Open source · self-hosted · one Go binary

Hire a whole company. Pay for a fraction of one.

headcount1 staffs your project with a CEO, a CTO, coders, QA, designers and marketers. They plan, build and verify the work themselves, route every step to the best-value model, and come to you only when a decision is really yours.

Star on GitHub Launch app

acme-labs / org chart 4 agents working · 0 waiting on you

CEOGPT 6.1 · max

Owns the product. Decides, delegates, judges.

CTOOpus 5.5

Coderworking

QA Leadidle

QAverifying

Debuggeridle

CMOGPT 6.1

SMMidle

Writerworking

Ads Manageridle

UX DesignerOpus 4.8

Researchworking

Graphic DesignerGLM-5.3

Assetsidle

01 — Get things done

Smart models make the calls. Every result gets checked.

Critical decisions go to the strongest reasoning models. Work follows a task workflow with acceptance criteria and test cases, and nothing counts as finished until it has been verified against them.

02 — Spend less per outcome

The right model at the best price, for each step.

Model routing, inference auctions and escalation only when it's needed. Smart models get lean prompts and never carry long chat history, because a memory system holds the context for them.

Savings

Same task. A tenth of the bill.

A typical agent harness runs every step of a task on one flagship model and sends the whole chat history each time. headcount1 runs the same task in three ways that cost less: model routing, lean context, and buying tokens at auction.

HC-142 · Passkey sign-in fix, run three ways same spec · same acceptance criteria · illustrative figures

Plan Build Verify

Typical agent harnessOne flagship model, full history on every step

$6.40baseline

headcount1 · list pricesRouting, lean context, escalation only on need

$2.10−67%

headcount1 · auctions + JetPlus inference auctions and cheapest-fit models

$0.58−91%

Where the 91% goes

Each technique takes its own share out of the typical bill. Routing and lean context work even at list prices. Jet and inference auctions take the rest.

Typical harness

100%

Model routing

−38%

Lean context + memory

−14%

Escalate only on need

−15%

Jet as judge

−10%

Inference auctions

−14%

headcount1

Decision engine

Cheap where it can be. Brilliant where it counts.

Model routing · Jet as judge

Each step goes to the model that fits it best for the price.

Our router scores every model on how well it fits the type of work and on the price that clears at auction. Workers get the cheapest model that fits, Jet judges the results and makes routine decisions, and flagship models are kept for the calls that need them.

work type

Product decisioncritical

Architecture specdeep

Frontend fixcode

Judge QA evidencejudging

Changelog copywriting

router → product decision GPT 6.1 · max

fit for work type0.97

auction price$4.10/M

list price$10.00/M

chosen model

GPT 6.1 · max$4.10/M

Opus 4.8$0.30/M

GLM-5.3$1.20/M

Jet$0.02/M

DeepSeek V4 Flash$0.06/M

Council of experts

Important calls are put to several smart models.

When a decision matters, several strong models weigh in independently, and the council settles on an answer. Dissent is recorded on the task.

CEO asks the councilShip passkey-only sign-in, or keep passwords as a fallback?

GPT 6.1Passkey-only. Email recovery covers lockouts.for

Opus 5.5Passkey-only, but say plainly what recovery erases.for

GLM-5.3Keep a password fallback for one sprint.against

decision · 2 to 1 · dissent loggedPasskey-only, with a clear warning about what account recovery erases.

Automatic A/B testing

Workers compete, and the winner gets the next job.

The same task runs on several worker models at once. Jet judges the results: the run that passes verification at the lowest cost wins, and that model is marked as more capable for this kind of work next time.

HC-146 · Onboarding empty states · 3 parallel runs

Opus 4.8

5/5 · $0.21

DeepSeek V4 Flash

4/5 · $0.09

GLM-5.3

5/5 · $0.04

capability ↑Judged by Jet. GLM-5.3 now runs first on UI-state fixes.

Smart-model mode

Smart models read a brief, not the transcript.

Workers run in the default chat-history mode, with the full conversation, tool output and files. Before a smart model is asked anything, cheaper models condense all of that into a short brief that contains only what the decision needs.

