Ship like you have an engineering team. Without the risk of one.
A crew of named AI agents plans, builds and reviews inside a sealed harbour with one opening. You stand in it, and you approve what ships.
Run missions and build your next idea with a full team of agents under your control: isolated, audited, and never able to merge on their own.
The judgement of a senior engineer, on call.
Carth does not just write code. It scopes the work, prices it, argues with itself and brings you a decision instead of a diff.
Your codebase, graphified.
Every repository is read into a graph of files, calls and owners. The crew navigates that graph instead of guessing, so an agent that has never seen your code knows where the payment logic lives.
The agents are fast because the walls are solid.
Every safeguard below is enforced by the software, not by a setting somebody has to remember. The trust page says exactly how, for the person who signs it off.
Running in production, today.
Businesses run their tech stack through Carth in production, and newer teams are building their first digital presence on it. Every deploy crossed a security gate with a name on it.
You write the first step and judge the last.
Everything in between belongs to the crew.
Not every mission is code.
Ask for a report, a deck or an analysis and the crew hands back a file, not a wall of chat. It lands on the mission, ready to open, and it is yours to download.
Claude
Codex
DeepSeek
Gemini
GLM
Grok
Kimi
Qwen
Billed by them, at their price. With your key every provider reviews, advises and analyses, and Claude and Codex also build and ship. Mix them on one mission: one model builds while another checks the work. Names and marks are the trademarks of their owners.
Half an hour, a real mission, your own repository.
Request a demoYour own harbour, in the zone you choose.
Carth is not a shared application with your rows in somebody else's database. Every customer gets their own container, with its own memory, its own workspace and its own keys. Nothing of yours is in the same process as anything of anyone else's.
Single project
One product, one cockpit.
Your container runs on shared hardware, dedicated to you and to nothing else. One repository set, one brain, one crew. This is where almost everybody starts, and plenty of companies never need to leave it.
Multi project
Several products, one set of gates.
Each project keeps its own repositories, brain and history. You switch between them in one cockpit, and the roles and approval gates you set carry across all of them, so governance is written once.
Dedicated and enterprise
Your own machine, or your own walls.
A whole server reserved for you in the region you name, or Carth installed inside your own infrastructure against your own model provider. On this shape we hold nothing at all: your code and your files stay on your machines, and the only thing that leaves is what a mission sends to the model provider you chose, on your own contract with them.
Choose your zone
Pick where your container and its backups live when you are set up. Your data stays in that region, and we tell you before it ever moves.
- EU WestParis
- EU CentralFrankfurt
- UKLondon
- North AmericaVirginia
- Your own accountEnterprise, any region you already use
EU zones are the default, and the only ones offered on Carth Secured. A zone is chosen once at onboarding. Moving an existing cockpit to another region is a scheduled migration, quoted per case.
Public prices, one application.
Start on the waiting list. We take on a small number of companies at a time so that onboarding is done properly, by a person.
Workspaces open a few at a time, because a person sets each one up with your repositories and your knowledge base. Tell us about your work, and we come back to you with a demo on your own code and a date.
Join the waiting listWhere most startups land, with room for the approvers.
- 4 seats, up to 5 projects
- Roles and per role gates
- 4 agents working at once
- 2 GB memory, 1 CPU core
- 20 GB workspace storage
A leadership team in one cockpit.
- 10 seats, unlimited projects
- 8 agents working at once
- 4 GB memory, 2 CPU cores
- 60 GB workspace storage
- Priority support
For code that cannot leave your own walls.
- Self hosted in your infrastructure
- Unlimited projects and seats
- Agents at once: as many as your machine holds
- Your own AI provider keys
- Council: several agents review the same plan independently, and you read where they disagree
- Onboarding included
Agents at once, and how to raise it
Your plan sets how many agents can be working at the same time. It does not cap how many missions you run, how many agents your crew has, or how much work you get through in a day. A fifth agent on Team does not fail, it queues, and it starts the moment a lane is free.
The limit exists because a working agent is a real process on a real machine, reading your repositories and running your tests. Each lane is about half a CPU core and a gigabyte of memory. We would rather sell you the hardware honestly than promise unlimited and give you a slow cockpit.
Three ways to raise it. Add lanes to the plan you are on, each with the CPU and memory it needs. Or move up a plan, which is usually better value once you need more than two extra lanes. Or take a dedicated server, where you set the number yourself and the only ceiling is the machine.
You can change the number yourself in the cockpit at any time, up to your plan's ceiling. There is no call to book and no wait.
