You have Claude Code in one terminal, a team chat bot in another, workflow diagrams in a third tab, and API keys pasted in a notes app you promised to delete. “Local-first AI” sounds great until you realize your actual workflow is still six SaaS dashboards and a prayer that nothing trained on your repo.
Ekko Studio (EKKOLearnAI/ekko-studio, formerly Hermes Studio) tries to collapse that stack. ~12k GitHub stars: a **local-first AI workspace** with multi-agent chat, visual workflows, coding-agent integrations (Claude Code, Codex, Cursor, and a dozen others), file browser, voice, channels (Telegram, Discord, Slack, Matrix, and more), and MCP hooks for automation. Ship it as a **desktop app**, **`npm install -g ekko-studio`**, or **Docker Compose** on a box you control.
What it actually does
Ekko Studio is the control plane; agents are the workers. Pick a runtime per chat or workflow node — built-in Ekko/Hermes agents, or external coding CLIs installed on the **same machine as the Studio backend**.
Highlights that matter for self-hosters:
- Multi-agent chat — streaming tool traces, session DB in local SQLite, group rooms with @mentions, usage and cost estimates per turn.
- Visual workflows — Vue Flow canvas with branches, loops, human approval gates, import/export, run history on the canvas.
- Coding agents — Agent Manager installs/updates supported CLIs; scoped vs global config; terminal and diff views in the UI.
- Workspace tools — file browser across local/Docker/SSH backends, web terminal, managed browser for agents (MCP), cron jobs, Kanban tied to Hermes.
- Channels — optional gateways to Telegram, Discord, Slack, WhatsApp, Feishu, etc. (credentials in your profile config, not a vendor cloud).
Default web port is 8648. Auth token is generated under ~/.hermes-web-ui (or HERMES_WEB_UI_HOME) — treat a public deployment like admin access to your agents and filesystem.
Why self-host Ekko Studio?
Conversations and files stay on your infrastructure. Sessions, uploads, provider configs, and workflow definitions live in directories you backup — not in a hosted “AI workspace” whose terms change quarterly.
One surface for many agents. Instead of granting a dozen SaaS tools access to the same repo, you run coding agents on a Canadian VPS or office server and point the team at one Studio URL behind VPN or SSO.
Automation with guardrails. Workflows can pause for human approval before a node runs destructive shell commands — closer to how you wish CI worked, but for ad-hoc agent tasks.
Channels without giving up the keys. Bridging Slack or Telegram to your own Studio means you choose what leaves the network; still requires hardening (tokens in .env, firewall, TLS).
What running it takes
npm (simplest lab): Node.js 23+, npm install -g ekko-studio, ekko-studio-web start, browse localhost:8648. Hermes Agent can be bundled (desktop/Docker) or installed alongside.
Docker Compose: upstream documents a single-container image with integrated Hermes (WEBUI_IMAGE=ekkoye8888/hermes-web-ui docker compose up -d in README — verify current image name on releases). Persist the data volume backing HERMES_WEB_UI_HOME.
Hardware: RAM scales with concurrent agent runs and model context; GPU optional unless you route to local inference. Coding agents need CPU for builds; browser MCP and file previews add overhead. A 4–8 GB VPS is a minimum for light solo use; production team setups want more headroom and strict network policy.
Security checklist: reverse proxy with TLS, strong auth, tight CORS_ORIGINS, do not expose port 8648 to the open internet without understanding that agents can execute tools on connected backends. Read upstream security docs before pointing channels at production repos.
Who it's for (and who should skip it)
Good fit: power users already running Claude Code/Codex locally, small dev teams wanting a private agent hub, homelabbers wiring Telegram bots to the same workspace as desktop chat, agencies experimenting with visual agent workflows on a Canadian VPS.
Maybe skip it: if you only need a single chat UI for one API key — Open WebUI is lighter. If you will not patch Node/Docker or lock down auth, hosted SaaS may beat operating an agent control plane. If policy forbids agents with shell access, this is the wrong category of tool entirely.
Hosting it in Canada
We deploy Docker on Canadian VPS when clients want agent workspaces in-country — TLS, VPN-only access, backups on the Studio data volume, and egress rules so provider API calls are a conscious choice, not a default leak.
Tell us how many agents and channels you plan to run if you want help sizing a self-hosted Ekko Studio box versus desktop-only setups. The interesting part is never npm install; it is who can reach port 8648 and what those agents are allowed to touch.
