Going open source.
On purpose. In order.
We are publishing Nomos in layers. The crypto, the policy engine, the SDK, and the MCP server are already on npm — anyone can audit how a decision gets made. The control-plane and dashboard source go public with 1.0 under Apache-2.0. Until then, here is exactly what is open, what is coming, and when.
13 packages on npm.
Every cryptographic primitive, the policy evaluator, the capability mint, and the SDK that agents call. If a decision feels wrong, you can run the same engine offline and prove it.
- @auto-nomos/corePDP decide() engine100% covon npm
- @auto-nomos/cedarCedar policy evaluator100% covon npm
- @auto-nomos/ucanUCAN delegation chains100% covon npm
- @auto-nomos/cryptoDID + Ed25519 signingon npm
- @auto-nomos/shared-typesZod schemason npm
- @auto-nomos/sdkTypeScript SDKon npm
- @auto-nomos/mcp-serverMCP-protocol serveron npm
- @auto-nomos/adaptersYAML connector specson npm
- @auto-nomos/schema-packsapiCall validatorson npm
- @auto-nomos/policy-builderVisual editor (React Flow)on npm
- @auto-nomos/audit-verifyChain verify CLIon npm
- @auto-nomos/clinomos CLIon npm
- @auto-nomos/ucan-clinomos-ucan CLIon npm
- @auto-nomos/control-planeHono + tRPC serversoon
- @auto-nomos/dashboardNext.js operator UIsoon
Three milestones.
One Apache-2.0 flip.
- v0.0.x → v0.1.xMay 2026
Foundation packages shipped under @auto-nomos/* on npm. PDP, Cedar, UCAN, crypto, SDK, MCP server, adapters, schema-packs all public.
- v0.2 (next)Targeting Q3 2026
Self-host helm chart. Bring-your-own Ed25519 root signing key. First-party Docker images for control-plane + PDP.
- v1.0Targeting Q4 2026
Control-plane + dashboard source open under Apache-2.0. CONTRIBUTING.md, RFC process, code of conduct, governance doc. Public roadmap on GitHub Projects.
Why not flip today?
Three reasons. The control-plane still carries a few customer-specific feature flags we’d rather extract before public review. The audit-root signing flow needs the bring-your-own-key path before self-hosters can run it without trusting us. And the first sweep of a public repo’s CONTRIBUTING is something we want to do once, not twice.
We’re moving fast. The npm-published packages are battle-tested in production today — those are the parts most worth reading first. When the rest flips, you’ll already know the engine that drives it.