the way in and on the way out, then redacted, blocked or escalated depending on the template. What was redacted is recorded; the value itself never enters a log or a trace.
Semantic guard
Judges the answer against a policy you write in plain language: no commitments the company cannot honour, no advice outside the licensed perimeter, no invented figures. A failed check retries once, then falls back to a safe response.
Format and citations
A validated output schema with bounded retry on drift, and an optional rule that every factual claim carries a citation from the knowledge collection. An answer without a source is not delivered.
Every decision is visible
Blocks, redactions, retries and escalations appear as steps in the run trace with the reason attached. A support lead can see why a customer got a refusal, and an auditor can count them.
Untrusted content is framed
Attachments, retrieved extracts, tool output and server descriptions are framed as data before they reach the model. One implementation for the whole platform, deliberately not two.
Asserted before publishing
Test suites assert on guardrail decisions, and a publication gate can block a version that fails them. Enterprise.
Thirty-four providers, and your own documents
One brain, many surfaces
Zone-based widget design, icon catalogue, automatic contrast, restrained motion Appearance changes live; what a visitor may ask is a decision of the version In-page capabilities only when the operator enables them and the visitor consents Verified visitor identity: your backend signs an assertion, the widget picks up the right thread
What happened, what it cost, and who changed what.
Per-run traces
Steps, model calls with tokens and cost, tool calls, cited extracts, parent-child delegations and authorization decisions. Usage and cost by organization, project, agent, surface and model, with CSV export.
Native OpenTelemetry
OTLP export to your collector, be it Grafana, Datadog, Langfuse or Honeycomb, following the generative-AI conventions, with Prometheus metrics and logs correlated to the trace. Without a collector, nothing fails.
Forty-eight rules, watching
The platform watches itself: restart loops, queue backlog, failure rates, exhausted provider billing, cost deviation, failed logins, blocked egress. A rule that changes severity announces itself in the Studio, by email, or to a webhook address you state. The twelve security rules cannot be switched off.
A dashboard, ready to import
One JSON file, built from what the platform actually exposes rather than adapted from a template. Import it into your Grafana against Prometheus, VictoriaMetrics, Thanos or Mimir, and it draws. Nothing extra has to run for it to work.
Accounts and roles
Local accounts with Argon2id, progressive lockout, two-factor with recovery codes, sessions listed and revocable. Invitations by email or at sign-up, usable without a mail server. A role per project and ownership transfer.
Secret vault and budgets
Written once and never readable again, with atomic rotation, a rollback window and a "referenced by" graph. Budgets and quotas per organization and project, and a per-run cost ceiling carried by the agent version, one dollar unless you raise it.
Runs where you already answer to
Every deployment path is a repository you can read, fork and pin to a version Managed PostgreSQL, Redis and object storage wherever you prefer them to the bundled ones Air-gapped installs supported: the model registry ships with the product and is never fetched at run time The same per-run sandbox isolation on a cluster as under Compose
Where Rikoo sits, and what the others do well.
| Criterion | Rikoo | Personal agents | Closed platforms | Workflow builders |
|---|---|---|---|---|
| Designed for | An organization exposing agents to customers and employees | One developer or operator, on their own machine | Companies already living in the vendor ecosystem | Teams assembling step chains |
| Where it runs | Your site, a sovereign cloud, or air-gapped | A workstation or a personal server | At the vendor, under their jurisdiction | Self-hosted or hosted |
| Models | 34 providers, European and self-hosted included, with automatic fallback | Several providers | Their model, or a curated catalogue | Several providers |
| Roles and tenancy | Organizations, projects and roles at both levels | Single user | Their own model, often per seat | Workspaces |
| Auditability | Immutable versions, frozen grants, append-only audit log | Depends what you wrote | What the vendor exposes | Run history |
Companies have agent prototypes, not agents in production. The gap is not the model. It is everything around it.
Declared, not yet delivered.
Discord, WhatsApp and Telegram
A hosted offering
Named customer references
Install it and judge for yourself.
Nine services, one command, fifteen minutes. No account, no key, no call with us.