Carbon open-sources ERP suite manufacturers can self-host or run fully air-gapped

What launched

Carbon, the company behind the carbon.ms manufacturing platform, has published its ERP, MRP, MES and QMS suite as open source and made a self-hosted edition available. The announcement reached the front page of Hacker News on 24 September as a Show HN post. It positions the product as a complete manufacturing system of record that runs on infrastructure the customer owns: a single server, a private cloud VPC, or a network with no outside connection at all.

The Community edition lives on GitHub under AGPL-3.0 and is free to self-host. According to Carbon, it is the same codebase that powers its managed cloud at app.carbon.ms, meaning a self-hosted deployment is not a stripped-down variant of the hosted product.

One Postgres database for everything

The central architectural claim is that all four modules share a single Postgres schema protected by row-level security. Carbon argues this removes the integration work that normally comes from stitching separate systems together: no sync jobs between tools, no vendor data lake, and one database to back up, audit and secure.

Functional coverage, per Carbon, includes:

• ERP: quotes, sales orders, purchasing, inventory and job costing, plus multi-entity, multi-location accounting with per-entity currencies, charts of accounts and consolidated books
• MRP: demand and supply planning, with BOM and routing versioning
• MES: digital travelers with work instructions, operator terminals, QR and barcode tracking, and finite-capacity scheduling
• QMS: first article inspection, an NCR-to-CAPA workflow with sign-off, calibration, and forward and backward serial and lot genealogy

On traceability, the company says any serial number can be pulled up with its full genealogy — material certs, operators, measurements and deviations — from a database sitting behind the manufacturer's own firewall.

Deployment options

The stack ships as Docker containers covering the application, API, an MCP server and Postgres, and Carbon says a single host can be stood up with docker compose for evaluation. From there, the same source scales into a customer's own VPC on AWS, GCP or Azure against managed Postgres, with the customer keeping the network, keys and backups. The third option is fully on-premise operation with no outbound calls. The codebase itself is a typed TypeScript monorepo with a React front end.

The open-core boundary

Not everything is free. The REST API and MCP server are Business-tier features, and self-hosting them requires a commercial license; Enterprise modules and air-gapped licensing are also paid. That AI surface is notable: because every table is a REST endpoint and a built-in MCP server exposes the backend, customers can point agents such as Claude, ChatGPT or a local model at their live production data inside their own perimeter — but only with the commercial license when self-hosting.

The AGPL-3.0 terms carry obligations of their own. Carbon says a private fork is fine, but if you modify the software and let others use it over a network, you must offer them the source; a commercial license removes that requirement.

Built for regulated shops

The explicit target market is defense, aerospace and other regulated manufacturers handling controlled unclassified information. Carbon's argument is that these shops cannot ship their record of production to someone else's cloud, so self-hosting keeps CUI inside a CMMC and NIST 800-171 boundary the manufacturer controls. For Enterprise deployments, the company provides the System Security Plan, POA&M and SPRS score inputs an assessor would request, mapped to how Carbon runs on the customer's infrastructure. Air-gapped licensing is aimed at ITAR-restricted and classified programs, and white-glove deployment, legacy data migration and an SLA are offered for regulated accounts.

Why it matters

Manufacturing software has leaned heavily on closed, cloud-hosted suites, leaving shops with little leverage over where their production data lives or what it costs to leave. A credible open-source alternative changes that in two ways: buyers get an auditable codebase they can inspect before sensitive records ever touch it, and the data-residency obstacle that has kept some regulated manufacturers on aging on-premise systems or spreadsheets disappears.

The trade-offs are real. The most interesting integration surface — the API and MCP-based AI access — and air-gapped operation sit behind a commercial license, and AGPL-3.0 obligations deserve legal review for anyone modifying the code. Still, for shops that wanted a modern ERP without handing their system of record to a vendor, this is a meaningful new option, and its front-page reception on Hacker News suggests interest in self-hostable manufacturing software extends well beyond the defense niche it was built for.