AutoGPT Platform

A single UI action exports a workflow as JSON, and a documented Import action restores it on a self-hosted instance, which counts as non-provider infrastructure. But restoring means standing up that instance first: cloning, generating env config and running Docker Compose by hand, since the docs say not to use the hosted one-command installer yet. That is one shortfall.

• Sharing and exporting agents
• Self-hosting installer
• Self-hosting getting started
• Graph export endpoint
• Agent upload (import) tab

The export covers one workflow graph with its sub-graphs. Credentials, secrets and webhook IDs are stripped. Otto/Expert configuration, memory (Graphiti and the business-understanding profile), execution history, schedules, presets and credentials have no export. Workspace files download one at a time, and the chat export is Markdown that skips tool-result messages.

• Export stripping (NodeModel.stripped_for_export)
• Chat export as Markdown
• Workspace file routes
• Expert routes (no export)
• Provider OAuth client settings

An exported graph runs on the self-hostable runtime. No licence check, update check or AutoGPT-run service is needed, and LaunchDarkly, Langfuse, Sentry and PostHog are off when their keys are empty. The PolyForm Shield grant is not stated to be perpetual or irrevocable, bars competing uses, and ends on an uncured violation after notice. Features gated by LaunchDarkly flags fall back to code defaults (for example, Graphiti memory is off) unless the owner forces them by env var. Provider-managed credentials must be replaced with the owner's own keys.

• autogpt_platform/LICENSE.md (PolyForm Shield 1.0.0)
• backend/.env.default
• Feature flag client (LaunchDarkly optional)
• Graphiti memory gating
• Self-hosting single container

On the cloud offering, workflow LLM blocks can use models from several vendors (Anthropic, OpenAI, Google, Meta, Mistral and others via hosted APIs), and Otto can use a Codex or Microsoft 365 Copilot connection. The cloud cannot use local models: the docs say Ollama is self-host only and that cloud AutoPilot routes through Anthropic/OpenRouter. Owners choose only a Balanced/Advanced tier. Voice, transcription and search embeddings are tied to specific OpenAI models.

• Ollama (self-hosting only)
• Copilot local LLM (self-hosting only)
• Copilot model routing
• Copilot config (TTS model, defaults)
• Search embeddings

Clause 8.2 of the Terms lets AutoGPT suspend or terminate access to the Platform at any time, and clause 4.2 lets it terminate registrations at any time. There is no post-termination export window, no shutdown plan and no owner-held copy of state by default.

• AutoGPT Platform Terms of Use

Agent state (graphs, executions, chats, Experts, memory in FalkorDB, profile) lives in provider-operated Postgres and FalkorDB. Apart from the graph JSON and Markdown chat exports, it can be read only through the hosted service. Credentials are encrypted with a server-side key the provider holds.

• Prisma schema
• Credential encryption with server ENCRYPTION_KEY
• Graphiti storage config

Otto's base system prompt is fetched at runtime from the provider's Langfuse prompt store; the code fallback is not necessarily what runs. The server-injected context blocks are removed before display, and compaction summaries are deliberately hidden from the card. The exact model is chosen per user by a provider LaunchDarkly routing flag, and owners see only a tier. Several behaviour switches are provider-side flags. Both shortfalls apply.

• Langfuse prompt fetch
• Compaction card hides summary
• Model routing flag
• Flag enum

The privacy policy collects a broad profile (interests, LinkedIn presence, location, usage). On retention it says only that data is not kept longer than needed, with details available by email, so retention is neither disclosed nor bounded. (The agent-used business-understanding profile is graded in M2.)

• AutoGPT Platform Privacy Policy (version 18 April 2025)

I found no paid or sponsored placement in the code. Onboarding recommendations sort provider-featured marketplace agents first. Otto's find_agent tool steers toward marketplace agents, and provider-chosen default models and managed credentials are auto-selected. None of this is covered by a binding no-steering commitment, and the featured ordering cannot be switched off.

• Onboarding recommendation ordering
• find_agent / agent_search tool text
• Integrations and credentials

Graph runs record inputs, outputs and trigger source (manual, schedule, webhook, sub-graph, copilot). Copilot block runs are recorded only as chat tool messages, with tool output truncated to about 100 KB. Admin impersonation acts under the user's ID and is logged only server-side, so staff actions are not distinguishable in the owner's record. Activity-event and cost-log writes swallow errors. Two or more shortfalls apply.

• Execution trigger sources
• Tool output truncation
• Admin impersonation logging
• Best-effort activity events

The execution and chat records carry no hash chain, signature or external anchor. The model the code calls an 'append-only' ActivityEvent has no enforcing trigger or permissions, and the chat-message rows can be updated in place.

• Prisma schema (ActivityEvent, executions)
• Chat message update functions

Execution and chat records are written by the backend, and no copilot tool deletes executions, graphs or chat history. However, tool outputs over about 80 KB are moved to workspace files, leaving only a preview in the chat, and the agent has a delete_workspace_file tool. That is one path to suppress part of the record. The protection is also undocumented.

