# guilds.run > Open-source, self-hosted system from Cigale AI for standing teams of AI agents, each with its own role, model and tools. A guild shares chat, notes and tables, and every run keeps the prompt, tool calls and memory changes. - Canonical: https://www.anchorterminal.com/tools/guilds-run - Markdown: https://www.anchorterminal.com/tools/guilds-run.md (~6,150 tokens) - Slim: https://www.anchorterminal.com/tools/guilds-run.min.md (~1,430 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/guilds-run.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Licence: CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author. - Updated: 2026-10-14 ## Overview **Grade C · 56.5/100 · rank #674 of 1084 · #11 in Agent frameworks & SDKs · not agent-ready · confidence medium** ## Assessment A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. Public since 9 October 2026, it has no tagged release or published package, its own security register lists 13 open issues, and the site's terms and privacy links return 404. ## Facts | Field | Value | | --- | --- | | Vendor | Cigale AI (https://guilds.run) | | Kind | Agent framework | | Category | Agent frameworks & SDKs (https://www.anchorterminal.com/categories/frameworks) | | Auth | API key · The box has no model key of its own. Each organisation pastes a key for OpenAI, OpenRouter, xAI, DeepInfra or Kimi Code, or points at a local OpenAI-compatible endpoint, and the key is sent only to that provider. The web app on 127.0.0.1:8080 has no login by default; whoever reaches the port is the operator. AUTH_MODE=trusted-header takes identity from an authenticating proxy with a shared secret. | | Pricing | Free (Free · OSS) · Free under AGPL-3.0 to run yourself, with model usage billed by your own provider and no spend cap set by guilds.run. A hosted edition from $19 a month is listed as coming soon and not available on 14 October 2026 (https://www.guilds.run/pricing). | | x402 | No · No x402, MPP or L402 in the repository, the docs or on guilds.run (checked 2026-10-14). | | Licence | AGPL-3.0-only | | Source | https://github.com/CigaleAI/guilds | | Docs | https://docs.guilds.run/ | | llms.txt | not found | | GitHub stars | 57 (as of 2026-10-14) | | Runs on | Docker with the Compose plugin. Three services, PostgreSQL 17, an OpenSandbox server and a Node 24 orchestrator serving the web app on 127.0.0.1:8080 | | Version | No tagged release or version number. Public repository created 9 October 2026, last commit on main 13 October 2026 | | Models | OpenAI, OpenRouter, xAI, DeepInfra, Kimi Code and any local OpenAI-compatible endpoint, each called through Chat Completions. Claude and Gemini through OpenRouter | | MCP client | Remote MCP servers run in the orchestrator, added by an admin or from a connector registry. Connect tokens never enter the sandbox | | Multi-agent | A guild is a team with a shared group chat, notes and tables. A message tagged @agent wakes that agent, and an untagged one wakes every agent | | Durable state | Runs, notes, tables, memory and scripts in PostgreSQL. After a restart, unresolved tool calls get an interruption result and no model call is replayed | | Human approval | Studio edits wait for the operator to publish, and writing MCP tools start Off. No per-call approval gate for agent tool calls was found | | Sandbox | One OpenSandbox container per machine with dropped capabilities and no_new_privileges. Agents on a machine share it, run commands as root and have open egress | | Telemetry | None by default. Sentry when SENTRY_DSN is set. The bundled Graft tool runs with DO_NOT_TRACK=1, and its daily npm version lookup has no switch | | Hosted | Listed as coming soon from $19 a month, not available on 14 October 2026 | | Capabilities | agent.framework, agent.multi-agent, agent.mcp-client, agent.durable | | Tags | framework, open-source, self-hosted, local, docker, typescript, free, no-card, pre-1.0 | | JSON | https://www.anchorterminal.com/api/v1/tools/guilds-run.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 53 | 10.6 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 58 | 9.4 | | Agent ergonomics | 13% | 16.2 | 67 | 10.9 | | Security & auth | 14% | 17.5 | 68 | 11.9 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 41 | 3.6 | | Transparency & trust (editorial 63, provenance 40) | 7% | 8.8 | 52 | 4.5 | | Negative events | up to −15 | up to −15 | 2026-10-14. The home page says each agent has its own computer, and its script example reads sandboxed in scout's workspace. Since the change of 13 October 2026 (pull request #8, per-org machines), agents are placed on shared machines, and the vendor's own register (SEC-24, open and accepted) says agents on one machine can read each other's homes, git tokens, browser sessions and running commands' environments. The footer also links to terms and privacy pages that return 404. The docs state the shared-machine risk plainly, so 2 points. https://www.guilds.run/ and https://github.com/CigaleAI/guilds/blob/main/docs/architecture/security-register.md | -2 | | **Total** | | | | **56.5 → C** | ### Why each score - Reliability 53: Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and there are none (10 of 20). The verify workflow runs typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and all 13 runs on main from 9 to 13 October 2026 passed. The clone has 196 test files (25). No open issues, and the three issues filed were closed within an hour, on five days of public history (18 of 25). No version numbers, tags or changelog (0). Not versioned or declared stable (0). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 58: Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on guilds.run or docs.guilds.run (404). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). No changelog or versioned releases. The security register is the one page that keeps dated history (4 of 15). - Agent ergonomics 67: Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). - Security & auth 68: Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt injection, 15 for audit and 20 for the security programme. Model keys go only to their provider, Sentry starts only when SENTRY_DSN is set with user info, bodies and model inputs and outputs excluded, and Graft runs with DO_NOT_TRACK=1. Graft's once-a-day npm version lookup has no switch (27). Each machine is an OpenSandbox container with dropped capabilities and no_new_privileges, writing MCP tools start Off and Studio changes wait for the operator. Agents on one machine share it and run commands as root with open egress (SEC-6, SEC-24), no per-call approval gate for tool calls was found, and the default box has no login (10). The coding prompt says repository content is data, Studio wraps evidence as untrusted, and known secret values are redacted from transcripts. SEC-8, injection into coding agents, is open (8). Every run keeps the prompt, each tool call and result, and versioned memory with who changed it (14). SECURITY.md with GitHub private reporting and a public register of 26 issues with exposure and residual risk, 13 still open. No security.txt, bounty or published advisory (9). - Payments & pricing 60: No payment protocol (0). Self-hosted rule. The software is free under AGPL-3.0 with nothing to buy today (20), needs no card (20) and needs no account with Cigale AI (20). The hosted edition at $19 a month is listed as coming soon and was not scored. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 41: No tagged release. Main, which the install clones and SECURITY.md names as the supported version, last changed on 13 October 2026, so 20 of 30 rather than full marks for a release. No releases or dated changelog entries (0). Eight issues and pull requests, all closed, the three issues closed within an hour, one with two comments, on five days of history (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, no Dependabot configuration in the repository (6 of 10). - Transparency & trust 52: AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer links to both and they return 404. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or notices. The security register is dated (3 of 20). Sentry is opt-in and documented on the Configure page, and the Graft telemetry setting and its version lookup are disclosed on the code tools page (18 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (18 items): https://www.anchorterminal.com/fixes/guilds-run.md (JSON https://www.anchorterminal.com/fixes/guilds-run.json) ### What we couldn't check - The lead's Product Hunt date of 12 October 2026 is not the first release. The public repository was created on 9 October 2026 (GitHub API). The founder's earlier availability announcement was not found first-hand, and the @guildsrun posts on X were not read - unchecked: the Product Hunt page, which answered with a Cloudflare bot check - Whether a legal form and address exist for Cigale AI. None was found on the site or in the repository - Whether the terms and privacy pages linked from the footer are planned. Both returned 404 on 14 October 2026 - The home page lists GLM under subscriptions, and the core providers table names Kimi Code as the only coding provider - The home page says each agent has its own computer. Since 13 October agents share machines per organisation, per pull request #8 and SEC-24 ### Sources - home page: (seen 2026-10-14) - pricing page (hosted coming soon): (seen 2026-10-14) - terms link (404): (seen 2026-10-14) - privacy link (404): (seen 2026-10-14) - robots.txt: (seen 2026-10-14) - security.txt (404): (seen 2026-10-14) - docs site: (seen 2026-10-14) - repository clone (docs, workflows, source, LICENSE, SECURITY.md): (seen 2026-10-14) - GitHub API, repository (created 2026-10-09, 57 stars, AGPL-3.0): (seen 2026-10-14) - GitHub API, releases and tags (none): (seen 2026-10-14) - GitHub API, issues and pull requests: (seen 2026-10-14) - GitHub API, CI runs on main: (seen 2026-10-14) - install guide: (seen 2026-10-14) - system architecture and trust boundary: (seen 2026-10-14) - security register: (seen 2026-10-14) - runs, limits and restart behaviour: (seen 2026-10-14) - model keys and providers: (seen 2026-10-14) - tool catalogue and default-off rules: (seen 2026-10-14) - configuration (Sentry opt-in): (seen 2026-10-14) - RDAP for guilds.run: (seen 2026-10-14) ## Who's behind it (provenance 40/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Cigale AI | 20/20 | | Domain age | guilds.run, registered 2026-09-19 (under a year) | 0/15 | | Endpoint on the vendor's domain | no hosted endpoint | n/a | | Terms of service | nothing hosted, so the AGPL-3.0-only licence stands in | 10/10 | | Privacy policy | nothing hosted, not scored | n/a | | Status page | not found | 0/10 | | Changelog | not found | 0/10 | | security.txt | not found | 0/10 | The site footer says Cigale is the company behind guilds.run, and THIRD_PARTY_NOTICES.md reads copyright Cigale AI. No legal form or address was found. The footer links to https://www.guilds.run/terms and https://www.guilds.run/privacy, and both returned 404 on 14 October 2026. www.guilds.run/.well-known/security.txt returns 404. The repository has SECURITY.md with GitHub private vulnerability reporting. RDAP gives guilds.run a registration date of 2026-09-19. The GitHub organisation CigaleAI was created on 2025-02-17 and is not verified. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The AGPL-3.0-only licence stands in and the check scores in full. **Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored. ## Live (updated 2026-10-14 21:13 UTC) - Watching pricing - Always current: https://www.anchorterminal.com/api/v1/live/guilds-run.