Enter OS (by MoleculesAI)

Inspiration

Every team wants AI agents working alongside them, but wiring that up is brutal: model keys, runtimes, sandboxes, secrets, CI, governance... weeks of infra before the first agent says hello. We wanted the "operating system" layer that makes an agent workspace as easy to get as an email account.

What it does

Enter OS (by MoleculesAI) provisions a complete, governed AI-agent workspace for a team in one click:

Instant workspaces - sign up, create an org, and a dedicated tenant spins up automatically: chat canvas, agent runtimes, per-tenant database, and an isolated network.
Multi-runtime agents - a shared runtime-contract SDK drives 6 interchangeable agent runtimes, so teams pick engines like they pick apps.
Plugin catalog - agents self-discover and install plugins (Lark, GitHub, custom MCP servers) through a catalog with install_plugin / list_available_plugins contracts.
Governed by default - secrets come from a single source of truth, images are digest-pinned, and a fleet reconciler continuously converges every tenant to the desired state and self-heals drift.
Agents that run the platform - our own CI, deploys, and fleet operations are executed by agents over MCP admin tooling: the platform is built and operated by the same agents it hosts.

How we built it

Control plane (Go) that provisions tenants, brokers LLM access through a metered HTTPS proxy, and exposes admin capabilities as MCP tools.
Runtime-contract SDK as the single source of truth for cross-runtime behaviors; adapters are thin shells, so no runtime can drift.
Kubernetes + Docker substrate with ephemeral CI runners that scale to zero on queue depth, a private registry, and a mesh (headscale) connecting the fleet.
Codex and coding agents are used throughout the build loop for implementation, review, and operations automation.

Challenges we ran into

False-ready races: a shared /health gate reported tenants ready before their databases were - we root-caused 5 distinct readiness races and fixed them at the contract level.
Registry distribution at fleet scale (image pulls that never converge over slow uplinks) - solved with a mirrored registry and digest-pinned promotion.
Keeping 6 runtimes behaviorally identical - solved by moving every cross-runtime behavior into the SSOT SDK and gating merges on contract tests.

Accomplishments that we're proud of

Public registration is live: a fresh org gets a working agent workspace end-to-end, gated by a full e2e pipeline (org -> platform agent -> team provisioning via management MCP) before any promote reaches prod.
Zero-drift fleet: every tenant image is digest-pinned and reconciled every 15 minutes.
The platform operates itself: agents handle CI triage, deploys, and fleet reconciliation.

What we learned

Treat "agent infrastructure" like an OS problem, not an app problem: contracts, reconciliation loops, and a single source of truth beat hand-wired integrations every time.