Employee001

Your organizational brain.

Agent twins of your real employees — running entirely on your own machine, sharing one knowledge layer, executing real work through real tools.

Install · A council in 30 seconds · How it works · Vs. alternatives · Security model

Install

npx employee001 setup     # interactive first-run wizard
npx employee001 start     # opens http://localhost:3000

Note

Requires Node.js 22+ and an Anthropic API key. A Composio API key is needed when you invite a real employee for training — marketplace agents work without it. Press Ctrl+C to stop the server.

Important

Your data never leaves your machine. Only the prompts a twin generates are sent to the Anthropic API. Employee profiles, audit logs, org knowledge — all of it stays in ./data/ on your hardware. No telemetry, no analytics, no "phone home".

What it is


🧠	Your organizational brain. Scattered expertise, past decisions, and work patterns become one living layer your company can query, trust, and grow.
👤	A twin for every employee. Always-on AI agents that understand a specific person's role, context, tone, and prior work — not generic role templates.
💬	Multi-twin council meetings. Ask one question and the right twins debate, challenge each other, and converge on a shared answer.
🔌	Connected to how people actually work. Email, calendar, docs, Slack, Linear, GitHub, CRM — through Composio MCP, the same tools your people already use.
⚡	Knowledge → execution. Twins draft Slack messages, file Linear tickets, send emails, follow up — each action gated by your approval.
🏠	Local-first by default. Runs on your Mac mini (or any Node 22 machine). Bound to `127.0.0.1`. Only prompts leave, only to Anthropic.

A council, in 30 seconds

You: What should we do before launching the new customer onboarding flow?

Twin	Tools	Says
🟠 Dana · Product	Linear, Slack	Risks first — the new flow touches activation. Let's pull last quarter's drop-off points.
🔵 Arie · Engineering	GitHub, Linear	DB migration ships Thursday. Day-1 launch blocks if rollback isn't tested.
🟣 Noa · Sales	Slack, Monday	Two enterprise demos this week. Defer = revenue at risk. Stage launch?
🟢 Tamar · Support	ClickUp, Slack	Need help docs + macros ready, or the queue floods. 2 days of work.

Tip

Verdict. Stage launch to 10% next Tuesday after migration rollback test. Sales keeps demos; Support ships docs + macros by Monday.

Each speaker is grounded in their own profile files (EXPERTISE.md, DECISIONS.md, CONTEXT.md, ...) and can call real tools to back up claims. Full transcript exports as markdown.

How it actually works

flowchart LR
    CEO(["👤 CEO<br/>(browser)"])
    subgraph local ["🏠 Your machine"]
        Server["⚡ employee001 server<br/>Next.js + Node"]
        Data[("💾 data/<br/>profiles · audit · org brain")]
        Server <--> Data
    end
    Anthropic["🧠 Anthropic API<br/>(Claude)"]
    Composio["🔌 Composio MCP<br/>(300+ tools)"]

    CEO -->|invite link| Server
    CEO -->|ask| Server
    Server -.->|prompts only| Anthropic
    Anthropic -.->|twin response| Server
    Server -->|tool call| Composio
    Composio -->|Slack · Linear · email · code| Server
    Server -->|answer + approval gate| CEO

    classDef local fill:#0d2818,stroke:#2ea44f,color:#fff
    classDef external fill:#1e1e2e,stroke:#888,color:#fff
    class Server,Data local
    class Anthropic,Composio external

The five steps end-to-end

sequenceDiagram
    actor CEO
    participant Server as employee001 server
    participant Employee
    participant Composio
    participant Claude as Anthropic

    Note over CEO,Composio: 1. Invite
    CEO->>Server: create invite (lookback 30–360 days)
    Server-->>CEO: shareable link
    CEO->>Employee: sends link

    Note over Employee,Composio: 2. Train (autonomous)
    Employee->>Server: opens invite, OAuth their tools
    Server->>Claude: spawn training agent (120-turn budget)
    Claude->>Composio: read Slack/Gmail/Linear/GitHub history
    Composio-->>Claude: real work signal
    Claude->>Server: writes 9 profile .md files
    Server-->>Employee: ✅ twin ready

    Note over CEO,Composio: 3. Ask, propose, approve, audit
    CEO->>Server: question (single twin or council)
    Server->>Claude: prompt + profile files + Org Brain
    Claude->>Server: proposes Composio tool call
    Server-->>CEO: 🛑 approval queue
    CEO->>Server: ✅ Approve
    Server->>Composio: execute (send email, file ticket, ...)
    Composio-->>Server: result
    Server-->>CEO: answer
    Server->>Server: append to audit.jsonl

