M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
D

DeskcommCRM

Community
Open-source AI sales OS: a self-hosted CRM with native AI agents and WhatsApp.
How to install ↓ Compare GitHub source repository ↗
Category
Other #131 of 230
Stars
★ 4.7k Very popular
Transport
stdio (local process)
Runtime
Docker · Node.js 22
Credentials
API key / credential required
License
MIT
Last commit
52FMRS · D

DeskcommCRM is an MIT-licensed, self-hosted open-source CRM whose core proposition is running AI agents on WhatsApp and exposing the whole CRM to agents over MCP, backed by multi-tenant RLS, RBAC, audit logging and LGPD features. It suits teams willing to operate their own VPS and Supabase project, and is a poor fit for users who want a hosted service, an SLA, or zero-ops setup. The main risks are self-hosting responsibility, potential WhatsApp account bans from the non-official integration, and automations silently idling when the cron is missing; the docs provide an installer, health check and restore script to cope with these. As an MCP server, the repository states its MCP capability exists and is internal, with a public MCP still on the roadmap, so a concrete tool list is not supported by the evidence.

Strongest · Documentation 13/20 Weakest · Reliability 7/20

Reliability
7/20
Security and permissions
9/20
Maintenance
13/20
Documentation
13/20
Setup experience
10/20
Why each score
Reliability 7/20
This is a static review of repository metadata and README only — nothing was executed, and the SERVER MANIFEST is marked [not cached]. The README claims a CI badge, 48 of 49 Playwright specs, an RLS isolation invariant test, and three Docker image build gates, and it even gives a verifiable command (gh api on branch protection required status checks) rather than just asserting green checks, which is a stronger signal than a badge alone. Two things cap this score. First, the README itself places a public MCP interface in the Roadmap "Next" section; only an internal MCP server is claimed as shipped, and this repository root exposes no MCP entry point, no tool inventory, and no init/tool-list handshake evidence. Second, the README openly states that e2e does not cover the P0 vps-fresh-onboarding journey, and that migrations 0001-0009 and 0013 are `SELECT 1;` stubs so the real schema lives only in baseline.sql — meaning the migration chain cannot bootstrap from zero. With no execution evidence the static calibration caps reliability at 12, and because the MCP-specific key paths (clean startup, init handshake, declared tools matching real behavior) and error/dependency controllability have essentially no source evidence, the score is pushed well below that cap. Score: 7.
Security and permissions 9/20
No red lines triggered: no malware, no credential theft, no covert exfiltration, no unconfirmed irreversible delete/pay/deploy/remote-command defaults, no fabricated maintainer identity, and no real tokens or secrets embedded in install examples. Positive signals actually present in the source: multi-tenant with RLS on every tenant-aware table plus a dedicated isolation invariant test that creates two orgs and proves org A sees zero rows of org B (with a control assertion so an empty table cannot pass falsely); server-side RBAC; append-only audit log; LGPD anonymization preferred over deletion; Sentry telemetry is opt-in at install, explicitly scrubs CPF/phone/e-mail, strips sensitive headers, redacts webhook/invite tokens from URLs, disables performance tracing and session replay on the community path, and can be turned off with SENTRY_DSN=off; a private vulnerability reporting channel instead of public issues; MIT license with the self-hoster named as data controller. Deductions: the MCP server source is not present at the repository root, so tool argument validation, scope enforcement, confirmation of dangerous operations, and external network egress boundaries are entirely unverifiable; the headline install path is a remote `curl ... | bash` pipeline (a read-first alternative is offered, which mitigates but does not remove the trust concentration); and the README is untrusted evidence, so its security claims cannot be cross-checked against committed code in this snapshot. Score: 9.
Maintenance 13/20
MIT license, an actively maintained CHANGELOG, multi-language READMEs, and a real governance set (VISION, ARCHITECTURE, CONTRIBUTING, CLAUDE.md, CODE_OF_CONDUCT, SECURITY.md, docs/index.md with a precedence rule). It declares branch protection with required status checks and — unusually — tells reviewers how to verify that claim themselves via `gh api .../branches/main/protection` instead of trusting a badge. 869 stars, 76 open issues, not archived, and a documented update/rollback path (update.sh, restore.sh, "update now" button with automatic image rollback written back into .env). Deductions: the snapshot contains no commit timeline, no release/tag list, and no issue-response latency evidence, so "sustained" cannot be confirmed; the README admits there is no SLA and support is community as-is; the external-facing MCP capability is still roadmap, so ecosystem stability is unproven; the README self-admits internal doc inconsistencies (its own "measure, don't trust this list" note about the number of required checks). Score: 13.
Documentation 13/20
Documentation is one of the project's strongest dimensions: layered from README to docs/SETUP.md (full integration tutorial), docs/ATUALIZANDO.md (plain-language updating), runbooks (waha-hostgator, deploy), PRDs and specs, CLAUDE.md conventions, plus a white-label guide for reselling. It covers install, update, rollback, backup, password/MFA reset, healthcheck, and production sizing, and it names verifiable surfaces (/api/v1/health, /api/v1/webhooks/in/<token>). Limitations are disclosed honestly and specifically: free Supabase has no automatic backups, e2e does not prove fresh-VPS onboarding, migration chain is stubbed, failed updates auto-revert and persist that to .env, and non-interactive installs leave telemetry off. Deductions: for this review the MCP-specific documentation is thin to absent — no MCP server description at the root, no tool parameters, no auth flow, no rate/cost limits, and no MCP troubleshooting; "MCP público" is a one-line roadmap entry; cost guidance is limited to a generic per-org AI spend ceiling with no worked examples. Score: 13.
Setup experience 10/20
The described install path is unusually thorough: on a VPS, `git clone` + `bash hostgator-setup-kit/install.sh`, claimed idempotent and resumable, generating secrets, applying baseline.sql, creating the first admin, provisioning HTTPS, and even able to create the Supabase project from a SUPABASE_ACCESS_TOKEN. There is a non-interactive mode (.env.hostgator.example + --yes), explicit handling for VPS hosts that already run their own reverse proxy (Hostinger/Coolify/Dokploy/CapRover), both a UI and terminal update path, and a full operations script set (backup, restore, healthcheck, reset-password, reset-mfa). It clearly separates "just use it" from "hack on the code". Static calibration caps setup at 15 without execution evidence, and the deeper problem is fit-for-purpose: to reach a working MCP connection there is no mainstream MCP client configuration example anywhere (no Claude Desktop, Cursor, or VS Code snippet), no MCP endpoint URL, and no MCP startup command in this repository. Prerequisites are also heavy (own VPS with ~4 GB RAM, a domain A record, a Supabase account, an AI provider key, a WhatsApp number), and the headline banner is a remote pipe-to-bash script that a cautious operator must read first. Score: 10.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkConnects to a database

Best for

  • Small and mid-sized businesses that sell on WhatsApp and are willing to maintain their own VPS
  • Teams that need multi-tenant isolation and data sovereignty
  • Operators comfortable configuring Supabase, WAHA and an AI provider following the docs
  • Service businesses (clinics, real estate, e-commerce, infoproducts) that need audit, RBAC and LGPD features

Not for

  • Non-technical users who expect a turnkey product without provisioning a server and a Supabase project
  • Scenarios requiring an official SLA or vendor-hosted support (the project is community-run and as-is)
  • Teams unwilling to configure third-party services (Supabase, AI provider, WAHA, Upstash, Resend and others)
  • Users who need fully automatic updates (updates are triggered by a click or by running the update script)

Required permissions

  • Root or equivalent access on a VPS (Docker, cron, ports 80/443)
  • Supabase project database and auth credentials (4 credentials plus the Session pooler connection string)
  • An API key from an AI provider (OpenRouter, Anthropic or OpenAI)
  • A WhatsApp number connected by QR code, or credentials for the official Meta Cloud API channel
  • Optional: Upstash Redis, Sentry DSN, Resend, and Nuvemshop integration credentials

Risks and side effects

  • Self-hosting makes you the data controller for the instance, carrying LGPD compliance, backup and maintenance duties
  • If the cron (event-log-drain) is not installed and running, automations are created but never execute
  • Connecting WhatsApp through a non-official engine (WAHA) carries a risk of account ban, mitigated by throttling and jitter
  • The Supabase free plan does not back up automatically, so you must schedule backup.sh yourself
  • Updates only target published release tags; reverting to an older version requires the explicit --force flag
  • Optional Sentry telemetry sends error reports, with CPF, phone and email scrubbed, and can be turned off with SENTRY_DSN=off

Setup

Before you start

Runtime：Docker · Node.js 22

SUPABASE_ACCESS_TOKEN optionalsecret Optional: lets the installer auto-create the Supabase project; from your supabase.com account.
SENTRY_DSN optionalsecret Optional telemetry; the installer asks, stays off if unset, set 'off' to disable.

