UniclawEnterprise multi-tenant AI agent platform
Digital workers that think, remember and grow. Built on NestJS 11 and Prisma 7: 25 business modules covering the cognition loop, three-tier memory, a five-layer persona, skill evolution and multi-agent collaboration; 19 built-in tools ready to use; multi-channel access via WeCom, Feishu, DingTalk, web chat and API.
The cognition loop is four engines wired into a closed circuit: intent extraction → planning → assessment → reflection. Each step is an independently testable module, not one long prompt.
Not another chatbot shell — an agent runtime with a cognition loop and long-term memory.
What problem does it actually solve
Four core capabilities, mapped to four real business needs.
Replaces repetitive human effort: 7×24 responsive support, lead qualification, order follow-up and after-sales handling, with configurable capability boundaries and human-handoff policies.
A LangGraph-orchestrated cognition loop: intent recognition, tool selection, result reflection and self-correction, so long task chains stay under control.
Milvus-based vector memory and structured profiles coexist on two tracks, keeping context consistent across sessions.
The full stack deploys privately; models, data and memory stay inside the customer’s own network boundary.
Capabilities at a glance
- Four cognition engines: intent-extractor → plan-engine → assess-engine → reflect-engine
- Three-tier memory: session → episodic → semantic, with decay and context-overflow governance
- Five-layer persona: role, tone, boundaries, domain knowledge and behavioural policy injected in layers
- 19 built-in tools: web search, SQL queries, chart generation, code execution, email, knowledge retrieval and more
- Multi-agent collaboration: orchestrator, supervisor and a communication protocol
- Multi-channel access: WeCom (SCRM pull), Feishu (push API), DingTalk (push API), web chat (WebSocket)
Not a product that lives in slides
The numbers below come from the real code in the uniclaw-copit repository: modules, tables, endpoints and capability items.
Tech stack
Go deeper
Each subpage answers a specific kind of question — not the same content re-typeset.
Features
8 business domains, 41 concrete capabilities — each one backed by an implementation that exists in the code.
Cognition loop
modules/cognitiveA think–act–learn closed loop with four engines in their own lanes; long task chains stay under control.
- intent-extractor: extracts structured intents and key slots from user input
- plan-engine: expands an intent into an executable step sequence and decides which tools to call
- assess-engine: grades the quality of tool results and decides whether to start over
- reflect-engine: reflects at the end of a turn, self-corrects failure paths and writes back to memory
- Driven by a LangGraph state machine; every node state can be persisted and replayed
Three-tier memory
modules/memoryWhat is remembered is not chat history but layered knowledge of the user.
- session-storage: session-level short-term memory keeping the current conversation coherent
- episodic-storage: episodic memory recording the concrete events of what happened
- semantic-storage: semantic memory — long-term knowledge of what kind of user this is
- vector-search + milvus-client: vectorised retrieval with semantic-similarity recall
- memory-decay: a decay mechanism so stale information stops dominating the weights
- context-overflow: overflow governance; long sessions are compressed and trimmed automatically
- memory-sync-pipeline: an async memory pipeline that persists without blocking the conversation
Persona system
modules/personaRole, tone, boundaries, knowledge and policy in five separate layers — changing the persona never means changing code.
- Role layer: the agent’s positioning (support / sales / advisor / tutor)
- Tone layer: expression style and wording constraints
- Boundary layer: what it may answer and what must go to a human; crossing the line triggers handoff
- Knowledge layer: dedicated knowledge bases and domain material attached to the agent
- Policy layer: behavioural policy such as follow-up cadence, recommendation timing and closing tactics
Built-in tools
modules/tool/builtins19 out-of-the-box tools covering search, data, documents, communication and generation.
- Information: web-search, web-fetch, wikipedia, knowledge-search
- Data processing: sql-query, json-extract, text-process, calculator
- Generation: chart-generate, qrcode, code-exec, translate
- Time and geography: datetime, calendar, weather, map-search
- Communication and memory: email-send, memory-write, skill-search
Multi-channel access
modules/channelWherever the user is, the agent is.
