DeskcommCRM: Open-Source AI CRM for WhatsApp

DeskcommCRM is an open-source sales CRM you install on your own server, with AI agents that answer WhatsApp messages, qualify the lead and move it down the pipeline. It went up on GitHub on 28 April 2026 and had 1,382 stars by 12 September, having shipped five releases in the five days to v1.19.0. The licence is MIT, there is no paid tier, and the thing people usually want to know first — what it costs — has an answer that is genuinely just "a VPS and your model keys".

Key Takeaways:

• MIT licence, no gated features, no per-seat charge; five people in sales or fifty cost the same server
• The recommended box is 4GB of RAM, and it boots on 2GB at the edge: seven containers, roughly 150MB per WhatsApp session
• WhatsApp connects through WAHA by scanning a QR code, not through a paid WhatsApp Business API account — which is both the reason it's free and the reason there's an anti-ban guardrail
• Seven checks run before every outbound message, in a fixed versioned order, and each evaluation is recorded, including the ones that block a send
• Documentation is Portuguese-first, written for the Brazilian market; English and Spanish versions exist and are complete

What DeskcommCRM is, and what self-hosting actually buys you

Strip away the positioning and DeskcommCRM is a multi-tenant CRM built on Next.js with an agent layer bolted to a WhatsApp gateway. The pitch on deskcomm.com.br is blunt about the category it's attacking: closed platforms charge per seat, so your bill climbs in the same year you hire, while here the cost belongs to the server and the server doesn't count heads.

That trade is real, and it isn't free. You own the uptime. You own the Postgres backups, the certificate renewal after the first automatic issue, the version bumps on a project that shipped three releases in a single day on 11 September. The install script does more of this than most: it checks dependencies, generates every secret, applies the schema, creates the first admin, brings the containers up and wires the scheduled task that fires automations, and update.sh backs the database up before reapplying the schema idempotently, with a health check at the end and the whole upgrade path exercised in CI. None of which changes the fact that at 2am on a Sunday, the person on call is you.

How the agents answer, and what they read first

The sequence DeskcommCRM describes is worth walking through, because the ordering is the design. A message arrives. Before composing anything, the agent pulls the contact's history, orders and what was agreed last time, then searches the company knowledge base — your lead times, your policy, your catalogue — rather than generating an answer from the model's priors. Only then does it write. Once the lead qualifies, it changes pipeline stage on its own, the tag lands, the owner gets set, and every move carries a recorded reason.

When the conversation reaches a human, that human doesn't inherit the raw thread. They get a summary: what happened, what was agreed, which objections came up, what the next step is. And if nobody replies at all, a follow-up gets scheduled, and a cold lead surfaces in what the project calls the Radar, classified by how long it's been silent and what's still outstanding.

Which models drive any of this, the public documentation does not say. The site tells you that you pay for "the AI keys you consume" and leaves the provider list to configuration. Treat the model question as unanswered until you've read the .env sample, because it determines both your bill and where the conversation text goes.

The seven guardrails are the part worth stealing

Before any message goes out, DeskcommCRM runs seven checks in a fixed, versioned order: opt-out, privacy, anti-ban, copy variation, deterministic promise, semantic promise, automation disclosure. Each evaluation becomes a durable exportable record — and this is the bit most agent stacks skip — including the evaluations that stopped a message from going out at all.

The two promise checks do different jobs. The deterministic one catches a stated fact that contradicts your data, like a 24-hour delivery window for a product whose catalogue lead time is four days. The semantic one catches the same commitment made obliquely, the way a salesperson does when they say "you'll have it before the weekend". The project's own worked example is the deterministic block, and the record it leaves behind says what the agent was about to say and why it didn't.

Copy variation and anti-ban are there for a less noble reason, and it's the one you should think hardest about. Because the WhatsApp connection runs through WAHA and a scanned QR code rather than a paid Business API account, the account you're automating is an ordinary WhatsApp account, subject to ordinary WhatsApp enforcement. Rotating phrasing and throttling sends are mitigations for a risk the architecture creates. Nothing in the repository can promise Meta won't disagree.

What it costs, in the only currency that matters here

The DeskcommCRM software price is zero and stays zero: MIT, modify it, resell it, host it for clients commercially without asking. What running DeskcommCRM actually costs is a VPS plus inference. The sizing guidance is specific enough to plan against — 4GB recommended, 2GB possible but running at the edge, seven containers, about 150MB per live WhatsApp session, and the server compiles nothing because it pulls a prebuilt image.