• Copilot tool list incl. delete tools
• Large output offload to workspace

Source for the platform is public under PolyForm Shield, which allows modification for permitted, non-competing purposes. Owners have no way to tie the hosted cloud build to a commit. The production system prompt and flag configuration come from Langfuse and LaunchDarkly rather than the repository.

• autogpt_platform/LICENSE.md (PolyForm Shield 1.0.0)
• Repository root LICENSE
• Langfuse prompt fetch

Agents and Experts have no cryptographic or owner-rooted identity. They are database rows under a provider-issued account, and agent email (AgentMail) is a provider-managed credential.

• Expert model
• AgentMail provider config

Workflow graphs keep numbered versions, can be listed, and can be rolled back by setting the active version. Changes are not attributed: an Otto edit looks the same as a user edit. Expert soul and boundaries, settings, credentials and the business profile are overwritten with no history. The code notes 'no undo for boundaries'.

• Graph version routes
• update_expert (no undo)

Workflows are fully editable, and Expert 'soul' text (identity, voice, boundaries) can be edited. The base Otto prompt, however, comes from the provider's Langfuse store and cannot be replaced; soul text is layered beneath it. Built-in default skills are not downloadable or replaceable. (Locked protected soul rules are graded in M4.)

• Expert context layering
• PROTECTED_SOUL_RULES
• Skills routes

Graphiti memory, where the flag enables it, can be listed and forgotten but not edited directly. The CoPilotUnderstanding business profile (partly populated from a Tally form at signup) is injected into Otto's context but has no user view, edit or delete route; the clear function exists but is never called. Skills can be managed.

• Memory routes
• Business understanding
• Understanding populated from Tally
• AutoGPT pricing and feature comparison

Owners can connect any MCP server by URL with only SSRF checks and no provider review. Built-in tools and blocks can be excluded only inside a workflow's AutoPilot block. Plain chat has no setting to remove built-ins, and provider-disabled blocks cannot be re-enabled.

• MCP block
• AutoPilot block tool filters

Provider-imposed protections are all set by operator env vars or provider flags, and I found no owner setting to change any of them. These are the E2B sandbox, ClamAV scanning, the SSRF blocklist, per-user AutoMod moderation and the protected Expert soul rules. The daily/weekly spend caps can only be reset by buying credits.

• Copilot config (sandbox, caps)
• Settings (ClamAV, AutoMod)
• PROTECTED_SOUL_RULES

The provider can change Otto's prompt through Langfuse (production label, re-fetched at runtime) and the model through the LaunchDarkly routing flag. Saved graph model choices are rewritten on every server start. The changelog records retired models being auto-migrated. Only schedules can pin a workflow version; the runtime, prompt and Otto model cannot be pinned.

• Langfuse prompt fetch
• Startup model migration
• Changelog Jan 29 – Feb 11 2026 (auto-migrated models)
• Managing LLM models

Host-scoped credentials, deny-by-default Expert credentials, Expert weekly budgets and copilot spend caps exist. The contact dimension is missing: there are no recipient, sender or domain allow/deny lists. The agent can also change its own limits: Otto can grant and revoke Expert credentials, and can propose a zero (disabled) budget through the confirm flow.

• Expert credential grant tools
• raise_expert budget
• Host-scoped credentials

Workflow owners can put human-in-the-loop approval blocks anywhere in a graph. Sensitive-action review covers a fixed set of irreversible blocks and is off by default. The copilot approval gate applies only to interactive sessions behind a default-off flag, so scheduled, routine and AutoPilot-block turns bypass it. In auto mode an LLM supervisor decides what to ask about.

• Human-in-the-loop block
• Graph safe-mode defaults
• Copilot gate

Owners can stop a single execution, which cascades to child runs, and cancel a chat turn. There is no user-level stop-all. Schedules must be deleted separately, and Expert pause has no manual route.

• Stop execution route
• Expert pause scheduling
• Changelog Feb 11 – Feb 26 2026

Clause 7.2 of the Terms reserves the right to use submitted information 'on an unrestricted and free-of-charge basis'. Copilot prompts, responses and tool calls are traced to Langfuse, and backend PostHog events are sent with no user opt-out. Marketing relies on legitimate interest (opt-out). Terms change by continued use. Staff impersonation is disclosed only as a pricing-table row.

• AutoGPT Platform Terms of Use
• AutoGPT Platform Privacy Policy (version 18 April 2025)
• AutoGPT pricing and feature comparison
• Langfuse wrapper and OTEL traces
• Backend PostHog tracking

Settings → Integrations lists credentials and deletes them one by one; OAuth tokens are revoked upstream for some providers only (Notion and Todoist are not). Provider-created managed credentials (AgentMail, Ayrshare) cannot be deleted by the user. No binding terms limit provider use of stored credentials or require deleting copies after revocation.

• Credential delete and revoke
• Managed credentials
• Integrations and credentials

The product has no account-deletion feature in the UI or API. The privacy policy directs rights requests to email but gives no deletion scope, time limit, backup treatment or confirmation. A helper for pre-deletion cleanup exists in code but nothing calls it.

• AutoGPT Platform Privacy Policy (version 18 April 2025)
• Unused pre-deletion credential cleanup