EpicStaff Agent Workflow Platform
Let operations teams build, run, and review AI agent workflows in infrastructure they control.
- Source repo
- EpicStaff/EpicStaff
- Stars
- ★ 359
- Last updated
- 10d ago
- License
- NOASSERTION
- Primary language
- Python
- FA score
- 57/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API (Partial support)
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Operations teams can represent a multi-step business process as a visual flow and review or edit its rules as they change.
- Not a fit if
- Teams that need a vendor-hosted, ready-to-use service
- Source review
- 57/100 · Major gaps
What does this agent do, and when should you use it?
EpicStaff is an agent orchestration platform for operations teams, with a Django backend and a node-based visual editor. Engineers can connect internal systems through MCP and Python, and add Python logic within nodes. Workflows support multi-agent collaboration, webhook triggers, document retrieval, and cross-session memory; the README names Redis and PostgreSQL with pgvector for memory storage. Teams deploy the service in an environment they control using Docker Compose, then use its browser-based interface to build and inspect workflows.
Users connect workflow nodes in the visual editor, configure model and embedding providers, and write Python code in nodes or define custom tools agents can call. The platform can start flows from HTTP POST webhooks, process uploaded documents into knowledge collections, and run retrieval strategies such as Naive Vector Search or GraphRAG. During execution it exposes node state messages and logs for debugging, and uses Redis/PostgreSQL for persistent cross-session agent memory. The resulting output depends on the configured flow and integrations.
- Operations teams can represent a multi-step business process as a visual flow and review or edit its rules as they change.
- Engineering teams can connect internal systems through MCP or Python, then let operations configure and run the workflows.
- Teams that need external events to start automation can trigger flows with HTTP POST webhooks.
- Teams that need agents to retrieve internal documents can create knowledge collections and configure indexing strategies.
- Teams that need visibility into agent steps and decisions can inspect node-level state messages and execution logs.
How do you install or deploy this agent?
Install Git and Docker Desktop first. This Linux/macOS example clones the repository, copies the configuration template, sets a save directory and Django signing key, creates the required Docker volumes and network, then starts the Compose services. Open http://localhost after startup.
git clone -b main https://github.com/EpicStaff/EpicStaff.git && cd EpicStaff && cp src/.env.example src/.env && savefiles="$HOME/savefiles" && sed -i "s|CREW_SAVEFILES_PATH=/c/savefiles|CREW_SAVEFILES_PATH=$savefiles|" src/.env && sed -i "s|^DJANGO_SECRET_KEY=.*|DJANGO_SECRET_KEY=$(openssl rand -base64 48 | tr -d '=+/')|" src/.env && docker volume create sandbox_venvs && docker volume create crew_pgdata && docker volume create media_data && docker network create mcp-network && cd src && docker compose up --buildThe README also provides a Windows PowerShell command. DJANGO_SECRET_KEY is required; changing it signs out every user. The README says savefiles is deprecated and will be removed.
How do you use this agent?
After the services start, open http://localhost and build a flow in the visual editor. Choose model and embedding providers, configure node logic or Python code, and set up knowledge collections, memory, or tools as needed. External systems can trigger a configured flow by sending an HTTP POST to its webhook. Inspect node state messages and logs in the interface. The README does not provide a webhook URL or request example.
What are this agent's strengths and limitations?
- Combines a node-based editor with a Django backend, allowing visual orchestration and custom Python execution in nodes.
- The README names OpenAI, Anthropic, and custom local LLM and embedding models as provider options.
- Documents MCP/Python integrations, HTTP POST webhook triggers, and node-level execution messages and logs.
- Supports cross-session agent memory stored using Redis and PostgreSQL with pgvector.
- Deployment requires Git, Docker, configuration, a signing key, multiple Docker volumes, and a Docker network.
- The README does not state software pricing, model-service costs, or the exact provider credential setup.
- The README does not give the actual webhook URL, request format, or failure retry behavior.
