Carbon

Build hardware at the speed of software

Carbon combines ERP, MRP, MES and QMS.
Plan materials, run the shop floor, manage quality and track actual costs in one system.

Hard tech unicorns build on Carbon.

Start 30-day trial · Self-host · Docs · API · MCP · Discord · Roadmap

GitHub stars Discord TypeScript React Postgres Rust License: AGPL-3.0


Carbon assembly instructions: step-by-step 3D work instructions authored from the CAD model
Sales orders list with status, linked jobs and order totals

One record from quote to cash. Link quotes, orders, jobs and invoices.

 Multi-level bill of materials with planning and supersession

Generate configurations from rules. Control BOMs, routings and revisions.

 Lot and serial traceability graph

Trace every unit to its source. Follow lot and serial genealogy in both directions.

## Contents - [Why Carbon](#why-carbon) - [Features](#features) - [Get Carbon](#get-carbon) - [API & MCP](#api--mcp) - [Architecture](#architecture) - [Tech Stack](#tech-stack) - [Monorepo](#monorepo) - [Local Development](#local-development) - [Commands](#commands) - [Security](#security) - [Contributing](#contributing) - [License](#license)
## Why Carbon Manufacturing teams often run planning, production, quality and accounting in separate systems. That creates predictable problems: - BOMs and revisions are re-keyed between engineering and production - Material shortages surface after work has started - Job costs and quality records are reconstructed after the fact - Integrations depend on vendor-specific tools and consultants Carbon puts ERP, MRP, MES and QMS in **one Postgres database you can inspect, own and extend**. Engineering, planning, production, quality and accounting update the same data, without synchronization jobs between separate product databases.

Why one database: in the usual setup, planning, production, quality and accounting each keep their own copy of the data and are joined by re-keying and connectors; in Carbon, sales, engineering, planning, production, quality, inventory and accounting all read and write the same Postgres database