- WeCom: integrated in SCRM pull mode, inside the WeCom ecosystem
- Feishu: push API proactive messaging
- DingTalk: push API proactive messaging
- Web chat: real-time bidirectional WebSocket communication
- realtime-module and webhook-module carry the long-connection and callback paths respectively
- Open API: business systems call directly to embed the agent in their own product
Multi-agent collaboration
modules/collaborationComplex tasks are split across specialised agents instead of one all-purpose prompt.
- agent-orchestrator: decomposes and dispatches tasks, managing execution order between agents
- supervisor: checks output quality and decides whether rework is needed
- communication-protocol: structured inter-agent communication
- collaboration-logger: the whole collaboration is recorded and replayable for troubleshooting
Proactive reach & evolution
modules/{outreach,evolution,skill}Not just waiting to be asked — it shows up when the moment is right.
- outreach: both event-driven and scheduled triggers
- Multi-channel routing picks the reach channel by user preference
- skill: reusable skills distilled from real conversations, sharpening with use
- evolution: policy and prompts keep improving from feedback
- research: a deep-research mode with multi-round retrieval and synthesis
Platform governance
modules/{auth,management,usage,audit}Everything a multi-tenant SaaS should have, and nothing missing.
- Multi-tenant isolation: tenants, roles and permissions managed in layers
- Usage metering: token consumption and tool calls counted per tenant
- Audit logs: key agent behaviour is traceable
- Health checks and debug modules for production troubleshooting
API contract
12 representative endpoints. What is listed here is the skeleton of the public contract; full definitions ship with the deployment.
/v1/chat/completionsThe main conversation entry point, with streaming responses and tool-call orchestration
/v1/realtimeWebSocket real-time bidirectional channel for web chat and long-lived connections
/v1/channels/wecom/callbackCallback entry point for WeCom SCRM pull mode
/v1/channels/feishu/eventFeishu event push reception and reply
/v1/channels/dingtalk/eventDingTalk event push reception and reply
/v1/tools/{name}/invokeTool invocation, constrained by authorization, quota and audit
/v1/memory/{userId}/semanticReads the semantic memory profile for troubleshooting and operations
/v1/persona/{id}/layersFive-layer persona configuration: role / tone / boundaries / knowledge / policy
/v1/workflows/{id}/runTriggers a composable multi-step business workflow
/v1/collaboration/orchestrateEntry point for multi-agent orchestration
/v1/usage/tokensToken consumption and tool-call counts per tenant
/v1/audit/logsAudit log of key agent behaviour
One real call
What an endpoint actually looks like says more than a list of endpoints.
01$ curl -X POST https://agent.zhenbei.tech/v1/chat/completions \02 -d '{"tenant":"acme","channel":"wecom","message":"Where is the batch from last week?"}'0304{ "intent": { "name": "order.track", "slots": { "batch": "last_week" } },05 "plan": ["memory.recall", "sql.query", "assess"],06 "tools": [{ "name": "sql-query", "ms": 84, "rows": 3 }],07 "reflect": { "rewritten": false, "memory_written": true },08 "reply": "The batch from last week arrived at the Shanghai warehouse on 9/18 — 240 units in total." }Contract discipline
An endpoint is a promise, not an exposure of implementation details. These three rules are ones we always keep.
Breaking changes go through a major version, announced one release cycle ahead. A shipped endpoint never changes semantics because of internal refactoring.
Error codes carry semantics instead of a blanket 500, so callers — including AI agents — can decide whether to retry or give up.
Structured data is returned by default instead of human-readable prose, so AI can read it directly — no human screenshotting and relaying.
Modules
5 groups, 19 code modules — all from the real directory structure of the uniclaw-copit repository.
uniclaw-server/src/modules/The agent’s brain: how it thinks, acts and corrects itself.
cognitiveFour cognition-loop engines: intent extraction, planning, assessment, reflection
src/modules/cognitive/servicesexecutionExecution layer: turns plans into concrete actions and collects the results
src/modules/executionllmModel abstraction: unified access to OpenAI / Anthropic / Google and other providers
src/modules/llmworkflowWorkflows: composable multi-step business processes
src/modules/workflowLetting the agent remember, and keep a consistent character.
memoryThree-tier memory: session / episodic / semantic + Milvus vectors + decay and overflow governance
src/modules/memorypersonaFive-layer persona model: role, tone, boundaries, domain knowledge, behavioural policy
src/modules/personaknowledgeKnowledge base and RAG retrieval; the data source for the knowledge-search tool
src/modules/knowledgeskillSkill system: reusable skills distilled from real conversations
src/modules/skillHow users connect, and how multiple agents work together.
channelChannel adapters: Feishu, WeCom SCRM, web — with webhooks and a realtime gateway
src/modules/channel/adapterscollaborationMulti-agent collaboration: orchestrator, supervisor, communication protocol and collaboration logs
src/modules/collaborationoutreachProactive reach: event-driven and scheduled outbound tasks
src/modules/outreachpublic-chatPublic conversations: a dialogue entry point for external users
src/modules/public-chatWhat tools the agent has at hand.
toolTool framework + 19 built-in tools (search, SQL, charts, code execution, email and more)
src/modules/tool/builtinsresearchDeep research: multi-round retrieval and information synthesis
src/modules/researchevolutionSelf-evolution: optimising policy and prompts from conversation feedback
src/modules/evolutionThe foundations of a multi-tenant SaaS.
auth / adminAuthentication and tenant management: JWT, OAuth2, tenants, roles and permissions
src/modules/{auth,management,admin}customer / applicationCustomers and applications: customer profiles, app configuration and business objects
src/modules/{customer,application}usage / auditUsage metering and audit logs; token consumption and operation traces
src/modules/{usage,audit}system / debug / healthSystem configuration, debug tooling and health checks
src/modules/{system,debug,health}Layered design
From access to runtime — what each layer owns and what it is built with.
the channel module: WeCom SCRM pull / Feishu push / DingTalk push / web chat WebSocket / open API
four cognitive engines: intent extraction → planning → assessment → reflection, driven by a LangGraph state machine
session / episodic / semantic three-tier storage + Milvus vector retrieval + memory decay
five-layer persona injection: role / tone / boundaries / knowledge / policy
skill evolution, 19 built-in tools, knowledge-base RAG, workflows
orchestrator, supervisor and an inter-agent communication protocol
NestJS 11 · TypeScript · Prisma 7 · MariaDB / MySQL · Redis · LangChain · LangGraph
Key flows
The most important paths, unpacked step by step.
One full cognition turn
From one sentence from the user to the agent’s answer — what happens in between.
- 1
The channel adapter receives the message and normalises it into the internal message structure
- 2
intent-extractor extracts intent and slots and decides whether to ask a follow-up
- 3
memory recalls relevant memory: session context + episodic memory + the semantic profile
- 4
persona injects the five layers and assembles this turn’s system context
- 5
plan-engine produces an execution plan and picks the tools to call
- 6
assess-engine evaluates tool results; anything below bar triggers replanning
- 7
reflect-engine closes the turn, writing conclusions and lessons back to memory
- 8
The response returns through the channel adapter; the whole path is written to audit and usage
Remembering a user across sessions
A preference mentioned last week is still there this week.
- 1
Stable facts (identity, preferences, taboos, business stage) are recognised in conversation
- 2
They are written to episodic memory and vectorised into Milvus
- 3
memory-sync-pipeline persists asynchronously without blocking the conversation
- 4
Semantic memory aggregates into a user profile
- 5
Next session, vector search recalls relevant memory, injected into context together with the profile
- 6
memory-decay lowers the weight of stale memories over time
Multi-agent collaboration on a complex task
When one agent is not enough, hand it to a team.
- 1
orchestrator receives the task and decomposes it into subtasks
- 2
Subtasks are dispatched to specialised agents by capability tags
- 3
Agents exchange intermediate results over the communication protocol
- 4
supervisor reviews each stage’s output and sends substandard work back
- 5
collaboration-logger records the full collaboration chain
- 6
Results are consolidated and returned; the chain can be replayed for optimisation
Tech stack
Scale & benchmarks
These numbers are not estimates — they are read from the code and runtime configuration. Each one states what it actually means, so it cannot be mistaken for marketing.
uniclaw-copitIntent extraction → planning → assessment → reflection, each a separate, separately testable module
Session / episodic / semantic layered storage, with decay and context-overflow governance
Search, SQL, charts, code execution, email and knowledge retrieval out of the box
WeCom / Feishu / DingTalk / WebSocket / open API behind one adapter abstraction
Role, tone, boundaries, knowledge and policy separated — persona changes never touch code
OpenAI / Anthropic / Google plus compatible-protocol domestic models
Facts you can count in the repository
Every item below can be checked in uniclaw-copit: modules, tables, endpoints and capability items. Whether something is “done” is judged by whether these numbers moved.