Need more?
Every plan can grow when you do: more agent lanes, another project, extra storage, or a whole server reserved for you in your zone. Tell us what you need and it is added to your plan.
Model usage is never marked up: your provider bills you at their price, and we add nothing on top.
Prices are per company, in US dollars, billed monthly. Seats are people, not agents, and a seat can be reassigned when somebody leaves. Add ons are billed monthly alongside the plan and can be removed at the end of any month. Model usage runs against your own budget caps.
What every plan includes
The full agent crew on every plan, and email support. Each plan runs in its own container, with its own memory, CPU and workspace storage: Team has 2 GB of memory, 1 CPU core and 20 GB, adds roles and per role gates, budget caps and the audit trail, and is where most startups land; Business has 4 GB, 2 CPU cores and 60 GB, raises the team to ten seats, and adds priority support. Enterprise is self hosted inside your own infrastructure against your own provider keys, with dedicated resources on its own host and seats and storage to fit, onboarding included and a named contact for support. On Enterprise, model usage runs against your own provider account.
Every plan is backed up nightly, and the plan sets how many nights are kept: one on Team, three on Business, seven on Enterprise. Older archives are removed the same night the new one is written, so a workspace never holds more than its plan allows.
One signed token. Checked on your machine, never ours.
Buying Carth gets you a licence token. You paste it into your cockpit once, and your install verifies it by itself, offline. A self hosted install stops there and never calls us again.
The check happens on your machine
The token carries its own signature. Your install verifies it against a public key that shipped with the software, in under a millisecond, with no network and no clock agreement with us. Whether your licence is valid is never decided on our side, on any plan.
A hosted install renews outward
Run Carth hosted by us and it polls our licence authority on a schedule, presents the token it holds and receives a fresh short one. The call goes out; nothing of ours reaches in. Give an install no authority to call, which is how a self hosted one ships, and it makes no call at all: a perpetual token has nothing to renew, so it runs air gapped for as long as you keep it.
We hold no key to your work
Only the public half of the signing key is in the software. The private half never leaves the issuer, so nobody can mint a licence in your name, and the key we hold cannot open anything of yours.
What the token says, and what it does not
The token states your plan, your seats, your storage limits and the date it runs to. That is all it contains. It is signed as a whole, so a changed seat count or a moved date stops verifying rather than quietly passing.
A renewal call carries a usage report, and this is the whole of it: how many missions, runs and finished runs your install has recorded, what it spent in dollars over the last thirty days with the tokens in and out behind that figure, a line per model giving the model id, its runs, its tokens and its cost, how long the install has been up, which build it runs, whether the licence is active and when it ends, and which features are switched on. It cannot carry code, prompts, repository names, mission or task titles or file paths, and not even a count of your projects. Each field is named and built one at a time rather than filtered out of something larger, so anything Carth gains later is absent from the report until somebody puts it there on purpose. An install with no authority to call sends none of this, because it never calls.
Renewal is a new token, not a payment the software waits on. When a term ends, a grace window opens, five days unless we agree otherwise. Everyone keeps working exactly as before and the cockpit shows a dismissible banner counting the days. Only when that window closes without a renewal does it lock, and even then nothing is deleted: your data, missions and history are all still there, and a new token brings it all back as it was.
A self hosted licence can be perpetual. If your code cannot depend on a supplier staying in business, we issue a token with no expiry date. The software you have keeps working whatever happens to us, which is the only version of that promise worth anything.
If a token is ever missing or unreadable, the cockpit says so plainly and keeps running on its stored entitlement rather than locking you out over a configuration mistake.
Ask for something, and the crew builds it.
A suggestion becomes a mission in our own cockpit, through exactly the gates you use.
Every one is read by a person, and you do not have to be a customer to send one.
What happens to a suggestion
Carth is built by the same kind of crew you would be hiring it for. When a customer asks for something the product genuinely needs, our own crew plans it, builds it in a worktree and reviews it, and a person here approves it. The ones we accept land in the changelog with the release that carries them. The ones we turn down get an answer saying why, because a request that disappears is worse than a no.
Your code gets its own walls.
Not a shared database with your name in a column. A separate container, a separate encrypted volume, and access you can take back from any one person at any time.
- A private container for each company
- Encrypted storage volumes
- Your code is never used to train models
- Hosting in the EU or Canada, your choice
- Full deletion on request, backups included
Put a crew on your backlog this week.
Tell us what you would hand to your AI crew first. We read every entry and reply within two business days.
Join the waiting list