Twenty

What it is

Twenty is an open-source CRM that your team shapes to its own business. It starts with Companies, People, Opportunities, Tasks and Notes, and you add custom objects and fields beside them. Email and calendar sync fill the records, views and workflows run the daily work, and AI agents act inside your permission model. You can use the cloud product, host it yourself, or extend it with apps written in TypeScript.

1. You sign up for the cloud, or start your own server
2. Connect a mailbox so real emails and meetings arrive
3. Shape objects and fields, then import records from CSV
4. Build views and workflows for the daily work
5. Use the AI chat, connect MCP or add an app if you want more

Who it suits

Teams with developers who want a CRM they can reshape, and organizations that must keep customer data on their own servers. The Meet Twenty page is plain about who should look elsewhere: teams that want a CRM they never have to think about, and companies that need hundreds of pre-built integrations today.

Where to use it

Twenty opens in a browser, in the cloud or on a server you run. It connects to other tools in these ways.

• Google and Microsoft mailboxes and calendars, plus mailboxes over SMTP and calendars over CalDAV
• Workflows with record, manual, schedule and webhook triggers, and steps that call an HTTP address or run JavaScript
• REST and GraphQL APIs generated from your own workspace schema, with a Metadata API for objects and fields
• An MCP server for Claude Desktop, Claude Code, Cursor, ChatGPT and other clients
• Apps that add objects, logic functions and front components, deployed privately or listed on the Twenty marketplace
• Official agent skills for building apps, installed with the skills CLI or as a Codex plugin

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with a page for each route and agent from the maker’s README and docs. The cloud route needs no install. A server of your own takes one command.

1. Install Docker and Docker Compose on the server if they are not there yet.
2. Run the command below.
3. On your own computer, open http://localhost:3000. On a server, check it with curl http://localhost:3000.
4. Set SERVER_URL in the .env file to the address people use, then restart.

bash <(curl -sL https://raw.githubusercontent.com/twentyhq/twenty/main/packages/twenty-docker/scripts/install.sh)

The Docker Compose page puts VERSION in front of the same line to pin a release, for example VERSION=v2.38.1. It must be a full release tag published on Docker Hub, and aliases such as v2 or latest are not accepted. To restart after changing SERVER_URL, the page gives these two lines.

docker compose down
docker compose up -d

How to use it

The Quickstart says to start with your mailbox, because real data gives your team value before you change anything else.

1. Open Settings, then Accounts, and connect a Google or Microsoft account. Another provider uses SMTP for mail and CalDAV for calendars. On a self-hosted server, an admin first sets up a Google Cloud OAuth client or an Azure app under Settings, Admin Panel, Configuration Variables. The Setup page’s calendar and messaging cron jobs must then run in the worker. Microsoft users need a Microsoft 365 license, and personal Microsoft accounts are not supported yet.
2. Open Settings, then Data Model. Add fields to People, Companies and Opportunities, and create custom objects for the rest.
3. Press Cmd+K or Ctrl+K to open the Command Menu and import a CSV. Download the sample file first and deduplicate emails and domains.
4. Then build views and workflows. A workflow has a trigger, steps and variables.

The AI chat answers questions about your records. Agents work through roles, so set their access under Settings, then Members, then Roles. The AI page gives these prompts.

What opportunities are closing this month?
Which deals have been in Negotiation for more than 30 days?
Summarize my interactions with this person

Example

You want to see which deals close this month. You sign up for the cloud, connect your mailbox and import your Opportunities, with their close dates, from a CSV. Then you open the AI chat and ask:

What opportunities are closing this month?

The chat has access to your workspace data, so it answers from your records. It draws on the workspace’s AI credits.

For newcomers and experts

If you are new. A CRM is where a team keeps its companies, contacts and deals. In Twenty those are the Companies, People and Opportunities objects, and a workspace is the space where your team’s data lives. Self-hosted means the server runs on a computer you control.

For experts. Most settings live in the app, under Settings, Admin Panel, Configuration Variables. Infrastructure settings such as PG_DATABASE_URL, SERVER_URL and the encryption keys can only be set in the .env file, and IS_CONFIG_VARIABLES_IN_DB_ENABLED=false moves everything there. ENCRYPTION_KEY encrypts OAuth tokens, application variables and TOTP secrets at rest. Losing it means losing access to every secret in the database.

The Securing page splits an instance into a private zone, a public zone for /webhooks, /s and /emailing, and a zone for cloud AI connectors at /mcp, /oauth and /.well-known. Workflow webhooks only check that the workspace and workflow exist, so anyone with the URL can trigger one. In production the logic-function and code-interpreter drivers start disabled, and the LOCAL driver has no sandbox.

The Apps page says logic functions run in isolated Node.js processes, sandboxed from the host, and front components run in Web Workers through Remote DOM. On a self-hosted server the isolation depends on the driver: the Setup page says LOCAL has no sandbox and names LAMBDA for untrusted code. An app only sees what its role allows. The README defines an object as code like this.

import { defineObject, FieldType } from 'twenty-sdk/define';

export default defineObject({
  nameSingular: 'deal',
  namePlural: 'deals',
  labelSingular: 'Deal',
  labelPlural: 'Deals',
  fields: [
    { name: 'name', label: 'Name', type: FieldType.TEXT },
    { name: 'amount', label: 'Amount', type: FieldType.CURRENCY },
    { name: 'closeDate', label: 'Close Date', type: FieldType.DATE_TIME },
  ],
});

Over MCP, the docs say to call learn_tools for a tool’s schema, then execute_tool.

Good to know

You run the server, so the care is yours. These points come from the repository and the docs.

• License: mostly AGPLv3, with an extra permission the LICENSE file calls the Twenty Application Exception. Files that begin with /* @license Enterprise */ are under a commercial license, and the file says production use needs agreed Twenty terms and a valid Enterprise Edition subscription. The twenty CLI, the SDKs, twenty-ui and the apps under packages/twenty-apps are MIT. GitHub names the license Other, so read the LICENSE file before you run a modified copy for other people
• Backups: the Docker Compose page gives a pg_dump line and a restore line. It says to test restores, keep copies off-site and encrypt them
• Upgrades: back up first, stop Twenty with docker compose down, change TAG in .env, then run docker compose up -d. The server runs the migrations on startup. Version 2.34 and newer need PostgreSQL 15 or newer, and an instance older than v1.23 must step through each major tagged version up to v1.23 first
• Fresh installs: the page’s fix for a Postgres password error is docker compose down --volumes, which permanently deletes all database data. Use it only when nothing is stored yet
• Exposure: the Securing page says to keep the instance off the public internet and open only the paths you need. An IP allowlist checks the network a request comes from, not who sent it
• MCP keys: an API key grants access to workspace data. Keep it out of version control and give it a role that fits the job
• Source checkouts: use yarn, not npm. Node 26 no longer ships Corepack, so install it first
• Data sent out: the pages these notes use do not describe usage data for a self-hosted server. The Setup page says AI file attachments reach the model as links built from SERVER_URL, so a localhost or private one limits AI chats and agents to text. Whatever an assistant reads over MCP goes to that assistant
• Plans: the Quickstart offers a 30-day trial with a card or a 7-day trial without one. Workflows, AI agents and AI chat share a credit balance, and a Usage Limits page caps spending. These notes quote no prices