Download OpenWork

OpenWork Enterprise

AI your team wants.Control IT needs.

Give employees an approved way to work with AI. Company sign-in, permissions, and your choice of provider, without forcing everyone into the same agent.

Book a demoCompare with Claude Cowork
Backed byYCombinator
AI Providers
  • Anthropic
  • OpenAI
  • Amazon Bedrock
  • Google Vertex AI
  • OpenRouter
Who can use modelsMembers can't add their own keys.
Spend limitsThis month
$3,240Spent by 48 people. Keys stay on the server.
  • Everyone$31 avg of $50 / person
  • Engineering
  • Design team
    Warning sent at 90%. Pauses at 100%.

Company identity

SAML or OIDC single sign-on. Provision and deprovision access through SCIM, not another set of personal accounts.

Explicit permissions

Assign models, skills, and connections by role and team. Administration stays separate from everyday access.

Your approved providers

Configure providers centrally, including AWS Bedrock. Supported clients get a company model path, not personal keys.

Visibility into routed usage

Review model usage and spend through the gateway, without claiming visibility into tools that bypass it.

The shadow AI problem

The work is already happening.Give it an approved path.

Understand shadow AI

Without an approved path

  • Personal AI accounts
  • Unmanaged API keys
  • Company context sent to unapproved providers
  • No record of what was used

With OpenWork

  • Company sign-in with SSO and SCIM
  • Approved providers, including AWS Bedrock
  • Models, skills, and connections by team
  • Usage and spend for routed traffic

OpenWork governs model traffic routed through your gateway. It does not find or block personal accounts and tools that bypass it.

Agent choice, with clear boundaries

Keep the tools.Know what’s connected.

Explore the MCP gateway
  • OpenWorkDesktop appShared skills and connectionsReadyAI gateway modelsReady
  • OpenCodeWith the opencode-openwork pluginShared skills and connectionsReadyAI gateway modelsReady
  • Claude CodeThrough the MCP gatewayShared skills and connectionsReadyAI gateway modelsIn progress
  • CodexThrough the MCP gatewayShared skills and connectionsReadyAI gateway modelsIn progress
  • CursorThrough the MCP gatewayShared skills and connectionsReadyAI gateway modelsIn progress

AI gateway model integration for Claude Code, Codex, and Cursor is in progress. Connecting an MCP server alone does not route a client’s model traffic.

A boundary you can explain

Local files.A clear data boundary.

Read the privacy policy
Employee’s computerStays here
  • Files and folders
  • Workspace processing
AWS BedrockOr another approved provider
  • Prompts and responses
  • File content selected as context

On the employee’s computer

In the local desktop setup, files and the workspace stay on the computer. SSO configuration and model traffic leave it, not a copy of the workspace.

Through the model path

Prompts, responses, and file content selected as context travel through the gateway to your provider. Local-first does not mean a remote model never sees company data.

Other data flows

Product analytics, diagnostics, update checks, optional cloud workers, and connected services have their own flows. Review them with your deployment.

OpenWork vs Claude Cowork

Control, without the lock-in.

Compare all 25 capabilities

8 capabilities, checked against each vendor's own docs. Yes, Partial, or No for what ships today.

Claude Enterprise, Claude Desktop on 3P, and OpenWork compared by capability
CapabilityClaude EnterpriseClaude on 3POpenWork
Control and deployment
Any model, including open-weight and self-hostedNoPartial1Yes
Prompts stay in your cloud, vendor telemetry offNo2Yes3Yes
Share skills, plugins, and MCP servers with your teamYesPartial4Yes
SSO, SCIM, teams, and custom rolesYesPartial5Yes
Desktop policies and version controlYesYesYes6
Spend limits per team or personYesPartial7Yes
Usage analytics, OpenTelemetry, and audit logYesPartial8Partial9Planned
Self-host the control plane, with open source codeNoNoYes
Yes, of 852+5 partial7+1 partial
Price per person, per month$20 + usageNo seat feeFree, or from $10
  1. 1Claude models; others only through an Anthropic-compatible gateway you run. Source
  2. 2Inference runs on Anthropic's API. Source
  3. 3On Bedrock or Vertex. On Foundry, Anthropic processes conversations. Source
  4. 4Through a plugin marketplace you host in git or over HTTPS, plus MDM. Source
  5. 5Through the Enterprise Admin Console, hosted by Anthropic and provisioned on request. Source
  6. 6Model access, allowed versions, and agent permissions for commands, file edits, websites, and local skills and MCP servers. Source
  7. 7Per-user token limits; dollar budgets live in your cloud or gateway. Source
  8. 8OpenTelemetry export; the Compliance API only in Admin Console organizations, and no Analytics API. Source
  9. 9Usage analytics and an audit log with API and CSV export ship; OpenTelemetry export is next. Source