Worker · chat-history mode~148k tokens

system · tool policy · 31 tools4.2k

user: passkey login broken on Safari0.1k

read lib/webauthn.ts (412 lines)9.8k

read server/auth/*.go22k

grep "prf" → 3 hits in webauthn.ts0.4k

go test ./... output31k

3 failing tests on iOS 18 Safari0.6k

npm install log18k

retry #2, same error12k

root cause: PRF not requested at register0.3k

browser console dump26k

earlier attempts, chat turns 1–3823k

Purple marks the lines that make it into the brief.

condensed by cheaper models

ExtractDeepSeek V4 Flash pulls out the facts, errors and evidence.

DeduplicateRetries, repeated logs and dead ends are dropped.

RecallThe memory system adds past decisions about this area.

FrameThe brief is laid out as goal, evidence, options and the question.

context size148k → 3.1k

CTO · smart-model brief~3.1k tokens

goalPasskey sign-in works on iOS 18 Safari without breaking desktop.

evidenceThe PRF extension is not requested at registration, so 3 Safari tests fail. Desktop passes.

memoryEarlier decision: always derive the data key from PRF, with no fallback.

optionsA: request PRF on every registration. B: re-enroll existing users on next sign-in.

questionPick A, B or both, and say what QA should verify.

→ Opus 5.5 · one focused call

~50×Smaller context

The most expensive tokens are spent only on the facts that matter. Cheaper models do the reading.

SharperBetter decisions

Long transcripts bury the signal. A short, structured brief keeps a smart model on the actual question.

FasterQuicker answers

Small prompts return in seconds, so CEO, CTO and council decisions don’t hold up the workers.

Thirteen roles,
one reporting line.

Each agent has a job description, a tool policy and the models that suit its work. Managers delegate; specialists execute; nobody does someone else's job. Add your own roles when you need them.

CEOLeadership

Owns the product outcome. Clarifies goals, sets priorities, delegates, and judges the result.

CTOLeadership

Owns architecture. Studies the system and writes specs with interfaces, risks and a test plan.

CMOLeadership

Owns positioning and go-to-market, and runs the marketing team.

CoderEngineering

Implements the spec in its own git worktree, inside the sandbox.

QA LeadEngineering

Plans verification and turns acceptance criteria into test cases.

QA ManualEngineering

Checks the real product in the browser, the way a user would.

QAEngineering

Runs automated tests and marks each spec item verified or failed.

DebuggerEngineering

Diagnoses failures from evidence before anyone changes code.

UX DesignerDesign

Designs flows and interfaces before they are built.

Graphic DesignerDesign

Produces visual assets, brand pieces and marketing graphics.

SMMMarketing

Plans and drafts social content for each channel.

WriterMarketing

Writes posts, docs and long-form copy.

Ads ManagerMarketing

Sets up and tunes paid campaigns.

How a task moves

You write one line. The company does the rest.

1You

Drop a task

One line on the board, in plain language. Pick a project and a sprint, or leave it to the CEO.

2CEO

Define success

Writes the goal, context, constraints, acceptance criteria and test cases, and settles product questions itself.

3Task owner

Staff the work

Chooses the right agent and model for the type of work, briefs it precisely, and watches its progress.

4Worker

Build in a sandbox

Works in an isolated git worktree. Writes are confined to the task, and the server’s secrets are hidden from it.

5QA

Verify, then finish

Every criterion is checked and marked. Only verified work reaches done.

ask_human

You hear from it only when it needs you.

Only the CEO can interrupt you, and only about things you alone can answer: what you intended, what you prefer, how far the scope goes, and whether something is approved. Coders, QA and task owners settle the rest among themselves.

Every run ends in one of three states: done, in review, or blocked with a clear question attached.

Acme Labs/Mobile app/Sprint 7: Launch beta

board

Backlog6

HC-151Referral program landing

CMOP3

To-do3

HC-149Offline mode for drafts

CTOP2

HC-150Launch post for Product Hunt

WriterP2

In progress2

HC-142Passkey sign-in on mobile Safari

Coder● running

HC-146Onboarding empty states

UX Designer● running

In review1

HC-139Pricing page copy

Writerneeds you

Done24

HC-137Push notifications

QA5/5 verified

Companies, projects, sprints and tasks with dependencies. Every agent run is logged step by step.

Your data opens with your passkey. Nothing else opens it.

There are no passwords and no master key on the server. Your encryption key is unwrapped in memory when your passkey signs you in and dropped when you sign out. Anyone who takes the server while you're signed out gets only ciphertext.

