pinchy-email

<h1 align="center">Pinchy</h1>

Self-hosted AI agent platform built on OpenClaw. Enterprise-ready. Offline-capable. Open source.

<a href="https://docs.heypinchy.com">Docs</a> • <a href="https://heypinchy.com">Website</a> • <a href="https://heypinchy.com/blog">Blog</a> • <a href="https://github.com/heypinchy/pinchy/discussions">Discussions</a> • <a href="https://linkedin.com/in/clemenshelm">LinkedIn</a>

---

What is Pinchy?

Pinchy is an enterprise layer on top of OpenClaw — the open-source AI agent framework. OpenClaw is incredibly powerful for individual power users. But for teams and companies, critical pieces are missing: permissions, audit trails, user management, and governance.

Pinchy fills that gap.

The Problem

You want AI agents in your company. But:

Cloud platforms (Dust, Glean, Copilot Studio) send your data to external servers. For regulated industries in the EU, that's a non-starter.
Workflow builders (n8n, Dify) let you chain steps visually — but they're not autonomous agents.
Frameworks (CrewAI, LangChain) are libraries, not platforms. No UI, no permissions, no deployment story.
OpenClaw is the best open-source agent runtime — but it has no user management, no role-based access, no audit trail.

The Solution

Pinchy wraps OpenClaw into something enterprises can trust:

Plugin Architecture — Agents get scoped tools, not raw shell access. A "read Odoo sales orders" tool, not exec. Each tool is granted explicitly, per agent.
Role-Based Access Control — Who can use which agent. What each agent can do. Per team, per role.
Audit Trail — Every agent action logged. Who, what, when. Cryptographically signed and verifiable.
Web & Telegram — Reach agents in a web UI or from Telegram on your phone. One bot per agent, with the same permissions and audit trail.
Self-Hosted & Offline — Your server, your data, your models. Works without internet.
Model Agnostic — OpenAI, Anthropic, local models via Ollama. Your choice.

How Pinchy compares

| | OpenClaw alone | Cloud platforms (Dust, Glean) | Workflow tools (n8n) | Pinchy | | ---------------------------------------- | :------------: | :---------------------------: | :------------------: | :---------------: | | Self-hosted, data stays in-house | ✅ | ❌ | ✅ | ✅ | | Agent-first (not flow-first) | ✅ | ✅ | flow steps | ✅ | | Per-agent tool permissions (allow-list) | ❌ | partial | flow-level | ✅ | | Roles & per-user access | ❌ | ✅ | paid | ✅ | | Tamper-evident audit trail (HMAC-signed) | ❌ | partial | execution log | ✅ | | Chat UI + Telegram for end users | partial | ✅ | ❌ | ✅ | | Odoo ERP integration | ❌ | ❌ | connectors | ✅ | | Open source | ✅ | ❌ | fair-code | ✅ (AGPL-3.0) |

Honest caveats: Pinchy is young, the integration list is short (Odoo, email — Gmail & Microsoft 365, Telegram, web search, documents), there is no compliance certification yet, and granular RBAC is on the roadmap.

Quick Start

curl -fsSL https://raw.githubusercontent.com/heypinchy/pinchy/v0.8.0/docker-compose.yml -o docker-compose.yml
docker compose up -d
# Open http://localhost:7777 — the setup wizard creates your admin account

That is the whole thing: one command, no build step, pre-built images on GHCR. Pair it with a local model via Ollama and nothing ever leaves your network. Full setup, configuration, and development instructions: Installation Guide.

Status

> Pinchy is in early development. The core is working — setup, auth, multi-user, agent chat, permissions, knowledge base agents, and audit trail. We're building the enterprise features (granular RBAC, plugin marketplace, cross-channel workflows) next.

What works today

Setup wizard — Create your admin account on first run
Authentication — Credentials-based login with database sessions
Multi-user — Invite users, admin and user roles, personal and shared agents
Agent chat — Real-time WebSocket chat with OpenClaw agents, conversation history
Agent permissions — Allow-list model for agent tools (safe and powerful categories)
Agent settings — Configure name, model, system prompt, and tool permissions per agent
Knowledge Base agents — Create agents with scoped read-only access to specific directories
Context management — Per-user personal context and organization-wide context, editable in Settings
Email integration — Connect Gmail or Microsoft 365 mailboxes via OAuth; agents can read, search, draft, and send email with per-agent permissions
Smithers onboarding — New users get an onboarding interview where Smithers learns about them through conversation
Provider management — Configure API keys for Anthropic, OpenAI, and Google
Docker Compose deployment — Single command to run the full stack
Audit trail — Cryptographic audit logging with HMAC-signed entries, integrity verification, and CSV export
CI pipeline — Automated linting, testing, and security auditing

What's coming

Full RBAC with team-scoped permissions
Plugin marketplace for agent tools
Cross-channel workflows (email, Slack)
Admin dashboard with usage analytics

Follow our progress on the blog and LinkedIn.

Tech Stack

| Layer | Technology | | ------------- | ----------------------------------------------: | | Frontend | Next.js 16, React 19, TailwindCSS v4, shadcn/ui | | Auth | Better Auth (email/password, DB sessions) | | Database | PostgreSQL 17, Drizzle ORM | | Agent Runtime | OpenClaw Gateway (WebSocket) | | Testing | Vitest, React Testing Library | | CI/CD | GitHub Actions, ESLint, Prettier, Husky | | Deployment | Docker Compose |

Origin Story

Pinchy started when an AI agent sent a WhatsApp message it shouldn't have — leaking its entire internal reasoning process to a friend instead of a simple "Sure, let's grab lunch!" That moment made one thing clear: AI agents without proper guardrails are a liability, not an asset.

Read the full story on heypinchy.com.

Philosophy

We care about how Pinchy _feels_, not just what it does. Security + Ease is our core tension — enterprise-grade protection that feels light, not intimidating. Smart defaults everywhere, personality templates instead of blank slates, zero-config setup, and full customization when you need it.

Read more in our Philosophy docs and PERSONALITY.md.

Contributing

We love contributions! Whether it's code, docs, bug reports, or ideas — all are welcome.

Please read our Contributing Guide before submitting a PR. If you're writing any user-facing text, also check our Personality Guide.

Community

GitHub Discussions — Questions, ideas, show & tell
Issues — Bug reports and feature requests
Blog — Build in public updates
LinkedIn — Daily updates from the founder

If Pinchy is useful to you, a ⭐ helps other teams find it.

License

Pinchy is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

This means you can use, modify, and distribute Pinchy freely — but if you run a modified version as a network service, you must release your changes under the same license. This protects the project from being turned into a proprietary cloud service without giving back.

Who's Behind This

Pinchy is built by Clemens Helm — a software developer with 20+ years of experience, daily OpenClaw power user, and believer in self-hosted AI.

Built in Vienna, Austria.

Summary

Install to Claude Code