// the find
aipotheosis-labs/aci
ACI.dev is the open source tool-calling platform that hooks up 600+ tools into any agentic IDE or custom AI agent through direct function calling or a unified MCP server. The birthplace of VibeOps.
ACI.dev is a self-hostable backend that handles OAuth2/API-key auth and function schemas for 600+ external services, exposing them to AI agents either through a unified MCP server or a Python/TypeScript SDK. The target is anyone building agents that need to call real third-party APIs without implementing auth flows from scratch. It also markets itself as the infrastructure for 'VibeOps', which is just AI-assisted DevOps automation with a brand name attached.
Multi-tenant OAuth2 management is the genuinely hard part here, and they've built it properly — linked accounts, encrypted credential storage with HMAC key lookup, per-project scoping. That's real infrastructure work most teams would rather not own. The integration catalog is defined as JSON schemas per app (app.json + functions.json), which means adding or auditing a tool doesn't require touching core server code — a reasonable architecture decision for a contrib-heavy repo. The Alembic migration history shows disciplined schema evolution rather than ad-hoc ALTER TABLE abuse. Dynamic tool discovery is a real problem when you have 600+ tools and limited LLM context; having a search/filter layer before dumping schemas into the prompt is the right call.
With 600+ community-contributed integrations, quality variance is the obvious risk — there's no live API testing in CI, so stale or wrong function schemas will accumulate silently. The 'natural language permissions' feature is vague in the code: it's not clear whether this is enforced server-side before execution or just guidance injected into prompts, which makes it unreliable as a security boundary. Self-hosting requires coordinating Postgres, the FastAPI backend, and the Next.js frontend, and the documentation is thin on production hardening (connection pooling, secret rotation, what happens when OAuth tokens expire mid-agent-run). The MCP server is in a separate repo (aci-mcp), so you're tracking two release cycles if you use that path.