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - Every run stores the prompt the model saw, each tool call and result, and versioned memory with the author of each change - Free under AGPL-3.0, with Sentry off unless SENTRY_DSN is set and no other telemetry found in the source - MCP tools that write or are marked destructive start Off for a new login, and each agent is offered only the tools turned on for it - CI runs typecheck, lint, unit tests and a smoke test of the Compose stack, and all 13 runs on main passed - A public security register records 26 issues with status, exposure and residual risk ## Weaknesses - No tagged release, version number, changelog or published image. Users install whatever is on main - 13 issues in the vendor's security register are open, among them shared machines (SEC-24), root shells (SEC-6) and prompt injection into coding agents (SEC-8) - No login on the default box. Whoever reaches port 8080 is the operator, and remote use needs a proxy or tailnet - Terms and privacy links on guilds.run return 404, and no privacy statement for the software was found - Five days of public history on 14 October 2026, with 57 stars and eight issues and pull requests ## Before you call it (notes for agents) 1. Keep the box on loopback or behind an authenticating proxy with AUTH_MODE=trusted-header. The default mode does not authenticate 2. Put agents that hold different secrets or GitHub tokens on different machines. Agents on one machine can read each other's homes and tokens 3. Back up the .env file written by ./setup.sh. It holds the only copy of the key that encrypts stored credentials 4. Set a spend limit at your model provider. guilds.run sets no spend cap, and max_tool_calls defaults to 50 per run 5. Pin a commit of main when you deploy. There are no tagged releases or versioned images yet ## Get started Install: ```bash git clone https://github.com/CigaleAI/guilds.git && cd guilds && ./setup.sh && docker compose up --detach --wait ``` ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | OpenAI Agents SDK | AA | 86.2 | 1 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/openai-agents-sdk.md | | Pydantic AI | A | 83.7 | 3 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/pydantic-ai.md | | Microsoft Agent Framework | A | 82.2 | 6 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/microsoft-agent-framework.md | | Docker Agent | BB | 76.5 | 34 | agent.framework, agent.multi-agent, agent.mcp-client, agent.durable | no | https://www.anchorterminal.com/tools/docker-agent.md | | Agent Development Kit (ADK) | BB | 74.7 | 69 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/google-adk.md | | Agno | BB | 72.8 | 102 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/agno.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The public repository was created on 9 October 2026 with an initial commit the same day, three days before the Product Hunt launch of 12 October (source: ) - No tagged release, no published package and no published Docker image. Install is a git clone of main, ./setup.sh to build the images, and docker compose up (source: ) - A public security register lists 26 issues, 13 of them open, including agents on one machine reading each other's homes, tokens and sessions (SEC-24) and coding agents running commands as root (SEC-6) (source: ) - The footer links to /terms and /privacy, and both returned 404 on 14 October 2026 (source: ) - Sentry error reporting runs only when SENTRY_DSN is set, and the agent runtime sets DO_NOT_TRACK=1 for the bundled Graft code tool (source: ) - A tool from a connected MCP login starts Off when it is marked mutating or destructiveHint or its name carries a writing verb (source: ) - #11 of 11 in Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md - All 55 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md ## Compare - [AgentOS vs guilds.run](https://www.anchorterminal.com/compare/agentos-vs-guilds-run.md): BB 75.3 vs C 56.5 - [Agno vs guilds.run](https://www.anchorterminal.com/compare/agno-vs-guilds-run.md): BB 72.8 vs C 56.5 - [Claude Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run.md): BB 72.1 vs C 56.5 - [CrewAI vs guilds.run](https://www.anchorterminal.com/compare/crewai-vs-guilds-run.md): B 67 vs C 56.5 - [Docker Agent vs guilds.run](https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run.md): BB 76.5 vs C 56.5 - [Agent Development Kit (ADK) vs guilds.run](https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.md): BB 74.7 vs C 56.5 - [guilds.run vs LangGraph](https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.md): C 56.5 vs BB 70.6 - [guilds.run vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework.md): C 56.5 vs A 82.2 - [guilds.run vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.md): C 56.5 vs AA 86.2 - [guilds.run vs Pydantic AI](https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.md): C 56.5 vs A 83.7 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on guilds.run or one of its subdomains, or the README of github.com/CigaleAI/guilds. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "guilds-run", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html guilds.run on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![guilds.run on Anchor Terminal](https://www.anchorterminal.com/badges/guilds-run.svg)](https://www.anchorterminal.com/tools/guilds-run) ``` Plain link: ```html guilds.run on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say guilds.run is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/guilds-run-dark.png - Light: https://www.anchorterminal.com/assets/share/guilds-run-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=guilds-run