- The README marks
savefilesas deprecated and notes that Linux directory ownership can affect sandbox writes.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| EpicStaff Agent Workflow Platform This agent | 57 · Major gaps | Self-hosted service | ★ 359 | 10d ago | Python | — |
| ByteChef | 53 · Major gaps | Self-hosted serviceFree + model costs | ★ 1k | today | Java | OpenAI API · Claude API |
| AGNT Agent OS | 52 · Major gaps | Desktop appFree + model costs | ★ 554 | today | JavaScript | Codex · Claude Code · OpenAI API · Claude API |
| Kronova Asset Intelligence Platform | 30 · Major gaps | Web appFreemium | ★ 252 | 26d ago | TypeScript | — |
How does FollowAgents rate this agent?
Why each dimension lost points
The README describes per-agent permissions, self-hosting, human review, and a session ledger; the security policy specifies reporting channels and research boundaries, CI documents image signing and SBOM steps, and the Redis tests show result and warning payloads. The supplied material does not detail the permission model, sensitive-data protections, pre-execution confirmation, or rollback. Custom Python, MCP, and webhook support can affect external systems, so these areas receive limited scores.
The README, setup commands, and security policy provide deployment and update guidance, but the README marks savefiles as deprecated while setup still uses it, and its env.yaml source-of-truth guidance differs from the default example-file copy. The test file asserts Redis result and error payload fields. Docker provides a dependency path, but the supplied material gives limited evidence about failure handling or service availability.
The intended users and scenarios are specific: operations teams, engineers, and auditors, with visual flows, Python, MCP, RAG, webhooks, multi-agent workflows, and self-hosted deployment. The capability set is broad, but permission boundaries, security limits, and suitability constraints are not clearly defined. Webhook triggering is described, while authorization and trigger-control details are thin.
The README is organized around setup, features, release verification, and contribution, and includes Windows, macOS, Linux, and Podman guidance. The security policy clearly states reporting routes, supported versions, and that there is no bounty. The PolyForm Perimeter license text is explicit, but metadata is NOASSERTION and the license includes a competition restriction that users should review. Release verification is detailed; named ownership and maintenance responsibility are mostly implicit in the security contact and project documents. The savefiles deprecation is a useful limitation disclosure.
Visual flows, persistent memory, state management, integrations, and node logs can support operations automation and review, giving the product clear workflow value. Deployment requires Docker, databases, Redis, and self-hosted operations; custom code and integrations add integration, security-review, and maintenance costs. The materials do not quantify benefits or resource costs.
The README's deployment and release-verification instructions, SECURITY.md's support scope, and the Redis emitter tests provide some cross-source support. Many feature and security capabilities remain README assertions, while the tests cover only one emitter component. The supplied documents do not consistently distinguish product claims from demonstrated implementation, so full marks are not justified.
- License metadata is NOASSERTION. The supplied PolyForm Perimeter 1.0.0 text includes a competition restriction that may affect use in competing products; review the terms before use.
- The quick-start still uses the savefiles path that the README marks as deprecated. Confirm current storage configuration and file-ownership guidance before deployment.
- The materials describe custom Python, MCP, webhooks, and external-system integrations, but provide limited detail on execution permissions, sensitive-data protections, and rollback. Review the actual deployment and flows before production use.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.3.2 Release v1.3.2
-
v1.3.1 Release v1.3.1
Release notes excerpt
Security release. Fixes [GHSA-8j32-5vj5-pqvr](https://github.com/EpicStaff/EpicStaff/security/advisories/GHSA-8j32-5vj5-pqvr): cross-organization access to knowledge documents through the document download and copy endpoints. All deployments running 1.2.0–1.3.0 should upgrade. Fixes are not backported to older versions (see SECURITY.md). After upgrading, run the check in the advisory for copies made before the fix. Reported by @hackchang. Thank you.View on GitHub ↗ -
v1.3.0 Release v1.3.0