Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.
Business & Enterprise Operations Top 100 / #–ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol
Open-source project · MIT · self-hosted

Octop

A smarter, self-hosted AI assistant — multi-user, multi-agent. Publisher: TencentCloud.

Vendor page ↗+ CompareExport JSON
Trust profileas of 2026-10-26
Publisherlikely · Repository ownership or inferred publisher domain — repository or Hub account ownershiplikely
Complianceno evidence foundT5
SecurityNo CVE linked to this agent in the CVE registry — none linked in the products checked, not a findingnone
ProtocolsModel Context Protocol (MCP) probed, not foundAgent2Agent (A2A) probed, not foundAgentic Resource Discovery (ARD) probed, not found0 / 3
TracesNone found — nobody has published what this agent does under attacknone
Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe TencentCloud, not this agent specifically.

Traces — under attack, in defence, in incidents

none public · what a trace is

No public trace found. Nobody has published what Octop does when its inputs carry instructions it should not follow, when a tool asks for credentials, or when a task invites a destructive command. Defenders can't learn from what they can't see: run it in a sandbox before the pilot and keep the transcript, or ask the vendor to publish one.

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

none linked · the registry

No CVE in the registry names this agent or its listed product. That reads "none linked in the products checked", never as a finding: a product that is not on the registry's list, or a record that names it differently, is not seen. The vendor's own advisories remain the source of truth.

Compliance evidence

4 frameworks shown
–
SOC 2
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 27001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 42001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
CSA STAR
T5 Unknown
Nothing found in the sources checked.
Scope: — · CSA STAR Registry
ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 0 vendor-claimed⚠ 0 issues linkedas of 2026-10-26
– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.
☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85
2026-10-25
Octop release v1.0.3b1
GitHub releases · ### 新增 - 建用户时可以同时创建一个默认专家。权限按页面 Tab 拆开，也可以按组折叠 - 用户组可以限制技能包、知识库、连接器、模型、存储和专家谁能看见 - 技能包可以共享，并用文件树编辑。创建专家、团队等资源时可以选头像 - 表单和对话可以让 AI 润色。搜索增加 DeepSeek 与元宝，模型支持 OpenAI Responses API ### 修复 - 云端协同共享后可以直接对话。回复进行中不会被刷新冲掉，也不能删掉这场会话 - 手机截图写到专家自己的工作
Product update
2026-10-18
Octop release v1.0.2
GitHub releases · +1 outlet · ### 新增 - 两台 Octop 可以连起来用：通过云端协同使用对方的专家，能聊天，也能改对方工作区里的文件 - 专家可以组队。主持人负责分派任务和收尾总结，成员的回复会回到聊天，也会同步到即时通讯 - 新连接器：企查查、OpenAlex、语雀、Obsidian、Agent Mail，以及钉钉命令行（设备码登录后可查通讯录、日程和文档） - 可以用公司的 LDAP 账号登录。Telegram 机器人可以限定哪些用户能跟它说话 - 记忆可以手改「用户档案」和「强
Product update

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Business & Enterprise Operations score

62
general profile · sar-score-2.0 · unranked
Adoption / usage23 / 30
Trust & security16 / 25
Project / product health20 / 20
Ecosystem / interoperability2 / 15
Domain expertise / fit34 / 100
Governance / compliance evidenceunknown
Docs / transparency7 / 10

Raw component / maximum, then weighted by the general profile (adoption 25, trust 20, project 15, ecosystem 10, domain 10, governance 5, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (0)

Nothing found in the sources checked.

Unknowns to check (2)
Ask the vendor for SOC 2, ISO 27001, ISO 42001, CSA STAR evidence; none was found in the sources checked
Whether the agent exposes MCP or A2A endpoints; none were observed
Suggested restrictions for a pilot (2)
Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked.
No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

GitHubrepository signals, license
Hacker News, GDELT, vendor feedsnews and chatter
First seen2026-10-26
Recordres_71eded6ba99448b5
Open the full record (JSON) →