Security and compliance support points
What Uniclaw concretely does for security, and where the boundaries are drawn. Every item notes where it is implemented, so you can verify.
What may be answered and what must go to a human is written into the persona configuration; crossing the line triggers handoff — no reliance on prompt discipline.
modules/persona boundary layerEvery tool call passes permission and quota checks; exceeding quota fails immediately, leaving the model no room to overstep.
modules/tool · usageSelf-hosted Milvus keeps vectors and memory inside the customer network; privately deployed model services can be connected.
Dockerfile single-image deliveryDelegation relations, tool calls and permission snapshots are recorded throughout; collaboration chains replay in full.
modules/audit · collaboration-loggerWith UIAM connected, agent credentials, scopes and tool permissions are managed by the identity kernel and revocable instantly.
UIAM tenant_code claim · MFA enrollmentSemantic memory is isolated per tenant, purgeable by policy, and decay keeps stale information from dominating.
modules/memory · memory-decayWhere the data stops
The data boundary is determined by the product form, not a toggle someone can flip. This is the shared judgement across all four business lines.
The minimum boundary for endpoint products. Data at this layer has no upload path by design — it is not switched off by a toggle.
- All legdger ledger data: encrypted locally, only ciphertext reaches the cloud
- legdger on-device AI statistics and Q&A: inference runs on the device
- NewTool desktop and wasm forms: the algorithm kernel has no IO, so data never leaves the process
- pxc captured traffic: the kernel runs locally and does not pass through third-party services
The boundary for private deployment. Models, vectors, business data and audit records are all deployed inside the customer’s own network.
- Uniclaw memory and knowledge vectors: self-hosted Milvus, never leaving the intranet
- Uniclaw model services: can connect to privately deployed compatible-protocol services
- UIAM identity and audit data: the whole deployment sits inside the customer boundary and can run fully air-gapped
- Uniscrm assets and media: object storage can connect to the customer’s own OSS
- Unilearning courseware and learning records: delivered as a single container, with data under the customer’s control
The only things needing external network access are sync and external channels, and what travels is ciphertext or already-desensitised messages.
- legdger cross-device sync: uploads only the latest ciphertext, and the server keeps no history
- Uniscrm WeCom channel: communicates with official WeCom interfaces and uses official archiving capability
- Uniclaw channels: Feishu / DingTalk push APIs, with content isolated per tenant
- NewTool remote calls: transported over MCP, while the algorithm kernel itself makes no network requests
Company-wide security principles
Whichever business line, these six are the shared floor.
Any constraint that can be baked into the compiler, the framework or the query layer does not go into a document for people to remember. Tenant isolation is enforced by a query-layer listener; domain boundaries are rejected at compile time by Go’s internal mechanism.
jOOQ TenantScopeVisitListener · Go internal 墙Sensitive data stays on the user device or inside the customer network by default. All four business lines support private deployment, and legdger does not even send AI analysis off the device.
legdger 端侧 AI · Uniclaw 自建 Milvus · Unilearning 单容器Agents never share human credentials, servers never hard-code long-lived keys, and endpoint integrations use revocable tokens. Any credential can be revoked on its own without affecting other principals.
UIAM MACHINE 主体 · OSS STS AssumeRole · ledger-cli 令牌Authentication, authorization, tool calls and captured traffic all produce structured records. We keep them not for compliance theatre but so that incidents can be replayed.
uiam-audit · collaboration-logger · pxc 会话记录Delegation is expressed with the act claim — who acts for whom — with permissions intersected at every hop. Audit can answer which user authorized which agent, which tool it called, and with which permissions.
RFC 8693 Token Exchange · agent_tools 注册表Database changes go through versioned migrations that produce the same result on repeat; application releases are single-image swaps, so rollback means switching back to the previous image.
Liquibase · 各域方言迁移 · Docker 单镜像Deploy & integrate
Every product line supports private deployment; the concrete form varies by product.
One command brings up MariaDB + Redis + the service — the fastest path locally and for POCs.