Install is one command inside the repo's setup kit, and the documentation is candid that you don't need to write code but you do need to follow a procedure with your credentials to hand. For a sales team without an ops person, that's still a real gate, and it's the gate that makes the rest of the savings conditional.

There's a version of this problem DeskcommCRM can't solve for you, because it isn't a CRM problem. Follow-ups fire on a DeskcommCRM scheduler, the Radar re-scores stalled leads on a clock, and both of those want a machine that is awake at 03:00 on a Sunday whether or not anyone is at a desk. A laptop is not that machine, and neither is a VPS you're also using for four other things. Zentor is a hosted cloud AI computer that stays up so scheduled work has somewhere to land — it sits next to an install like this rather than replacing it, and it's the part of the stack you were never going to enjoy running yourself.

DeskcommCRM against Kommo, Octadesk and Intercom

The repository names those three directly, and the comparison it's making is narrow and honest: it's competing on ownership and price shape, not on feature depth. Kommo and Intercom both bring years of integrations, mobile apps, support organisations and a WhatsApp Business API relationship that doesn't depend on a QR code surviving the next policy change. You are trading all of that for a fixed server bill and a database you can query.

Where DeskcommCRM does something the closed platforms mostly don't is the audit trail. Seven recorded guardrail evaluations per message, activity entries for every meaningful mutation, and a public test suite you can read: continuous integration boots a clean Postgres and runs 364 invariant tests, one of which creates two organisations and proves that one sees zero rows belonging to the other, after a control case first proves those rows exist so the test can't pass against an empty table. That last detail is a small thing that tells you a lot about who wrote this.

DeskcommCRM keeps pipeline vocabulary configurable rather than forked, which is how the same core serves a clinic, a sneaker store and a property agency. Agencies get two environment variables that swap the product name and logo across the interface; what they don't get, and the guide says so up front, is per-organisation branding or colour changes without editing the design system.

Who should not install this

If nobody on your side is comfortable with a terminal, a domain and a DNS record, stop here — the assistant that walks you through the install is helpful, and it is not a substitute for someone who can read an error. If your compliance position requires the official WhatsApp Business API, the QR-code route disqualifies this outright. And if you need the system tomorrow with a signed support contract behind it, a four-month-old project shipping three releases a day is the wrong risk.

Everyone else gets a real option. The gap Zentor covers in that setup is narrow but persistent: the agent work that has to keep running when the laptop is shut, on an environment you reach from any machine instead of the one under your desk. Running the CRM yourself and running the always-on half yourself are two separate decisions, and plenty of teams should only make one of them.

Before you commit an evening, read the DeskcommCRM language question honestly. The README leads in Portuguese, the project was built for the Brazilian market and its compliance framing is Brazilian; the English and Spanish versions are complete rather than machine-dumped, but the centre of gravity is clear. If you're evaluating this from outside Brazil, budget time for a few docs pages where the Portuguese is the source of truth. All of the above is accurate as of September 2026, on a project moving fast enough that some of it will not be by October.

FAQ

Is DeskcommCRM free?

Yes. It's MIT-licensed with no paid tier and no gated features, and you're allowed to modify it, host it for third parties and charge for that. Your costs are the VPS and whatever model API usage the agents consume.

Can it run on my own server?

That's the only way it runs. The recommendation is 4GB of RAM; it will boot on 2GB but the project describes that as running at the edge, with seven containers and roughly 150MB per WhatsApp session. Install is one command from the setup kit in the repository, and HTTPS certificates are issued on first access rather than configured by hand.

Does it work with the WhatsApp Business API?

Not as the default path. The documented route is WAHA with a scanned QR code, which is why there's no Meta bill and also why the guardrail list includes an anti-ban check. If your policy requires the official Business API, verify that route in the repository before you build anything on this.

How many people can use DeskcommCRM?

There's no seat limit in the software, which is the entire pricing argument. What limits you is the box: sessions cost memory, so scale the VPS to the number of concurrent WhatsApp connections rather than to headcount.

The question isn't the software, it's who runs it

DeskcommCRM is a more serious piece of work than the star count suggests, and the tell is what the DeskcommCRM authors chose to make verifiable rather than what they chose to claim. A published guardrail order, a tenant-isolation test with a control case, an upgrade path exercised in CI: that's a project expecting to be audited. Whether you should run it comes down to one question that has nothing to do with the code, and you already know the answer — is there someone on your team who will pick up the phone when the containers don't come back after a reboot?