Vs. other AI-for-teams products

	ChatGPT Teams / Copilot	Cabinet¹	Paperclip²	Employee001
Who the agent represents	Generic assistant	Generic role templates	Configurable AI "employees"	A twin of a real, named person
Where data lives	OpenAI / Microsoft cloud	One founder's laptop	Managed cloud or self-host	Your machine. Prompts only leave, only to Anthropic
Multi-twin reasoning	—	—	Task routing	Council debates — twins challenge each other
Tool execution	Limited connectors	CLI in a terminal	Adapters to external agents	Native MCP + approval gate on every external action
Org-wide knowledge	Conversation history	Personal notebook	Task/spend dashboards	Org Brain — what one twin learns, the rest inherit

Built around how people actually work

📧 Email · 📅 Calendar · 📄 Documents · 💬 Chat · ✅ Tasks
💻 Code repositories · 🛍️ CRM · 📚 Knowledge bases · 🔧 Internal tools

Connected through Composio MCP — 300+ toolkits, OAuth per employee (the employee authorizes their own twin, not the CEO on their behalf), token refresh handled automatically. Add a custom MCP server with Bearer auth or full OAuth from /settings — Apify, Stripe, Firecrawl, Higgsfield, anything that speaks MCP.

What twins can and can't do

Twins run on the Claude Agent SDK. Permissions are deliberate and identical for every twin in every workspace.

The approval gate, visually

stateDiagram-v2
    [*] --> Proposed: twin wants to call<br/>an external tool
    Proposed --> ApprovalQueue: SDK pauses
    ApprovalQueue --> Approved: CEO clicks ✅
    ApprovalQueue --> Denied: CEO clicks ❌
    ApprovalQueue --> Expired: 10 min timeout
    Approved --> Executed: tool runs
    Denied --> Audited: twin notified, no retry
    Expired --> Audited
    Executed --> Audited
    Audited --> [*]: append to<br/>data/audit.jsonl

    note right of ApprovalQueue
        Read-only tool calls
        skip this gate entirely
        (listing channels, fetching
        messages, reading PRs)
    end note

Hard-disallowed everywhere — no twin can call these, ever

Bash · NotebookEdit · EnterWorktree · ExitWorktree

No twin runs shell commands on your machine. Enforced in two places at once (the SDK's disallowedTools plus a defensive PreToolUse hook).

📋 Detailed permissions per run type (click to expand)

Run type	Built-in tools	External tools
Twin chat	`Read`, `Glob`, `Grep`, `Write`¹, `WebSearch`, `WebFetch`, `Task`², `TodoWrite`, `AskUserQuestion`	Composio³
Twin training	`Read`, `Write`¹, `Glob`, `Grep`, `TodoWrite`	Composio³ (read-only signal — Slack/Gmail/Linear/GitHub history)
Scheduled routines	`TodoWrite`	Composio³
Org-brain summarisation	— none —	— none —

¹ Write is sandboxed to data/scratch/<employee-id>/. A twin can jot a memo or draft — it cannot overwrite its own profile, the org brain, audit logs, or any other file under data/. Path traversal is rejected.

² Task spawns one of two restricted sub-agents: a web-researcher (only WebSearch + WebFetch) or a brain-explorer (only Read + Glob + Grep). Sub-agents inherit the same hard-disallow list.

³ Composio MCP tools are external-effect tools — posting to Slack, sending Gmail, opening GitHub PRs. Every call hits the approval gate above. Auto-execution is off by default. Read-only Composio calls run without prompting.

Audit trail. Every tool call — built-in or Composio — is appended to data/audit.jsonl with the run id, the employee id, the tool name, the input, and the verdict (executed / ceo_approved / ceo_denied / hard_blocked). Browseable from /audit.

Web citations. After any WebSearch or WebFetch, a PostToolUse hook injects an instruction telling the model to cite the URL and the fetch date. Twins can look things up online, but they can't pretend they "just knew" something.

Models. claude-sonnet-4-6 default with claude-sonnet-4-5 fallback. Override to claude-opus-4-7 for a single message from the chat UI. Source of truth: src/lib/sdk-defaults.ts.

Where your data lives

./
├── .env                  # your API keys (chmod 600)
└── data/
    ├── employees/<id>/   # 9 markdown profile files per twin
    ├── org/              # Org Brain (shared knowledge graph)
    ├── audit.jsonl       # every tool call, every approval
    ├── routines.json     # scheduled work
    ├── hired-agents.json # marketplace hires
    └── memory/<id>/      # per-twin episodic memory

Tip

npx employee001 export ~/Desktop/e001-backup.tar.gz snapshots everything except secrets. npx employee001 import <archive> restores on a fresh install.

