Today we are opening the Upstep repository. The dashboard, feedback API, public roadmaps, integrations, billing, web and mobile SDKs, deployment setup, and the MCP server are all there. You can inspect the code, run the product on your own infrastructure, change it, and contribute back.
Why open source a feedback product?
Feedback is one of the most valuable datasets a product team owns. It contains unfinished plans, customer pain, internal decisions, and a fairly honest map of where the product is weak. Asking a team to put all of that into a black box requires trust. We would rather earn that trust with code you can inspect and an exit path you control.
There is a practical reason too. Upstep sits at the intersection of your product, your users, and now your coding agents. Every team wants to connect that loop differently. Open source means you do not need to wait for our roadmap to add an integration, change a workflow, or deploy into an environment with stricter data requirements.
What is included
- The Next.js dashboard, public feedback API, voting, moderation, labels, statuses, boards, and public roadmaps
- The project-scoped MCP server used by Claude Code, Codex, Cursor, Windsurf, Copilot, and other MCP clients
- Web, React, React Native, and Flutter SDKs for collecting feedback inside a product
- Slack, Discord, email, and generic webhook integrations with durable delivery retries
- PostgreSQL schema and migrations, Docker Compose, production containers, health checks, and CI security workflows
The server is licensed under AGPL-3.0. The independently distributed SDK and shared-type packages remain MIT licensed, so application developers can embed them without inheriting the server license.
A security boundary we wanted to get right
Opening the code also gave us a reason to make the credential model explicit. Publishable SDK keys start with upstep_pk_ and are designed to live in browser and mobile applications. Private MCP keys start with upstep_mcp_, grant project-scoped read and write access, are shown once, and are stored only as SHA-256 digests. A public client key is never treated as an authorization boundary for private project data.
How Upstep remains a business
Open source does not mean the hosted product disappears. Most teams do not want to operate a database, migrations, OAuth, email delivery, billing webhooks, backups, and notification workers for a feedback widget. Upstep Cloud remains the fastest way to use the product, with a free plan and paid plans for teams that need more capacity and support.
The business model is straightforward: the software is available, and we charge for the convenience and reliability of running it for you. We think that is a healthier incentive than hiding basic product capabilities behind a proprietary wall.
Run it yourself
git clone https://github.com/TheBugEater/upstep.git
cd upstep
cp apps/web/.env.example apps/web/.env
docker compose up --buildUpstep runs as one application backed by PostgreSQL. Redis is not required. The repository includes committed Prisma migrations, a dependency-free health endpoint, a production startup script, and documentation for OAuth, email, Stripe, SDKs, and the REST API.
What we want from the community
Try it, question the decisions, and tell us where the self-hosting path is rough. Contributions to SDKs, integrations, accessibility, documentation, and deployment targets are especially welcome. If you find a security issue, please use the private reporting process in SECURITY.md rather than opening a public issue.