Why we open-sourced Goatfied (and what we kept proprietary)

The reasoning behind Goatfied's open-source strategy — what's open and why, what stays proprietary, and how we think about trust, lock-in, and telemetry for an AI coding tool.

Open-sourcing part of a commercial product is always a set of deliberate tradeoffs, not a slogan. When you're asking engineers to let an AI agent edit their code and open pull requests, trust is the entire game — and trust is hard to earn behind a closed binary. This is an honest account of what we opened, what we kept proprietary, and the reasoning behind each line we drew.

The principle: open the things you need to trust

Our rule of thumb is simple. The parts of Goatfied that a user has to _trust_ — the parts that touch your code, decide what to change, and determine what leaves your machine — should be inspectable. The parts that are about scale, operations, and our own business are fair to keep proprietary.

That gives two buckets.

What's open

**The client-side agent surface.** The code that reads your files, constructs prompts, and applies diffs is the part with the most direct access to your source. You should be able to read exactly what it does with your code.
**The validation and gate logic.** Compile-first reliability only means something if you can see how the gate works. The "does this change compile, lint, and pass tests before it's marked done" logic is open.
**Editor integrations and extension points.** The interfaces you'd build on top of shouldn't be a moving black box.
**Prompt and policy scaffolding.** How tasks become plans, and how policy constraints are enforced, is inspectable — because "trust the prompt" is not an answer.

Openness here isn't charity; it's the only credible way to claim "your code stays under your control" and let people verify it.

What we kept proprietary

**The managed cloud platform.** The orchestration, scaling, and reliability engineering that runs Goatfied's hosted offering is where a lot of our operational investment lives. Self-hosters get the pieces they need; the managed scale layer is ours.
**Model routing intelligence and tuning.** The heuristics that decide how to route and constrain inference for cost and quality are a core differentiator.
**Enterprise policy and control features.** The advanced policy controls that security-sensitive teams pay for.

None of these require you to trust us with your source in a way you can't verify — which is why we're comfortable keeping them closed.

On telemetry — the part people actually worry about

For an AI coding tool, "what are you collecting?" is a fair and important question. Our stance:

Telemetry is opt-in and inspectable where it touches anything sensitive.
The self-hosted deployment keeps transcripts, command logs, and repository data inside _your_ boundary — the audit trail is yours, not ours.
We don't need your proprietary code to improve the product, and the architecture reflects that.

If a vendor can't tell you clearly what leaves your machine, that's a red flag regardless of how good the demo is.

Doesn't open-sourcing help competitors?

A little — and it's worth it. The open parts are the parts that build trust; they're not the operational moat. Cursor, Copilot, and others aren't blocked by not seeing our diff-application code. What actually differentiates Goatfied is the compile-first reliability, the reproducible agent loop, and the managed platform that runs it at scale — and reliability is something you earn in production, not something a competitor copies from a repo.

What this means for you

If you self-host, you can read the code that touches your code. That's the point.
If you use the managed platform, you get the operational reliability we invested in, with the same trust guarantees at the boundary.
Either way, the design goal is the same: automation you can audit, on infrastructure you choose.

Open source isn't a marketing badge for us. It's the mechanism that lets us make a strong claim — _your code stays under your control_ — and invite you to check our work.

[Self-hosted AI coding assistants: a complete Goatfied deployment guide](/blog/self-hosted-ai-coding-assistants-goatfied-deployment-guide)
[The Goatfied agent loop: how we ship code that compiles first try](/blog/goatfied-agent-loop-compiles-first-try)