Managoat runs on Fountain, an open-source server you can run yourself.

Chat with Claude Code, Codex or Gemini CLI. Watch it work.

Give an agent a task, follow its tools and changes, and send a follow-up. Each conversation has a real computer that keeps its files between prompts.

Conversations showing a cart task, tool calls, an expanded code diff, and tests in progress — Real app screens with a seeded local example.

Workbench on a phone, with a cart work item assigned to Builder — Real app screens with a seeded local example.

Build with the API

Apps

Use an app. Or build your own on the same API.

12 open-source apps already run on the public API. Use one, fork its source, or point it at your own instance.

Conversations

Run an agent and watch every step.

Source

Team

Message your agents like teammates.

Open app Source

Workbench

Assign work across shared projects.

Open app Source

Browse all 12 apps

Coding agents on ready machines.

Your repositories, packages and credentials arrive with the machine. It parks between prompts and wakes with its work intact. Run your own instance to try it.

Case study

The pager still rings. An agent starts working too.

When a workload breaks, this Kubernetes cluster pages an on-call engineer and starts an agent at the same time. The agent investigates the alert and, when it finds a repository fix, opens one focused pull request. It never holds cluster credentials. A person decides whether to merge.

7.5 min: median alert-to-verdict time; The longest investigation ran 50 minutes.

78: alerts investigated
12: fix pull requests opened
8: fix pull requests merged

Measured from 11 to 25 August 2026 on one Kubernetes cluster running live production workloads. Numbers reported by the cluster administrator (us).

Read the incident timeline

Setup

You write this once. Everything after it is a prompt.

1 Describe the machine once. Repositories, packages, env vars, setup scripts. Write it in the console, or keep it in git.

2 Add credentials only when a run needs them. A Vault is an optional set of environment-variable overrides. Attach one in the API call; leave it off when a run needs no credentials.

3 Name the agent and its tools. Pick the runtime and model, add skills and MCP tools, and attach the Environment. The public DeepWiki server needs no credential.

# fountain.yml
apiVersion: fountain.dev/v1
kind: Environment
metadata:
  name: app
spec:
  repositories:
    - url: https://github.com/acme/app
      mount_path: /work/app
      secret_key: GITHUB_TOKEN
  setup_script: cd /work/app && npm install
---
apiVersion: fountain.dev/v1
kind: Vault
metadata:
  name: ci-bot
spec:
  secrets:
    GITHUB_TOKEN: op://Private/github/token # resolved from 1Password at apply time
---
apiVersion: fountain.dev/v1
kind: Agent
metadata:
  name: reviewer
spec:
  runtime: claude
  model: anthropic/claude-sonnet-5
  environment: app
  skills:
    - source: obra/superpowers
      ref: v2.1.0
  mcp_servers:
    deepwiki:
      type: http
      url: https://mcp.deepwiki.com/mcp

One file, three documents. Apply it once. It creates what is new and updates what changed.

fountain apply -f fountain.yml

4 Send a prompt. A sandbox spawns and the agent works, streaming as it goes. Send another prompt and the machine is still there with its work on it.

import { Fountain } from "@managoat/fountain-sdk";

const fountain = new Fountain(); // FOUNTAIN_API_KEY

const run = await fountain.run(
  "Fix the failing test and open a PR",
  { agent: "reviewer", vault: "ci-bot", channelId: ticket.id }
);

console.log(run.text);

Underneath

What runs underneath the agent.

The agent is only the visible part.

Launch every run from the same reviewable setup.: An Environment defines repositories, packages, environment variables, setup scripts, and network policy. Keep it in git, review changes, and reuse it across runs.
Change a credential without a redeploy.: Here, a Vault is a per-run override, not a central secret store. Its values override the Environment, so the same setup can run as you, a bot, or your customer. Managoat scrubs secret values from stored output.
Let the agent open the pull request.: The sandbox already has the checkout and the credential you assigned. The agent can commit, push, and open the pull request without a patch handoff.
Build one interface for every runtime.: Managoat normalizes text, reasoning, tool calls, results, and approval requests into one block schema. Request it with ?blocks=true.
Keep the workspace. Release the capacity.: While a sandbox waits, its checkout and work in progress stay intact, but it uses none of your concurrency. The next message wakes it on the same files.
Trace what changed and who changed it.: The audit trail records who changed each resource and which fields changed, without storing their values. Each conversation also records the exact Agent version it ran under.

State

Use an id you already have. Managoat keeps the session.

Bind a conversation to a customer, ticket or Slack channel id. Send that id with the same Agent, Environment and Vault to resume the live conversation. You do not store or look up a Managoat conversation id.

Between prompts, the sandbox parks with its files intact. The next message or a scheduled run wakes it.

In the default mode, the disk belongs to that conversation. End the conversation and its workspace goes with it.

See the conversation API

Scale

A hundred tickets take a hundred calls, not a new architecture.

No queue to run, no worker pool to size, no image to bake per repository.

Give each job its own sandbox

In the default mode, one call starts one conversation on its own sandbox. A batch is a loop. Every sandbox carries the bundled skill, so an agent can start more work and collect the replies.

Or share one sandbox across conversations

Use persistent mode when many conversations need the same checkout. They keep separate transcripts and run up to the runtime's capacity. Work beyond that limit is refused, not queued.

Protocols

Put Managoat behind the stack you already use.

Your editor or chat surface keeps speaking ACP, and your agents keep speaking MCP. Everything else drives the roster through the API our own apps use.

Agent Client Protocol: Connect an ACP editor or chat surface to any agent on your roster with fountain acp.
MCP, both directions: Let agents use the servers you declare, then expose the roster so they can delegate to each other.
REST, SSE and webhooks: Start a conversation, stream its blocks and receive a signed webhook when the turn ends, from your own code, an SDK or the CLI.

See what connects today

Self-host

Own as much of the stack as you want.

The same API, SDK and CLI. Run Fountain and Postgres in your own account, and connect machines from your network.

Run the control plane yourself. Fountain is open source. Docker Compose brings up Fountain and Postgres, while plain Kubernetes manifests run the same release image.

Bring your own sandbox compute. A runner dials out from your network and opens no inbound port.

By default, a runner uses trusted mode. The agent runs as you, with your network and tools and no container between. Use it where you would hand a colleague a shell, or use the Firecracker backend on Linux with KVM for a microVM boundary.

See what self-hosting takes

Questions

You do not have to take our word for it.

Read every limit and review the security model yourself. The answers tell you what the software enforces and where it stops.

Get the answers

Want to learn more?

Managoat is not open for sign-ups. If you are curious about it, or about running Fountain yourself, Jake is happy to talk.

Contact Jake

Or read the manual.