Planned links to the public roadmap and never counts as Yes. Sources, checked 2026-10-27:3P feature matrix3P overview3P plugins and MCPClaude Desktop on LinuxClaude in SlackClaude computer useClaude Enterprise pricingOpenWork roadmapOpenWork pricing

Deployment, on your terms

Start on the laptop.Choose the control plane.

macOS, Windows, and Linux

Local-first desktop

Start with a per-user install and connect the organization’s approved services.

Download OpenWork
OpenWork Cloud

Cloud management

Manage access, models, shared skills, and connections from OpenWork’s control plane.

Explore OpenWork Cloud
Your infrastructure

Private or self-hosted

A managed private deployment, or self-host it. Agree on operations and responsibility boundaries first.

Review deployment docs

Before you roll out.

Visit the Trust CenterRead the AI governance guideInspect the source
How does OpenWork help manage shadow AI?

OpenWork gives employees an approved path for AI work, with company sign-in, permissions, centrally selected providers, and visibility into routed model usage. It governs traffic configured to use the gateway; it does not automatically discover or block personal accounts and unsanctioned tools outside that path. Pair it with your approved-tool policy and endpoint or network controls where needed.

Which agents work with the AI gateway?

OpenWork and OpenCode with the opencode-openwork plugin can use your organization's AI gateway models. Claude Code, Codex, and Cursor can access shared skills and connections through the MCP gateway. AI gateway model integration for those clients is in progress. Connecting an MCP server alone does not route a client's model traffic.

Can we use AWS Bedrock and our identity provider?

OpenWork supports centrally configured providers including AWS Bedrock, SAML and OIDC single sign-on, and SCIM provisioning and deprovisioning. Confirm your provider configuration, identity setup, permissions, and deployment requirements with the team during an evaluation.

Does company data leave the employee's computer?

In the local desktop model-gateway setup, files and the workspace stay on the employee's computer. Prompts, responses, and file content included as model context travel through the gateway to the selected model provider. Local-first does not mean remote inference never sees company data. Product analytics, diagnostics, update checks, optional cloud workers, and connected services have separate data flows to review.

How would an enterprise rollout work?

Start with a per-user installation and a small pilot group. A proposed 30-day evaluation can cover SSO, provider access, data flows, permissions, and real employee workflows. Use the findings to plan a phased rollout to a few hundred seats if that fits your organization. Timeline, deployment scope, support, and commercial terms are agreed with the team, not guaranteed by this outline.

Can we self-host or use a managed deployment?

OpenWork offers a local-first desktop app, an organizational control plane, and self-hosted deployment options. Discuss managed private deployment requirements with the team, or review the source and deployment documentation. The right setup depends on your infrastructure, identity provider, approved model providers, and operational responsibilities.

A practical evaluation

Bring IT.Bring a real workflow.

  1. 01Start with a personInstall per user. Connect company sign-in and an approved provider, then test one workflow with a small pilot group.
  2. 02Plan a 30-day trialValidate permissions, review data flows, test the identity lifecycle, and collect feedback from employees and IT.
  3. 03Expand in phasesUse the pilot findings to plan a few hundred seats, with deployment, support, and scope agreed first.

An evaluation plan, not a deployment guarantee. Timeline, scope, support, and commercial terms are agreed with your team.

Book a demo

Tell us what you need