// the take
OpenBSP is a self-hostable, multi-tenant backend for WhatsApp and Instagram Business messaging, built on Supabase (Postgres + Deno Edge Functions) with PostgREST exposing every table as a REST endpoint. It's aimed at developers or small BSPs who want to run their own messaging platform with pluggable AI agents instead of paying for a hosted Twilio-style service.
Using PostgREST as the API layer is a genuinely good call: every table is instantly a REST/Supabase-SDK endpoint, so there's no hand-rolled CRUD layer to maintain. The agent integration is deliberately decoupled — it talks to external agents over standard chat-completions/responses protocols rather than baking in a specific framework, so you're not locked into whatever the project's own agent logic does. Channel coverage is broad and practical: official WhatsApp Cloud API, Instagram, Slack (both per-user and bot-wide installs with correct DM privacy semantics), plus an unofficial WhatsApp Web bridge for people who don't want to go through Meta's business verification. The MCP server is a nice touch — you can drive WhatsApp conversations straight from Claude Code or Desktop with scoped API keys.
Business logic lives heavily in Postgres triggers and RLS policies, and the migration history shows this has been fragile — there are multiple separate 'fix RLS infinite recursion' migrations and several full reworks of the contacts schema, which suggests the permission model has needed repeated firefighting rather than being solid from the start. 'Self-hostable' really means 'runs on your own Supabase project' — the architecture is tightly coupled to Supabase-specific primitives (Edge Functions, PostgREST, Supabase Auth), so hosting it on vanilla Postgres + any other runtime would be substantial rework. The WhatsApp Web bridge is explicitly a single-replica service by design (one WebSocket session per number) with no horizontal scaling path, and the project itself flags real ban risk and no template/business features on that channel. There's also no cross-service contact identity by design — if you need to know that the same person is messaging via WhatsApp and Instagram, you have to build that de-duplication yourself on top.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →