← Back to directory
D

DeskcommCRM

Community
Open-source AI sales OS: a self-hosted CRM with native AI agents and WhatsApp.
GitHub source repository ↗
★ 869 Stars Category · Other Very popular
52FMRS · D

DeskcommCRM is an MIT-licensed, self-hosted open-source CRM whose core proposition is running AI agents on WhatsApp and exposing the whole CRM to agents over MCP, backed by multi-tenant RLS, RBAC, audit logging and LGPD features. It suits teams willing to operate their own VPS and Supabase project, and is a poor fit for users who want a hosted service, an SLA, or zero-ops setup. The main risks are self-hosting responsibility, potential WhatsApp account bans from the non-official integration, and automations silently idling when the cron is missing; the docs provide an installer, health check and restore script to cope with these. As an MCP server, the repository states its MCP capability exists and is internal, with a public MCP still on the roadmap, so a concrete tool list is not supported by the evidence.

Reliability
7/20
Security and permissions
9/20
Maintenance
13/20
Documentation
13/20
Setup experience
10/20
Read the FMRS scoring method →

DeskcommCRM is an open-source, self-hosted AI sales operating system (CRM) for businesses that sell via chat, positioned as an open alternative to Kommo, Octadesk and Intercom. It combines AI agents with a CRM: agents can run per-tenant RAG, execute skills during a conversation, move leads through the funnel, and hand off to a human when appropriate, with audited IA-to-human transitions. WhatsApp is supported two ways: QR-code connection through WAHA (multi-number, with anti-ban measures such as throttling, jitter and a sending time window) or the official Meta Cloud API channel with approved, synced templates. The product is multi-tenant by design, with RLS on every tenant-aware table and an isolation test enforced as a CI gate; it also includes LGPD capabilities (export, anonymization, audited consent), an append-only audit log, server-side RBAC, configurable per-pipeline vocabulary, Webhooks for inbound lead sources, and QUANDO/SE/ENTÃO automation rules. The repository describes an internal MCP server and a roadmap item to expose CRM capabilities publicly via MCP. The stack includes Next.js 16, TypeScript, Supabase (Postgres + Auth + Storage + Realtime), Tailwind + shadcn/ui, WAHA, the Vercel AI SDK (OpenRouter, Anthropic, OpenAI and more), Upstash Redis rate limiting and optional Sentry telemetry. Installation ships as the hostgator-setup-kit, which deploys app, WhatsApp and database with a single command, and supports UI- or script-driven updates with automatic backup.

Setup

Self-host installation (the path for users, not developers): on a VPS with Docker, run git clone https://github.com/melgarafael/DeskcommCRM.git, enter the directory and run bash hostgator-setup-kit/install.sh. The installer asks only for what is yours (domain, Supabase credentials, AI provider key, admin password), validates each answer, generates technical secrets, creates the Postgres extensions and applies supabase/baseline.sql, creates the first admin, brings the whole stack up with automatic HTTPS, and installs the automations cron plus the update agent. Non-interactive mode: copy .env.hostgator.example to .env, fill it in, and run bash hostgator-setup-kit/install.sh --yes. If your VPS already ships its own reverse proxy (Hostinger, Coolify, Dokploy, CapRover, etc.), the installer detects it and publishes the CRM through it instead. After install, open https://<your-domain>, log in with the admin account, and scan the QR code with your WhatsApp during onboarding. For local development you need Node 22, pnpm, a Supabase project and optionally Docker for WAHA, and you must apply baseline.sql manually; see docs/SETUP.md.

Fit and risk

Best for

  • Small and mid-sized businesses that sell on WhatsApp and are willing to maintain their own VPS
  • Teams that need multi-tenant isolation and data sovereignty
  • Operators comfortable configuring Supabase, WAHA and an AI provider following the docs
  • Service businesses (clinics, real estate, e-commerce, infoproducts) that need audit, RBAC and LGPD features

Not for

  • Non-technical users who expect a turnkey product without provisioning a server and a Supabase project
  • Scenarios requiring an official SLA or vendor-hosted support (the project is community-run and as-is)
  • Teams unwilling to configure third-party services (Supabase, AI provider, WAHA, Upstash, Resend and others)
  • Users who need fully automatic updates (updates are triggered by a click or by running the update script)

Required permissions

  • Root or equivalent access on a VPS (Docker, cron, ports 80/443)
  • Supabase project database and auth credentials (4 credentials plus the Session pooler connection string)
  • An API key from an AI provider (OpenRouter, Anthropic or OpenAI)
  • A WhatsApp number connected by QR code, or credentials for the official Meta Cloud API channel
  • Optional: Upstash Redis, Sentry DSN, Resend, and Nuvemshop integration credentials

Risks and side effects

  • Self-hosting makes you the data controller for the instance, carrying LGPD compliance, backup and maintenance duties
  • If the cron (event-log-drain) is not installed and running, automations are created but never execute
  • Connecting WhatsApp through a non-official engine (WAHA) carries a risk of account ban, mitigated by throttling and jitter
  • The Supabase free plan does not back up automatically, so you must schedule backup.sh yourself
  • Updates only target published release tags; reverting to an older version requires the explicit --force flag
  • Optional Sentry telemetry sends error reports, with CPF, phone and email scrubbed, and can be turned off with SENTRY_DSN=off

Troubleshooting

  1. If the app is down or misbehaving, run bash hostgator-setup-kit/healthcheck.sh and read its output
  2. If automations never fire, check that install.sh/update.sh installed the every-minute event-log-drain cron
  3. If the baseline fails with type public.vector does not exist, create the vector, citext and pg_trgm extensions first
  4. Already exists / multiple primary keys noise during database updates is expected; look for unexpected warnings instead
  5. To roll back, run bash hostgator-setup-kit/restore.sh against your backup
  6. A UI message saying automatic updates are unavailable means the update agent is not running; use update.sh in the terminal
  7. On older installs, run update.sh twice the first time so the update agent gets installed
  8. When reporting issues, include /api/v1/health output; for security vulnerabilities use the private advisory flow, not a public issue

Use cases

Let AI agents greet, qualify and advance sales leads on WhatsApp inside a self-hosted CRM
Run multi-tenant customer service and sales for chat-based businesses, with per-tenant RAG knowledge
Capture leads from landing pages, forms or tools like Zapier/n8n through inbound webhooks straight into the funnel
Automate tagging, funnel movement, agent assignment and WhatsApp messages with QUANDO/SE/ENTÃO rules
Handle LGPD obligations such as data export, anonymization and audited consent
Serve as an open, self-hosted alternative to Kommo, Octadesk and Intercom with your data on your own server