Network exposure

By default the server binds to 127.0.0.1 — only this machine can reach it, OS access control is the boundary.

For a LAN-shared install (e.g. Mac mini in the office serving the whole team):

EMPLOYEE001_BIND=0.0.0.0 npx employee001 start

When bound to anything other than loopback, every request must carry a shared-secret token. setup generates one (EMPLOYEE001_TOKEN in .env); start prints the access URL on boot. Visit it once from each device — the token becomes a 30-day e001_token httpOnly cookie. API calls without a matching cookie return 401.

Invite tokens are carve-outs — they bypass the LAN gate for /join, /onboarding, and /api/invites/<token> only, so employees can onboard without holding the workspace secret.

Warning

Use a firewall or Tailscale. The token gates HTTP access, but the app is not hardened for the public internet. Don't put this on a port-forwarded box.

Commands

Command	What it does
`npx employee001 setup`	Interactive first-run wizard. Writes `.env`, creates `data/`.
`npx employee001 start`	Starts the local server. Opens browser. `--no-open` / `--port <n>` flags.
`npx employee001 doctor`	Health check — Node version, env, API keys, port, build.
`npx employee001 update`	Checks GitHub releases for a newer version.
`npx employee001 export <path>`	Snapshot `data/` to a tar.gz (excludes secrets).
`npx employee001 import <path>`	Restore `data/` from a tar.gz. `--force` overwrites.
`npx employee001 help`	Show help.

Status

The product has shipped the core loop end-to-end. Tracking against the public roadmap:

Open-core

100% of the code in this repo is MIT-licensed and free. Everything you see in the product is available to you.

Premium = services, not features:

Professional onboarding — we install it for you, set up MCP connections, train your team
SLA support with a dedicated Slack channel
Custom integrations

If that's interesting, open a discussion or email office@bulldog-adv.com.

☁️ Cloud edition (planned, separate)

This repository is the local-first OSS edition. A managed cloud edition is on the roadmap as a separate product — for teams that want long-running shifts, audit logs in a hosted console, private MCP networks, and don't want to run their own Mac mini.

The cloud edition will be a paid service, not a feature gate on this code. Everything you see in the repo today stays MIT and local-first.

Stack

Next.js 16 (App Router, RSC, standalone output)
Claude Agent SDK for reasoning + tool use
Composio MCP for tool integrations (300+ toolkits)
JSON-on-disk for state — no database

Contributing

PRs welcome. See CONTRIBUTING.md for setup, the rules of the road (no telemetry, no paid feature gates, no cloud dependencies), and how to file a security issue.

Maintainers: see RELEASING.md for the tag-driven publish flow.

License

⭐ If Employee001 sounds useful, star the repo — it helps others find it. ⭐

Comparison reflects public information about Cabinet (hilash/cabinet, MIT-licensed) as of May 2026. ↩
Comparison reflects public information about Paperclip (paperclip.inc, MIT-licensed) as of May 2026. ↩

Name		Name	Last commit message	Last commit date
.github		.github
bin		bin
docs		docs
public		public
scripts		scripts
src		src
.env.example		.env.example
.gitignore		.gitignore
.metadata_never_index		.metadata_never_index
.npmignore		.npmignore
CHANGELOG.md		CHANGELOG.md
CLAUDE.md		CLAUDE.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
RELEASING.md		RELEASING.md
SECURITY.md		SECURITY.md
eslint.config.mjs		eslint.config.mjs
next-env.d.ts		next-env.d.ts
next.config.ts		next.config.ts
package-lock.json		package-lock.json
package.json		package.json
postcss.config.mjs		postcss.config.mjs
tsconfig.json		tsconfig.json

Navigation Menu

Repository files navigation

Employee001

Your organizational brain.

Install

What it is

A council, in 30 seconds

How it actually works

The five steps end-to-end

Vs. other AI-for-teams products

Built around how people actually work

What twins can and can't do

The approval gate, visually

Hard-disallowed everywhere — no twin can call these, ever

Where your data lives

Network exposure

Commands

Status

Open-core

Stack

Contributing

License

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

Employee001

Your organizational brain.

Install

What it is

A council, in 30 seconds

How it actually works

The five steps end-to-end

Vs. other AI-for-teams products

Built around how people actually work

What twins can and can't do

The approval gate, visually

Hard-disallowed everywhere — no twin can call these, ever

Where your data lives

Network exposure

Commands

Status

Open-core

Stack

Contributing

License

Footnotes

About

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages