Pinchy vs Onyx
Onyx (formerly Danswer) is an open-source AI platform built around connected knowledge: permission-aware search and chat across 50+ sources, custom agents, actions over MCP and OpenAPI, and, in its paid Craft feature, approval-gated actions in external apps. Pinchy starts from the other end: agents that act inside your business systems, default-deny per agent, with every call in a signed, hash-chained audit trail. Both are self-hosted and chat-first.
The Core Difference
Connect 50+ sources, then ask. Onyx retrieves across your documents and apps and answers in chat, respecting the permissions of the underlying systems. Agents can also call actions, and Craft takes approved actions in connected apps. Knowledge is still the center of gravity.
Pinchy agents work inside your business systems: they create the sales order in Odoo, draft the email, answer from your documents. The center of gravity is bounded action. Each agent has only the tools an admin granted it.
Onyx's signature is document-level permission sync: answers inherit who-can-see-what from the source. Pinchy's signature is the grant: which tools each agent may use, and a signed, hash-chained record of every call it made.
Side by Side
Figures as of 16 October 2026, taken from Onyx's public pricing, product and documentation pages and its GitHub repository. Check Onyx for current details.
| Onyx | Pinchy | |
|---|---|---|
| Center of gravity | Connected knowledge: search, RAG, plus agents and actions | Agents that take actions in business systems |
| License (core) | MIT (enterprise dirs separately licensed) | AGPL-3.0 |
| Connectors / integrations | 50+ source connectors; actions via MCP and OpenAPI; Slack and Discord bots | Odoo (read + write), email, web search, knowledge base; chat in web UI and Telegram |
| Retrieval / RAG depth | Hybrid search, knowledge graph | Hybrid search over folders you grant per agent, indexed locally, cited to the page |
| Document permission sync | Yes (self-hosted EE) | Not offered |
| Per-agent tool permissions | Actions chosen per agent; Craft: Auto-approve, Ask or Deny per action (Business or Enterprise license) | Default-deny allow-list per agent: no tools until an admin grants them |
| RBAC & groups (self-hosted) | Enterprise Edition | Admin/Member roles free; groups and agent visibility in Pro |
| Audit of agent actions | Query history and usage analytics; since v4.3 a SIEM audit-event stream for auth, access, config and credential events. Docs list no agent tool calls and describe no signing | Every tool call and knowledge-base retrieval; each row HMAC-SHA256-signed and hash-chained, built-in verifier, CSV export |
| Local models | Yes (Ollama, vLLM, LiteLLM); air-gappable self-hosted deployment | Yes (Ollama), fully offline |
| Self-hosted | Yes (also offered as managed Onyx Cloud) | Yes (first-class, GHCR images) |
| Pricing | MIT core free. Business $20/user/month, billed annually; Enterprise by quote (adds SSO, on-premise) | Community free (AGPL), no user limit; Pro €1,188/yr for up to 10 users, quote above |
Being Honest
50+ source connectors (Google Drive, Slack, Confluence, Salesforce, SharePoint and more) with strong hybrid retrieval, plus actions over MCP and OpenAPI and bots for Slack and Discord. For company-wide search, Onyx covers far more ground than Pinchy's integration list.
Onyx inherits access-control lists from source systems, so answers only surface documents a user may already see. For knowledge access, that is deeper than Pinchy's tool allow-lists. Pinchy does not mirror source ACLs.
Over 32k GitHub stars (October 2026), backing from Khosla Ventures, First Round Capital and Y Combinator, and SOC 2 Type II, all per Onyx's own site and repository. Onyx is further along the maturity and trust curve than early-stage Pinchy.
If the primary job is "ask the company's knowledge anything", Onyx's retrieval and research agents are built for exactly that, and its 50+ connectors reach into the SaaS tools where much of that knowledge lives. Pinchy runs hybrid search too since v0.9.0 — vector plus full-text, cited to the page — but it reads folders you mount rather than connected systems, and its index takes PDFs only. Narrower ground, covered properly.
Onyx agents can call external actions over MCP and OpenAPI. Craft, available with a Business or Enterprise license, takes approved actions in apps such as Gmail, Slack, HubSpot and GitHub. Each action has an Auto-approve, Ask or Deny policy, with an approval card and fail-closed handling when a request expires. Pinchy has no runtime approval step.
Where Pinchy Wins
Reading and answering is the start. Pinchy agents create and update records in Odoo and draft email, and send it when you grant email_send. The reach is narrow on purpose: Odoo, email, web search and your documents.
Agents get no tools beyond their own workspace until an admin grants them, per agent; templates propose a starting set, and only admins create agents. Every tool call is recorded in an audit row that is HMAC-SHA256-signed and hash-chained, with a built-in verifier. Onyx's audit-event stream covers auth, access and config events; its docs list no agent tool calls and describe no signing.
The allow-list per agent, the signed audit trail, the integrations and offline operation are in the free Community edition, with no user limit. Pro adds groups, agent visibility and usage analytics: €1,188/yr for up to 10 users, quote above. For self-hosted Onyx, RBAC, SSO and permission sync sit in the Enterprise Edition. Pinchy's licence covers neither servers nor model usage.
Pinchy ships a deep Odoo integration: query stock, create orders, book a receipt from a photo, all from chat or Telegram. Acting inside an ERP is a first-class use case.
Pinchy does not ask before it acts. The control is the grant. Grant email_draft but not email_send, or Odoo read tools without write tools. An admin sets the boundary per agent before it runs, instead of a user approving each action while it runs.
The license key is validated offline and Pinchy sends no telemetry. What runs on your infrastructure stays on your infrastructure, air-gapped if you want.
Decision Guide
The job is secure question-answering across many documents and apps, possibly with approval-gated actions. Connector breadth matters. Answers must respect who can see what in the source systems.
The job is agents that take actions in business systems, especially Odoo. You want a default-deny allow-list per agent and a signed, hash-chained record of every action.
Onyx covers company-wide knowledge search, and Pinchy handles the agents that act on what those answers imply. They address adjacent halves of the same workflow.
FAQ
They overlap on the surface and differ at the core. Onyx (formerly Danswer) is an open-source AI platform built around connected knowledge: chat over your company's documents, with answers that respect source-system permissions, plus agents and actions. Pinchy is an agent platform where the agent takes actions in business systems under a default-deny allow-list. If the job is secure question-answering across documents, Onyx fits. If the job is agents that read and write to tools like Odoo under admin control, Pinchy fits.
Yes. Onyx's community edition includes custom agents, actions over MCP and OpenAPI, a code-execution sandbox and a deep-research agent. Craft, which needs a Business or Enterprise license, takes approved actions in connected apps with an Auto-approve, Ask or Deny policy per action. The emphasis is knowledge work. Pinchy's emphasis is action governance: agents that take bounded actions in business systems, with every action signed and hash-chained in an audit trail.
Yes. Onyx self-hosts, describes its deployment as air-gappable, and supports local models via Ollama, vLLM, and LiteLLM, the same direction as Pinchy with Ollama. Local-model support is not a differentiator between the two.
For self-hosted deployments, Onyx's Enterprise Edition gates SSO/OIDC/SAML, user groups and RBAC, the permission-sync connectors that inherit document ACLs from source systems, usage analytics, and encrypted secrets. The community edition is MIT-licensed and includes chat, RAG, agents, actions, and 50+ connectors. Onyx's Business plan ($20 per user per month, billed annually) lists RBAC and permission inheritance; Enterprise, by quote, adds SSO and on-premise deployments. Pinchy's free Community edition has no user limit and includes Admin/Member roles and a tamper-evident audit trail (HMAC-SHA256-signed, hash-chained, with a built-in verifier). Groups, agent visibility and usage analytics are in Pro: €1,188 per year up to 10 users, quote above. Figures as of 16 October 2026.
Use Onyx when the core job is letting a team ask questions across many documents and apps, with answers that respect who may see what in the source systems. Its connector breadth and retrieval quality are strong. Use Pinchy when you want agents that take actions in business systems, with a default-deny allow-list per agent and a signed record of every action.
Self-host Pinchy yourself in minutes, or book a call to talk it through. Your choice.
Or email us: info@heypinchy.com