An Open-Source Sales OS Built for WhatsApp and AI Agents

In mid-September 2026, a Brazilian open-source project briefly colonized the algorithm. An eight-minute episode of GitHub Daily Trend profiled it on September 12, describing it as a self-hosted customer relationship management platform with native AI agents and WhatsApp integration [2][11]. Two days later, a YouTube channel dedicated to trending repositories served a #Shorts clip that racked up nearly two thousand views in forty-eight hours [5]. Instagram reels positioned it as an escape hatch from Intercom’s per-seat pricing, complete with freelance deployment offers for anyone who preferred not to touch a terminal [7]. The repository in question is DeskcommCRM, and the attention spike is less about novelty than about timing: it arrives at the exact intersection of three exhausted trends—SaaS seat pricing, AI agent hype, and WhatsApp’s de facto monopoly on business chat outside the United States.

The project’s own description sounds like a buzzword composite until you read the implementation. It is built on Next.js 16 and PostgreSQL, released under an MIT license, and designed to run on a private VPS [7]. More importantly, it does not treat AI as a chat widget floating over a database. It treats the agent as a first-class user of the CRM itself, complete with assignee rights, organizational memory, and the ability to modify records.

Most “AI CRMs” bolt a language model onto a messaging window and call it qualification. DeskcommCRM attempts something more systemic. The agent operates the CRM through an internal Model Context Protocol server, with access to tenant-isolated RAG knowledge bases, executable skills, and long-term memory that persists across conversations [2][3]. Each tenant’s knowledge base is isolated in a vector store, fed from the tenant’s own catalog and policies, and updatable through the UI without code changes [3]. The agent does not rely on a generic foundation model trained on the open internet; it retrieves from a corpus that the business controls, which reduces hallucinated product claims and keeps pricing data current. When the agent decides a lead is warm enough, it can move the deal through the pipeline itself. When it hits a boundary, it hands off to a human with an audited context trail. The handoff is not a simple escalation message: the system logs the decision, preserves the full conversation state, and removes the agent from the assignment so a human can take over without guessing what has already been promised [3]. This matters because the most common complaint about sales bots is not that they are too robotic, but that they make commitments—discounts, delivery dates, feature promises—that the human team never authorized.

The system even includes a feedback loop where resolved conversations are fed back into the knowledge base, and the agent proposes self-improvements that a human must review and gate before they go live. This is not decorative automation; it is an attempt to make the agent an actual operator inside the sales stack.

This architecture matters because it addresses the two failure modes that currently plague AI sales tools: the black box and the ban hammer.

On the black-box front, the project enforces seven discrete checks before any AI-generated message leaves the server—unsubscribe status, LGPD compliance, anti-ban throttling, text variation, deterministic promise checking, semantic promise checking, and automation disclosure [3]. Each check is logged durably, including rejected messages and the specific reason for rejection. The audit trail is append-only with a five-year retention policy, and row-level security is validated by hundreds of invariant tests in continuous integration. For a technically literate reader, the boring part is the value: this is compliance infrastructure dressed as a CRM, built for a market where data residency and algorithmic accountability are legal requirements, not marketing slogans.

On the ban-hammer front, the system integrates WhatsApp in two modes. The first uses WAHA, an unofficial Web-emulation layer that carries the familiar risk of number bans [3][4]. To mitigate this, the project applies throttle-and-jitter rate limiting, scheduled sending windows, and STOP detection. The second mode uses Meta’s official Cloud API, with pre-approved templates and synchronized messaging [3]. Media lands in a private Supabase Storage bucket served through signed URLs. The dual-track approach lets a small team start with a QR-code scan and graduate to official channels without migrating platforms—a pragmatic concession to the reality that WhatsApp’s unofficial ecosystem is often the only on-ramp for small businesses in Latin America, even if it violates Meta’s terms of service [4][6].

The self-hosting proposition is equally deliberate. The project ships a setup kit that targets a VPS in São Paulo—though it will run anywhere with Docker—and claims an install process that generates its own secrets, applies an idempotent database baseline, and configures automated HTTPS. Updates are meant to happen through a web UI with automatic database backups and rollback on failure; if the background agent is missing, the UI degrades gracefully and exposes the terminal fallback rather than pretending everything is fine. There is no paid tier, no feature gate, and no seat limit. The cost model is the VPS bill, period [3][7].

This pricing philosophy is the project’s sharpest wedge against incumbents. Intercom charges per seat plus per AI-resolved conversation; HubSpot and Freshsales scale by user count [3][7]. DeskcommCRM argues that a sales team should not pay more simply because it hired another human. The trade-off is that you become your own DevOps team. The documentation is explicit about this: there is no SLA, no guaranteed support, and the instance operator is the legal data controller under Brazilian LGPD [7].

The feature set is comprehensive enough to expose the gaps. The automation engine uses WHEN/IF/THEN rules triggered by CRM events and inbound webhooks, with an event-log table drained by cron workers rather than fragile database triggers that fire HTTP requests directly [3]. A Lead Radar surfaces stalled conversations by idle time and risk level. The kanban board uses fractional indexing and per-pipeline vocabulary, so a real-estate pipeline can say “Fechado” while a clinic says “Agendado” without code changes. But the project also admits its own limits: there are no deep native integrations with email marketing platforms, ad networks, or data warehouses, and a single installation cannot host multiple brands—each brand needs its own VPS [3].

In the broader landscape of open-source WhatsApp tools, this places DeskcommCRM between all-in-one support desks like Chatwoot and unofficial API gateways like Evolution API [4]. It is more CRM than Chatwoot, more structured than a bare API, and more Brazilian than most alternatives—Vocero CRM, for instance, is Spanish-first [4]. The September 2026 hype wave is therefore partly regional and partly categorical: it is the rare open-source project that combines multi-tenant row-level security, AI agent governance, and WhatsApp anti-ban logic in a single deployable system.

The roadmap suggests the project knows where its seams are. Upcoming work includes niche templates for clinics and real estate, adapters for VTEX and Shopify beyond the existing Nuvemshop integration, and a public Model Context Protocol server that would let external agents operate the CRM without native integration code. The most ambitious item is probabilistic identity unification—merging contact records across channels—which is exactly the kind of hard data problem that separates a messaging tool from a true operating system.

Whether it sustains the attention depends on execution. The unofficial WhatsApp path remains a terms-of-service gray area regardless of throttle logic [4][6]. The official API path requires Meta messaging fees and template approvals. And self-hosting, while liberating, shifts the burden of backups, updates, and compliance entirely onto the operator. But for teams already paying rent to Intercom or Kommo, the proposition is simple: own the stack, own the data, and let the AI sit at the same table as the humans—assignee rights, memory, skills, and all.