PilotDeck is an open-source platform for running AI agents, from Tsinghua’s THUNLP, ModelBest, OpenBMB and AI9Stars. Version 2.0 was announced on 15 October 2026 under the AGPL-3.0 license. Its cost study is run by the developer (70.6 at $3.15 against 69.1 at $18.36), and we found no independent review or reproduction.
The short answer
- What it is: “An open-source agent operating system designed around the concept of ‘WorkSpace’”, with web, CLI and IM front ends, native MCP support, and hooks, skills and custom memory providers via plugin.
- Distinguishing features: memory that users can see, edit and delete inside a WorkSpace, and routing of hard tasks to flagship models and simple ones to lighter models.
- Dates: open-sourced 28 May 2026; “PilotDeck 2.0 is here” on 15 October 2026. Releases are date-tagged (latest seen v2026.10.17).
- License: GNU AGPL v3.0.
- Running it: Node.js 22.13.0 or later and below 23; install by script, pnpm or Docker; default ports 3001 and 5173.
- Providers: OpenAI, Anthropic, Google Gemini, DeepSeek, Qwen, Kimi, MiniMax, other OpenAI-compatible endpoints and local Ollama.
What does “visible” memory mean?
The README says memory generation, extraction, storage and retrieval are “visible end-to-end.” Users can edit and delete entries and pin critical decisions. A “Dream Mode” consolidates memory during idle windows with “one-click rollback.” Memory is scoped per WorkSpace.
The project compares itself with “black-box” agents without naming any product or giving evidence.
How does routing between models work?
The README says task difficulty is auto-detected. Complex calls go to flagship models and simple ones to lighter models. It contains no routing configuration; its YAML covers only providers, keys and model choice.
It publishes a social-media case study with no method. Opus 4.5 as main model with Sonnet 4.5 as sub-agent cost $2.83 against $12.58 for Opus 4.5 alone. The README says “~70% cost savings.” By our arithmetic, 1 minus 2.83 / 12.58 is about 77%, so the README’s own figures do not match its headline, and its stated multipliers do not match the cost ratios either.
What does the developer’s cost study show?
| Setup (seven complex tasks) | Score | Cost |
|---|---|---|
| MiniMax-M2.7 alone | 37.1 | $1.90 |
| Claude Sonnet 4.6 alone | 69.1 | $18.36 |
| Sonnet 4.6 as main + MiniMax-M2.7 as sub-agent | 70.6 | $3.15 |
The headline reads “1/6 the cost while beating frontier models on hard tasks.” Our arithmetic: 3.15 / 18.36 = 0.17, close to one sixth. The lead is 1.5 points (70.6 versus 69.1), with no variance or repeat runs shown.
So the useful reading is cost, not quality. The mixed setup scored about the same as Sonnet alone at roughly a sixth of the price. A 1.5-point lead on seven tasks is too small to call a win.
The tasks are described as seven complex ones: a multilingual podcast push, multi-source data reports, a domain literature review, codebase architecture docs and others. Only four are named.
The study gives no scoring method or scale, no named runner (only “the research team”), no tool or build versions and no stated caveats. These are developer numbers and should not be transferred to other models.
What does AGPL-3.0 require?
- Section 13: if you modify it and users interact with it over a network, you must “prominently offer” them the source of your version.
- Section 5(c): derivative works go under the same license (“You must license the entire work, as a whole, under this License”).
- Section 15: “There is no warranty for the program, to the extent permitted by applicable law.”
This is not legal advice; commercial use needs legal review. Running the platform and models is not necessarily free.
How strong is the isolation and security?
The README says each WorkSpace has its own file system, memory store and skill set, “completely isolating files, memory and skills per project,” and that “A’s memory never reaches B.” The README does not explain the mechanism, or say whether MCP servers, credentials and API keys are isolated.
The repository has no security section, threat model or audit. Release notes mention three fixes:
- symlink traversal and deny rules (v2026.10.10);
- keeping auth tokens out of WebSocket logs (v2026.10.09);
- project file API root checks (v2026.10.16).
Isolation should not be read as a security certificate.
Who is this for?
- Good fit: individuals and teams who want to see and edit what an agent remembers, and who can self-host on Node.js.
- Be careful: companies planning to modify and serve it to users, because AGPL-3.0 section 13 applies.
- Wait: anyone who needs a documented security model. None is published.
What should you do next?
- Read the AGPL-3.0 license file before any modified or commercial use.
- Run your own tasks to test the routing savings, rather than relying on the developer’s numbers.
- Check the releases page for security-related fixes before you deploy.
Questions and answers
Does PilotDeck cut costs six-fold?
That is the developer’s headline. In its own seven-task study the ratio was 0.17, with a 1.5-point score lead and no repeat runs.
What license does it use?
AGPL-3.0, which requires offering modified source to users who interact with it over a network.
Is its isolation guaranteed?
No. The README describes per-WorkSpace isolation but publishes no mechanism details or audit.
Which models can it use?
OpenAI, Anthropic, Google Gemini, DeepSeek, Qwen, Kimi, MiniMax, other OpenAI-compatible endpoints and local Ollama.
What do I need to run it?
Node.js 22.13.0 or later and below 23. Install by script, pnpm or Docker; the default ports are 3001 and 5173.
Terms in plain language
- WorkSpace: PilotDeck’s project container, with its own files, memory and skills.
- Sub-agent: a helper model that handles part of a task for the main model.
- MCP: a standard way for agents to connect to outside tools.
- Routing: sending each task to a stronger or lighter model.
- AGPL: a copyleft license that applies even when users reach the software only over a network.
Sources
Facts last checked against the linked pages on 18 October 2026. The cost study is the developer’s, not an independent test.
