Messengers
Grant access to named conversations, never an entire inbox by default.
- Available
WhatsApp - Coming soon
Telegram - Coming soon
iMessage - SMSComing soon
Open-source MCP control layer
Let AI act on your data. Not all of it.
Automata sits between AI clients, messengers, and databases. Give Claude, ChatGPT, or any MCP client access to only the chats and tables you choose, with every boundary enforced before a tool can read or write.
Free and MIT licensed · Your infrastructure · Strictly scoped
Automata control plane
AI clients
Claude
ChatGPT+Any MCP client
Strict permission gate
Token · tool · resource
Messengers
- AvailableWhatsApp
- SoonTelegram
- SooniMessage
- SMSSoon
Databases
- PostgreSQLAvailable
- MySQLSoon
- MongoDBSoon
One control layer
One MCP interface. Two kinds of sensitive data.
Connect AI to the tools where conversations and operational data already live. Automata presents a common MCP surface while keeping the permission model specific to each connector.
Databases
Expose only approved tables and separate read access from write access.
- PostgreSQLAvailable
- MySQLComing soon
- MongoDBComing soon
Permissions, not promises
Chat allowlists and table scopes are checked in the control layer before a connector tool can touch the underlying resource.
One token, one connection
Each MCP token is bound to a single messenger or database connection, with only the read and write tools you explicitly grant.
Free and open source
Inspect the enforcement path, run it on infrastructure you control, and extend the connector layer under the MIT license.
Token scope
WhatsApp chats
send_message · search_messages
- Read + write
Design team
WhatsApp group
- Read
Investor updates
WhatsApp group
- Blocked
Family
WhatsApp group
PostgreSQL tables
query · execute
- Read
public.orders
PostgreSQL table
- Read + write
public.inventory
PostgreSQL table
- Blocked
private.payroll
PostgreSQL table
Out-of-scope call refused
private.payroll · permission_denied
Strict enforcement
The boundary is part of the tool, not the prompt.
Automata does not ask the model to behave. It checks the token, requested action, chat allowlist, and table scope before a tool executes. Requests outside that boundary are refused without exposing the protected data.
- Allow specific chats and tables, not entire accounts
- Separate read tools from send and write tools
- Bind every connector token to exactly one connection
- Reject out-of-scope requests before data is accessed
- Revoke a token or permission at any time
Run it your way
Free, open source, and yours to inspect.
The control layer protecting your messages and data should not be a black box. Read the code, verify the checks, and deploy Automata wherever your security model requires.
automata-mcp — zsh
$git clone https://github.com/ju-li/automata-mcp
$cd automata-mcp && cp .env.example .env
$pnpm install && pnpm services:up
$pnpm dev
→Automata ready at http://localhost:3000
$
Self-hosted
Free, forever
Run the Nuxt control plane and PocketBase on your machine, VPS, or homelab. Add the WhatsApp services only when you need that connector.
- MIT licensed source
- Unlimited scoped connections
- Credentials stay on your infrastructure
Hosted
Invite only, for now
Use the same connector and permission model without operating the services yourself. Tell us which messengers and databases you need.
- Managed setup and updates
- The same granular scopes
- Direct access to the Automata team
Your AI. Your connections. Your rules.
Put a strict control layer between AI and the data that matters.
Start today with WhatsApp and PostgreSQL. Self-host Automata for free, inspect every permission check, and keep control of where it runs.