The open-source manufacturing ERP, MES & QMS

Quote, plan, buy, build, inspect and ship on one live model of your factory,
from a ten-person prototype shop to a rate-production line.

Start free · Self-host · Docs · API · MCP · Discord · Roadmap

Quote to cash. Quotes, orders, jobs and invoices on one record.

Unfork your BOM. Multi-level BOMs, revisions and configuration.

Traceability by default. Lot and serial genealogy, forwards and back.

• Why Carbon
• Features
• Get Carbon
• API & MCP
• Architecture
• Tech Stack
• Monorepo
• Local Development
• Commands
• Security
• Contributing
• License

Legacy ERPs were built for accountants in the 1990s. We built Carbon after years of running manufacturing on off-the-shelf systems and finding that:

• Modern, API-first tooling didn't exist
• Vendor lock-in bordered on extortion
• There is no "perfect ERP", because every manufacturer is unique

So Carbon puts ERP, MRP, MES and QMS on one Postgres schema you can read, own and extend. Every stage, from CAD to cash, writes to the same record: no handoffs, no re-keying, no reconciliation.

Carbon is an open-source alternative to NetSuite, Epicor, SAP Business One, Plex, Odoo and ERPNext, built for discrete manufacturing: complex assembly, contract manufacturing, configure-to-order and high-mix, low-volume production. See all comparisons.

See the full roadmap for what's next.

Technical highlights

• Full-stack type safety, from the database to the UI
• Row-level security, multi-tenant by design
• Role- and attribute-based access control (Employee, Customer, Supplier)
• Realtime database subscriptions
• Unified auth and permissions across apps
• Dependency graph for operations
• Rust geometry service: STEP → GLB and assembly motion planning

Carbon is API-first. The Carbon API is the service layer, the same code the app runs when you click a button: 1,500+ operations across 15 modules, each validating its input, recalculating what depends on it and enforcing your permissions. Every operation is reachable two ways, with the same arguments:

• HTTP: POST https://app.carbon.ms/api/v1/{module}/{operation}, with a published OpenAPI spec for generating a typed client in any language
• MCP: as tools for Claude, ChatGPT, Cursor and other agents, scoped to the permissions of the key or signed-in user

Create a key under Settings → API Keys, then:

curl -X POST https://app.carbon.ms/api/v1/sales/getSalesOrders \
  -H "Authorization: Bearer $CARBON_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "args": { "limit": 10 } }'

Self-hosted, the same API is served by your ERP at /api/v1. For the rare case the service layer doesn't cover, the Data API exposes every table and view directly.

ERP and MES are React Router apps over a single Postgres database. Permissions (row-level security), computed totals and change events live in the database itself; background work runs through Inngest, which calls back into the ERP to execute jobs. The architecture guide follows one click all the way down.

A pnpm + Turborepo monorepo:

carbon
├── apps         # ERP, MES and the Rust assembler
├── packages     # shared TypeScript packages
├── crates       # Rust crates behind the assembler (CAD conversion, collision, motion planning)
└── docs         # docs.carbon.ms, with content and glossary as @carbon/content

Prerequisites: Docker, Node.js 22 and pnpm (via Corepack). On Windows, use WSL or Git Bash.

git clone https://github.com/crbnos/carbon.git && cd carbon
corepack enable && pnpm install
cp .env.example .env
pnpm dev

pnpm dev boots the whole backend in Docker (Postgres, PostgREST, auth, storage, realtime, Inngest, Redis and a mail catcher), applies migrations, generates types and starts the apps:

Sign in as test@carbon.ms: the dev stack seeds that user and skips the magic link. To fill a company with a full demo story (items, BOMs, orders, jobs, inspections, journals), seed one of the industry datasets (satellite, robotics, precision, motor):

pnpm db:seed:dev -- --email test@carbon.ms --dataset satellite

No external accounts are needed to run locally. Email, Google/Microsoft sign-in, Stripe, PostHog and AI providers are all optional and configured in .env; see environment variables.

pnpm dev is shorthand for crbn up --no-portless. Run source ./setup.sh once to put crbn on your PATH and you get a separate, isolated stack per git worktree, so several branches can run side by side, each on its own HTTPS .dev URLs via portless:

crbn checkout -b feat/my-thing   # new branch + worktree off HEAD
crbn up                          # boot this worktree's stack at erp.<branch>.dev
crbn checkout 760                # check out PR #760 into its own worktree
crbn status | down | reset       # ports and health, stop, wipe and reboot

The full command reference is in the local development guide.

This project uses Biome for formatting and linting; install the VS Code extension for format-on-save.

Found a vulnerability? Please email support@carbon.ms instead of opening a public issue. We respond within 3 business days and credit reporters once a fix ships. The full policy is in SECURITY.md.

Security is enforced by the database, not left to application code:

• Tenant isolation in Postgres. Every table is scoped to a company and guarded by row-level security, so a query can only see its own company's rows.
• Granular permissions. Role-based access per module and action for employees, customers and suppliers, applied the same way in the app, the API and MCP.
• Scoped API keys. Keys carry explicit permissions, are stored only as hashes and are rate limited per key.
• Sign-in. Passkeys, SSO, and enforced two-factor authentication on the Business plan.
• Audit log. A record of who changed what and when, on the Business plan.
• Your perimeter. Self-host on a single server, in your own cloud account or fully air-gapped, for programs with ITAR or CMMC requirements.

We welcome contributions of all sizes. Read CONTRIBUTING.md to get started, and say hi in Discord. Good first issues are labelled good first issue.

Carbon is open core. Everything in this repository is licensed under AGPLv3, except the Enterprise files (packages/ee and any file whose name contains .ee.), which are under the Carbon Commercial License. See Licensing for what that means in practice.