- Start dependencies with docker compose up -d
- Prisma migrate and generate
- Node.js 20+ / pnpm 9+
Models, data and memory stay inside the customer’s own network boundary.
- A self-hosted Milvus vector store keeps vector data inside the intranet
- Can connect to privately deployed model services (OpenAI-compatible protocol)
- Delivered as a single image via Dockerfile
Not locked to any single model vendor.
- The llm module abstracts uniformly; OpenAI / Anthropic / Google all work
- Domestic models connect over the compatible protocol
- Choose models per scenario: fast models for conversation, strong models for planning
Agent identity and permissions reuse the UIAM identity kernel directly.
- Adapted to UIAM’s tenant_code claim and MFA enrollment
- Webhook wiring synchronises identity events
- Agent credentials and tool authorization are issued by UIAM
Comparison
The same job, done in different ways. The left column is our choice; the right is the common alternative — the difference is usually not in the feature table but in where the boundary is drawn.
Who feels the difference
Feature lists do not convince people; role perspectives do. Below are the real before-and-after differences for four roles.
Repetitive enquiries consume the whole team; nights and holidays go uncovered and customer experience gaps
Digital workers carry repetitive enquiries 7×24, escalating out-of-scope cases to humans with full context
Leads arrive with nobody screening them; seller time drains into low-quality leads
The SDR agent reaches out proactively and qualifies leads, handing only mature ones to human sales
Policy documents go unread, and the same question gets asked a hundred times by different people
Mount the enterprise knowledge base with RAG retrieval: answers are sourced and distil into skills
Worried about business data leaving the intranet, hesitant to use AI in real scenarios
Models, data and the vector store all deploy privately; vector data never leaves the network
Releases and roadmap
Shipped items state what was delivered, in-progress items what is being built, planned items what is intended. Shipped items are never reversed.
v0.9ReleasedCognition core- Four cognition-loop engines
- Three-tier memory with Milvus vector retrieval
- 19 built-in tools
- The model provider abstraction layer
v1.0ReleasedPlatformisation- The five-layer persona model
- Five channel families
- Multi-agent orchestration
- Multi-tenancy and usage metering
v1.2In developmentEvolution capabilities- Skills distilled automatically from conversations
- An enhanced deep-research mode
- A standardised inter-agent communication protocol
- Full integration with UIAM credential issuance
v2.0PlannedEcosystem- Cross-enterprise agent federation
- A capability and skill marketplace
- Industry agent templates
- Hybrid on-device small-model inference
Integrations and counterparts
Who Uniclaw needs to integrate with, and how.
SCRM pull mode inside the WeCom ecosystem, reaching customers where they are
push API proactive messaging and event reception
push API proactive messaging and event reception
The vector retrieval foundation for memory and knowledge, privately deployable
One abstraction in the llm module; different models per scenario
Agent identity, delegation chains and tool authorization issued by the identity kernel
Adoption scenarios
How this is used in real business settings.
Hand repetitive enquiries to digital workers; humans handle only the real exceptions.
- One reception across WeCom / Feishu / DingTalk / web
- Out-of-scope questions escalate to humans with full context attached
- Conversations distil into the knowledge base, so the same question is answered right next time
Leads are qualified first, so sellers only follow the valuable ones.
- Proactively reaches new leads and qualifies them through multi-turn dialogue
- Customer profiles accumulate automatically; follow-up notes update in real time
- Mature leads are handed to human sales
Company policy and historical documents — ask once, get the answer.
- The knowledge module mounts the enterprise knowledge base
- RAG retrieval + semantic memory keep answers sourced
- Private deployment: material never leaves the intranet
No waiting for the data team’s schedule — ask and get a chart.
- sql-query connects straight to the business database (read-only)
- chart-generate produces visualisations
- research mode drills into multi-round attribution
FAQ
A raw model call has no memory, no persona constraints, no tool authorization boundary and no audit trail. What Uniclaw provides is a runtime: the cognition loop keeps long tasks on track, three-tier memory keeps them consistent across sessions, and tools and permissions keep the agent doing only what it should.
Hand the complexity of identity, agents and private domain to one governable kernel
Whether you are replacing an existing IAM, building an agent platform, or trying to make private-domain operations actually work — start with a 30-minute architecture call. We will first judge whether this is the kind of problem we are good at, and say so plainly if it is not.