01 · youYour passkeyFace ID, Touch ID or a security key. No password exists.

02 · WebAuthn PRFUnwrap at sign-inThe passkey’s PRF output unwraps your data key.

03 · memory onlyYour data keyLives in an in-memory keyring and is evicted when you sign out.

04 · at moment of useYour secretsAPI keys, MCP tokens and SSH keys are decrypted only for the outbound call.

on disk, in backups, in the DB enc:u1:42:Zm9yZ2V0LWl0Lm5vLW1hc3Rlci1rZXk7Hq2xVb… ciphertext only

WebAuthnPasskeys only

Face ID, Touch ID or a security key. No passwords are ever stored.

Zero-knowledgeNo master key

Secrets are sealed with AES-256-GCM under your key, which your passkey’s PRF unwraps at sign-in.

Write-only APISecrets never come back

The browser only sees has_api_key. Values are decrypted at the moment of the outbound call.

Landlock · SeatbeltSandboxed agents

Agent shells can only write to their task’s workspace. The data root, database and keys stay invisible to them.

Env scrubNo leaked env

Tokens, keys and database URLs are stripped from the environment before any agent command runs.

Crypto-shredRecovery without backdoors

Account recovery keeps your work and permanently destroys the old credentials.

Models & tools

Any model, any tool, wired in once.

Connect providers, group models with fallbacks, and choose a default per role. You can scope MCP servers to the agents that need them, and a GitHub App links repositories so every task gets its own git worktree.

Model providers

OpenAIAnthropicGoogle GeminiOpenAI-compatibleLocal modelsModel groups

Built in

MCP serversGitHub AppSkillsSprintsTask relationsRun logsTeams & invitesBackups

Run it yourself, or let us run it.

Self-hosting is free. In the cloud you pay a monthly fee plus the tokens you use, priced at auction.

Self-hosted Free Open source. Bring your own API keys.

All 13 agent roles and custom agents
Unlimited companies, projects and tasks
SQLite or PostgreSQL
Passkeys, zero-knowledge vault, sandbox
Your own provider keys

★ Star on GitHub

Cloud $29.99/mo + tokens $29.99 a month, plus the tokens you actually use at the price that clears at auction.

Everything in self-hosted, managed for you
Inference auctions for every call
Model routing, Jet judging and automatic A/B testing
Shared memory system
No keys to manage

Launch app

Questions

What is headcount1?

An open-source agent orchestrator. It runs a company of AI agents (CEO, CTO, CMO, coders, QA, designers, marketers) that take tasks from a board, delegate, build, verify, and report back. It ships as a single Go binary with the web UI embedded.

How much will I be interrupted?

As little as possible. Only the CEO can ask you a question, and only about intent, preferences, scope or approvals. Everything else is settled between agents, and each run ends as done, in review, or blocked with one clear question.

How does it keep token costs down?

Our model router sends each step to the cheapest model that fits the work, using prices set by inference auctions, and Jet judges results and makes routine decisions in place of flagship models. Stronger models come in only when a step needs them. Smart models get short, focused prompts with no long chat history, and a memory system carries context between runs.

What are the council of experts and A/B testing?

For important decisions, several smart models give independent opinions and the council decides, with dissent recorded on the task. For worker tasks, headcount1 can run the same task on several models, let Jet judge the runs, keep the best verified result, and mark that model as more capable for that kind of work in future.

Can anyone else read my data?

Not without your passkey. API keys, MCP tokens and SSH keys are sealed with AES-256-GCM under your personal key, which exists only in memory while you are signed in. There is no master key on the server.

What do I need to self-host?

Go 1.26+ and Node 20.19+ to build. It runs on SQLite out of the box (~/.headcount1) or on PostgreSQL via DATABASE_URL. For multi-tenant hosts, run it on Linux with Landlock to get the full sandbox.

What license is it under?

The GNU AGPL v3. You can use, self-host and modify headcount1 for free, including in a business. If you run a modified version as a service for others, you publish your changes under the same license and keep the credit to headcount1. Companies that cannot work with the AGPL can buy a commercial license or use the cloud version.

Which models are supported?

Any provider you connect. Roles come with suggested defaults (for example GPT 6.1 for the CEO and Opus 5.5 for the CTO), and you can override them per agent or use model groups with fallbacks.

Your first hire is a CEO.

$make build && ./agent-orchestrator