Carbon is an open-source alternative to [NetSuite](https://carbon.ms/compare/netsuite), [Epicor](https://carbon.ms/compare/epicor), [SAP Business One](https://carbon.ms/compare/sap-business-one), [Plex](https://carbon.ms/compare/plex), [Odoo](https://carbon.ms/compare/odoo) and [ERPNext](https://carbon.ms/compare/erpnext). It supports complex assembly, contract manufacturing, configure-to-order and high-mix, low-volume production. See [all comparisons](https://carbon.ms/compare).
## Features | | | | ---------------------------- | -------------------------------------------------------------------------------- | | **ERP — Inventory & Costing** | Quotes, orders, purchasing, inventory, invoicing and actual job costs | | **MRP — Planning** | Demand, supply planning, versioned BOMs and routings, finite-capacity scheduling | | **MES — Execution** | Digital travelers, operator terminals, 3D instructions, barcode and labor capture | | **QMS — Quality** | Inspections, FAI, nonconformance, CAPA, calibration and risk management | | **Traceability** | Forward and backward lot and serial genealogy | | **Engineering** | Multi-level BOMs, revisions, change orders, supersession and product configuration | | **Accounting** | General ledger, journals, multi-entity, multi-currency and accounting integrations | | **Workflows** | Rule-based automation with triggers, actions and run history | | **Maintenance & Assets** | Scheduled maintenance, fixed assets and kanban replenishment | | **API, Webhooks & MCP** | Typed REST operations, event-driven webhooks and a permission-aware MCP server | | **Custom Fields** | Extend records without changing the core schema | | **Integrations** | Onshape, SolidWorks, Paperless Parts, Linear, Jira, Slack, Ramp, Stripe and Zebra | See the [full roadmap](https://github.com/orgs/crbnos/projects/1/views/1) for what's next. **Technical highlights** - Generated types shared by the database, application and API - Postgres row-level security and tenant-scoped records - Role- and attribute-based access for employees, customers and suppliers - Realtime database subscriptions - Shared identity and permissions across the application, API and MCP server - Explicit dependency graphs for manufacturing operations - Rust geometry services for STEP conversion and assembly motion planning
## Get Carbon | | | | --- | --- | | **Carbon Cloud** | Managed application, database, updates and backups. [Start a 30-day trial](https://app.carbon.ms) without a sales call. | | **Self-hosted** | Run Carbon in your VPC, on-prem or air-gapped. See the [self-hosting guide](https://carbon.ms/self-hosted). | | **Develop locally** | Run the application and supporting services from source. Follow [Local Development](#local-development). |
## API & MCP The [**Carbon API**](https://docs.carbon.ms/api) exposes the same manufacturing operations used by the application. Each operation validates its input, updates dependent records and enforces the authenticated identity's permissions. Operations are available through two interfaces with the same arguments: - **HTTP:** `POST https://app.carbon.ms/api/v1/{module}/{operation}`, with a published [OpenAPI spec](https://app.carbon.ms/api/v1/openapi.json) for [generating a typed client](https://docs.carbon.ms/api/sdks) in any language - **[MCP](https://docs.carbon.ms/api/mcp):** as tools for hosted or local AI agents, scoped to the permissions of the API key or signed-in user Create a key under **Settings → API Keys**, then: ```bash curl -X POST https://app.carbon.ms/api/v1/sales/getSalesOrders \ -H "Authorization: Bearer $CARBON_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "args": { "limit": 10 } }' ``` Self-hosted deployments serve the same API at `/api/v1`. The [Data API](https://docs.carbon.ms/api/data) provides direct access to permitted tables and views when an operation is not available in the service layer. API keys and MCP are included with Business and Enterprise plans. Using them in a self-hosted deployment requires a commercial license.
## Architecture ERP and MES are React Router apps over a single Postgres database. Permissions (row-level security), computed totals and change events live in the database itself; background work runs through Inngest, which calls back into the ERP to execute jobs. The [architecture guide](https://docs.carbon.ms/docs/building/architecture) follows one click all the way down. How Carbon fits together: shop floor staff use the MES; office staff, customers, suppliers, your code and AI agents reach the ERP. Both apps check permissions and write to Postgres, which enforces row-level security, computes totals in views and queues change events in the same transaction. After commit, Inngest calls the ERP back to run jobs that update search, the audit log, webhooks, workflows, accounting sync, Linear and Jira, email and Slack. Realtime pushes live updates to screens. ## Building E2E Systems Carbon is intended to be the core of a bespoke end-to-end manufacturing system. We provide an `apps/starter` and allow you to build a custom sales and shop-floor engine with Carbon at the center. Ways to build on Carbon: your own app (from apps/starter), scripts and other systems use the Carbon API, AI agents use the MCP server, and reports use the Data API. All of them get the same permissions as the signed-in user or API key. The API and MCP run the same operations the ERP uses; the Data API goes straight to tables and views. On a change, Carbon calls out through webhooks, workflows and integrations.
## Tech Stack | Layer | Technology | | -------------- | ------------------------------------------------------------------------------------------------ | | Apps | [React Router 7](https://reactrouter.com) on [Vite](https://vite.dev), [TypeScript](https://www.typescriptlang.org/) | | UI | [Tailwind 4](https://tailwindcss.com), [Radix](https://radix-ui.com), [React Aria](https://react-spectrum.adobe.com/react-aria/), [TanStack Table and Query](https://tanstack.com) | | Forms | [Zod](https://zod.dev) with `@carbon/form` | | Database | [Postgres](https://www.postgresql.org) with row-level security, [PostgREST](https://postgrest.org) and [Kysely](https://kysely.dev) | | API | [oRPC](https://orpc.unnoq.com) with OpenAPI, [MCP](https://modelcontextprotocol.io) server | | AI | [AI SDK](https://ai-sdk.dev) (Anthropic, OpenAI) | | Jobs & events | [Inngest](https://inngest.com) | | Cache | [Redis](https://redis.io) | | 3D & CAD | [three.js](https://threejs.org) / react-three-fiber; Rust with [OpenCASCADE](https://dev.opencascade.org) and [FCL](https://github.com/flexible-collision-library/fcl) | | Documents | [React PDF](https://react-pdf.org), [React Email](https://react.email), [TipTap](https://tiptap.dev) | | i18n | [Lingui](https://lingui.dev) | | Tooling | [pnpm](https://pnpm.io), [Turborepo](https://turbo.build), [Biome](https://biomejs.dev), [Vitest](https://vitest.dev) | | Docs | [Next.js](https://nextjs.org) + [Fumadocs](https://fumadocs.dev) | | Hosting | [AWS](https://aws.amazon.com) via [SST](https://sst.dev), or self-hosted with Docker |
## Monorepo A [pnpm](https://pnpm.io) + [Turborepo](https://turbo.build) monorepo: ``` carbon ├── apps # ERP, MES and the Rust assembler ├── packages # shared TypeScript packages ├── crates # Rust crates behind the assembler (CAD conversion, collision, motion planning) └── docs # docs.carbon.ms, with content and glossary as @carbon/content ``` ### `/apps` | App | Description | | ----------- | --------------------------------------------------------------- | | `erp` | ERP: sales, purchasing, inventory, planning, quality, accounting | | `mes` | MES: the shop floor app, run on tablets next to the machines | | `assembler` | Rust geometry service: STEP → GLB and assembly motion planning | | `academy` | Training | | `starter` | Example app built on the API | ### `/packages` | Package | Description | | ------------------------ | ---------------------------------------------------------------------------- | | `@carbon/database` | Schema, migrations, generated types and database clients | | `@carbon/auth` | Authentication, RBAC, sessions, API keys and OAuth | | `@carbon/api` | API contract: the generated operation manifest behind the Carbon API and MCP | | `@carbon/react` | Shared UI components (Radix, React Aria, Tailwind) | | `@carbon/form` | `ValidatedForm` and field components for zod + FormData | | `@carbon/jobs` | Inngest background jobs: events, integrations, notifications, workflows | | `@carbon/planning` | MRP and scheduling engines | | `@carbon/documents` | PDFs, email templates, ZPL labels, QR and barcodes | | `@carbon/printing` | Printer routing, label queue and ProxyBox delivery | | `@carbon/viewer` | 3D models and animated assembly instructions (react-three-fiber) | | `@carbon/files` | File handling: images, HEIC, CAD formats | | `@carbon/tiptap` | Rich-text editor extensions and components | | `@carbon/onboarding` | Implementation Hub: guided company setup | | `@carbon/notifications` | Notification event taxonomy shared by apps and jobs | | `@carbon/workflows-core` | Community-licensed contracts for workflow triggers | | `@carbon/locale` | Lingui i18n runtime for ERP and MES | | `@carbon/lib` | Server utilities: event system, Inngest client, SMTP, Slack | | `@carbon/kv` | Redis client and rate limiting | | `@carbon/env` | Validated environment variables, secrets kept server-side | | `@carbon/logger` | Isomorphic logger built on LogTape | | `@carbon/utils` | Pure shared utilities (dates, precision, BOM, formatting) | | `@carbon/stripe` | Stripe billing (Carbon Cloud only) | | `@carbon/ee` | Enterprise features and integrations (commercial license) | | `@carbon/checks` | Conformance checks that keep the codebase consistent | | `@carbon/dev` | The `crbn` dev CLI: worktrees, Docker stacks, dev URLs | | `@carbon/harness` | Harness for AI coding agents working on this repo | | `@carbon/config` | Shared Vitest, TypeScript and Tailwind configuration |
## Local Development **Prerequisites:** [Docker](https://docs.docker.com/get-docker/), [Node.js](https://nodejs.org) 24.22.1+ and [pnpm](https://pnpm.io) (via Corepack). On Windows, use WSL or Git Bash. ```bash git clone https://github.com/crbnos/carbon.git && cd carbon corepack enable && pnpm install cp .env.example .env pnpm dev ``` `pnpm dev` boots the whole backend in Docker (Postgres, PostgREST, auth, storage, realtime, Inngest, Redis and a mail catcher), applies migrations, generates types and starts the apps: | Surface | URL | | ------------ | ------------------------ | | ERP | http://localhost:3000 | | MES | http://localhost:3001 | | API | http://localhost:54321 | Sign in as `test@carbon.ms`: the dev stack seeds that user and skips the magic link. To fill a company with a full demo story (items, BOMs, orders, jobs, inspections, journals), seed one of the industry datasets (`satellite`, `robotics`, `precision`, `motor`): ```bash pnpm db:seed:dev -- --email test@carbon.ms --dataset satellite ``` No external accounts are needed to run locally. Email, Google/Microsoft sign-in, Stripe, PostHog and AI providers are all optional and configured in `.env`; see [environment variables](https://docs.carbon.ms/docs/platform/self-hosting/environment-variables). ### Worktrees and the `crbn` CLI `pnpm dev` is shorthand for `crbn up --no-portless`. Run `source ./setup.sh` once to put `crbn` on your `PATH` and you get a separate, isolated stack per git worktree, so several branches can run side by side, each on its own HTTPS `.dev` URLs via [portless](https://github.com/vercel-labs/portless): ```bash crbn checkout -b feat/my-thing # new branch + worktree off HEAD crbn up # boot this worktree's stack at erp..dev crbn checkout 760 # check out PR #760 into its own worktree crbn status | down | reset # ports and health, stop, wipe and reboot ``` The full command reference is in the [local development guide](https://docs.carbon.ms/docs/building/local-development).

Optional: the assembler geometry service

 `assembler` is a Rust service (STEP → GLB + assembly motion planning) over C++ FCL and OpenCASCADE. ERP/MES run fine without it — set it up only if you need the 3D `/convert` and `/plan` endpoints. 1. **Toolchain + native build deps** (macOS): ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # Rust, if not already installed brew install fcl cmake ninja draco # collision libs (+ libccd/eigen/octomap), build tools, Draco mesh compression ``` On Linux, install the equivalents from your package manager: `libfcl-dev libccd-dev libeigen3-dev liboctomap-dev libdraco-dev cmake ninja-build` plus a C/C++ toolchain. `./setup.sh` already installs Draco on macOS. If yours lives outside the Homebrew keg (`/opt/homebrew/opt/draco` on arm64), point `draco-bridge`'s build at it with `DRACO_PREFIX=/path/to/draco cargo build`. 2. **Build OCCT once** — a patched static OpenCASCADE, cached in `~/.cache/carbon-occt`. Slow (~15–30 min) but one-time per machine; re-running is a no-op once cached: ```bash ./apps/assembler/scripts/build-occt.sh ``` 3. **Build the service** — seconds once OCCT is cached (`build.rs` finds it automatically): ```bash cargo build --release -p assembler ``` `crbn up` spawns the binary when it's present. Verify it's up with `curl -sf "$ASSEMBLER_SERVICE_URL/health"` (the URL is in your worktree's `.env.local`) or by watching the `asm |` lines in the `crbn up` output. Without the binary the rest of the stack still runs — only `/convert` and `/plan` are unavailable.

Restoring a production snapshot

 To restore a production database snapshot locally, use `crbn restore`. It handles both plain-text `.backup` and custom-format `.dump` archives, drops and rebuilds the public schema, fits the backup to your stack's auth/storage/realtime schemas, verifies that every index, constraint, trigger and policy landed, realigns internal sequences, resets storage metadata, then applies any migrations the backup predates and regenerates types. If verification fails, it exits nonzero and applies no migrations. 1. Export a backup of your production database with `pg_dump`. 2. Run it from your worktree root: ```bash crbn restore /path/to/db_cluster.backup # …or for .dump archives: crbn restore /path/to/postgres_YYYYMMDD.dump ``` It prompts before replacing the database. The stack must already be running (`crbn up`) — a restore rewrites the `auth` and `storage` schemas, which GoTrue and Storage build through their own migrations when those containers boot, so `crbn restore` refuses rather than restore into an uninitialized stack. To also get local admin access, pass your production email — your account is upgraded to Admin in the companies it already belongs to and the password is reset locally: ```bash crbn restore /path/to/backup.backup --admin-email you@example.com # Optional: set a custom local password (default: localpass) crbn restore /path/to/backup.backup --admin-email you@example.com --admin-password mypass ``` Useful flags: `--no-scrub-emails` keeps real addresses (see the warning below), `--mode prod` restores exactly as-is without localizing config/webhooks/integrations, `--no-migrate` / `--no-regen` skip the trailing steps, `--yes` skips the prompt. > **Emails are scrubbed by default** — every address is rewritten to `@example.test` (your `--admin-email` is preserved so you can still log in). If you pass `--no-scrub-emails`, real production addresses will be present in the local DB; ensure local email sending is disabled or pointed at a sandbox (e.g. Mailpit) before triggering any email flows. > > **Note:** `storage.objects` is truncated by default, so a restore does not populate local file storage — kept rows would reference files that only exist in the source environment's backend. Pass `--keep-storage-objects` to retain the metadata (and the backup's buckets) anyway; downloads will still 404, but the rows are there for work that needs realistic storage volume. The underlying script, `scripts/restore-database.sh`, can still be invoked directly — it takes the same options as environment variables (`SCRUB_EMAILS`, `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `RESTORE_MODE`), but note it defaults to **not** scrubbing emails and leaves the trailing `pnpm db:migrate` / `pnpm db:types` to you.

## Commands | Command | Description | | ---------------------------------- | ------------------------------------------------------------ | | `pnpm dev` | Boot the stack and apps on localhost | | `pnpm db:migrate:new ` | Create a database migration | | `pnpm db:migrate` | Apply pending migrations | | `pnpm generate:types` | Regenerate database types after a migration | | `pnpm db:seed:dev -- --dataset ` | Seed a demo company | | `pnpm lint` / `pnpm test` | Biome lint / unit tests | | `pnpm exec turbo run typecheck --filter=` | Typecheck one package | | `pnpm --filter ` | Run a command in one workspace | This project uses [Biome](https://biomejs.dev/) for formatting and linting; install the [VS Code extension](https://marketplace.visualstudio.com/items?itemName=biomejs.biome) for format-on-save.
## Security **Found a vulnerability?** Please email [support@carbon.ms](mailto:support@carbon.ms) instead of opening a public issue. We respond within 3 business days and credit reporters once a fix ships. The full policy is in [SECURITY.md](.github/SECURITY.md). Security is enforced by the database, not left to application code: - **Tenant isolation in Postgres.** Every table is scoped to a company and guarded by row-level security, so a query can only see its own company's rows. - **Granular permissions.** Role-based access per module and action for employees, customers and suppliers, applied the same way in the app, the API and MCP. - **Scoped API keys.** Keys carry explicit permissions, are stored only as hashes and are rate limited per key. - **Sign-in.** Passkeys, SSO, and enforced two-factor authentication on the Business plan. - **Audit log.** A record of who changed what and when, on the Business plan. - **Your perimeter.** Deploy in your VPC, on-prem or air-gapped to keep CUI inside infrastructure you control while supporting ITAR and CMMC requirements.
## Contributing We welcome contributions of all sizes. Read [CONTRIBUTING.md](.github/CONTRIBUTING.md) to get started, and say hi in [Discord](https://discord.gg/yGUJWhNqzy). Good first issues are labelled [`good first issue`](https://github.com/crbnos/carbon/labels/good%20first%20issue). Contributors ### Star history Star history chart
## License Carbon is open core. Everything in this repository is licensed under [AGPLv3](LICENSE), except the Enterprise files (`packages/ee` and any file whose name contains `.ee.`), which are under the [Carbon Commercial License](packages/ee/LICENSE). See [Licensing](https://docs.carbon.ms/docs/platform/licensing) for what that means in practice.
Built by the Carbon team · Join the Discord