Self-host installation (the path for users, not developers): on a VPS with Docker, run git clone https://github.com/melgarafael/DeskcommCRM.git, enter the directory and run bash hostgator-setup-kit/install.sh. The installer asks only for what is yours (domain, Supabase credentials, AI provider key, admin password), validates each answer, generates technical secrets, creates the Postgres extensions and applies supabase/baseline.sql, creates the first admin, brings the whole stack up with automatic HTTPS, and installs the automations cron plus the update agent. Non-interactive mode: copy .env.hostgator.example to .env, fill it in, and run bash hostgator-setup-kit/install.sh --yes. If your VPS already ships its own reverse proxy (Hostinger, Coolify, Dokploy, CapRover, etc.), the installer detects it and publishes the CRM through it instead. After install, open https://<your-domain>, log in with the admin account, and scan the QR code with your WhatsApp during onboarding. For local development you need Node 22, pnpm, a Supabase project and optionally Docker for WAHA, and you must apply baseline.sql manually; see docs/SETUP.md.

Check that it works

The README documents MCP capability (an internal MCP server; a public MCP is on the roadmap), but no tools or client config are recorded, so no concrete verification step can be cited; after install, confirm the server is running via /api/v1/health.

Troubleshooting

  1. If the app is down or misbehaving, run bash hostgator-setup-kit/healthcheck.sh and read its output
  2. If automations never fire, check that install.sh/update.sh installed the every-minute event-log-drain cron
  3. If the baseline fails with type public.vector does not exist, create the vector, citext and pg_trgm extensions first
  4. Already exists / multiple primary keys noise during database updates is expected; look for unexpected warnings instead
  5. To roll back, run bash hostgator-setup-kit/restore.sh against your backup
  6. A UI message saying automatic updates are unavailable means the update agent is not running; use update.sh in the terminal
  7. On older installs, run update.sh twice the first time so the update agent gets installed
  8. When reporting issues, include /api/v1/health output; for security vulnerabilities use the private advisory flow, not a public issue

Things to try

Once connected, you can ask your AI assistant things like:

  • Use MCP to list all deals in my CRM pipeline

Use cases

Let AI agents greet, qualify and advance sales leads on WhatsApp inside a self-hosted CRM
Run multi-tenant customer service and sales for chat-based businesses, with per-tenant RAG knowledge
Capture leads from landing pages, forms or tools like Zapier/n8n through inbound webhooks straight into the funnel
Automate tagging, funnel movement, agent assignment and WhatsApp messages with QUANDO/SE/ENTÃO rules
Handle LGPD obligations such as data export, anonymization and audited consent
Serve as an open, self-hosted alternative to Kommo, Octadesk and Intercom with your data on your own server

Overview

DeskcommCRM is an open-source, self-hosted AI sales operating system (CRM) for businesses that sell via chat, positioned as an open alternative to Kommo, Octadesk and Intercom. It combines AI agents with a CRM: agents can run per-tenant RAG, execute skills during a conversation, move leads through the funnel, and hand off to a human when appropriate, with audited IA-to-human transitions. WhatsApp is supported two ways: QR-code connection through WAHA (multi-number, with anti-ban measures such as throttling, jitter and a sending time window) or the official Meta Cloud API channel with approved, synced templates. The product is multi-tenant by design, with RLS on every tenant-aware table and an isolation test enforced as a CI gate; it also includes LGPD capabilities (export, anonymization, audited consent), an append-only audit log, server-side RBAC, configurable per-pipeline vocabulary, Webhooks for inbound lead sources, and QUANDO/SE/ENTÃO automation rules. The repository describes an internal MCP server and a roadmap item to expose CRM capabilities publicly via MCP. The stack includes Next.js 16, TypeScript, Supabase (Postgres + Auth + Storage + Realtime), Tailwind + shadcn/ui, WAHA, the Vercel AI SDK (OpenRouter, Anthropic, OpenAI and more), Upstash Redis rate limiting and optional Sentry telemetry. Installation ships as the hostgator-setup-kit, which deploys app, WhatsApp and database with a single command, and supports UI- or script-driven updates with automatic backup.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →
Compare with other MCP servers

Source revision 5470425537e2 Data synced 2026-10-19 Read the FMRS scoring method