The Complete Guide to Open-Source Voice AI Agents: Own the Code

An open-source voice AI agent runs on code published under a license that lets anyone read and change it. For a phone agent, you can then check what the software does with every call and run it on your own servers. Which speech and language models hear the audio is a separate choice. Running the servers stays your job.

Key Takeaways

• Open code lets you read what the platform does with every call.
• The platform's license and each model's license are separate checks.
• Only open-weight models on your own servers keep audio away from model providers.

This guide covers what open source changes for a voice agent, from the code you can read to the license terms you ship under. We show how each part works in Dograh, the open-source AI voice agent platform we build. You can self-host it or use our managed cloud.

What open source means for a voice agent

A voice agent platform is the software that runs a phone call, and open source means its code is published under a license that lets anyone read it and change it. The platform holds the call flow and decides when the caller has finished speaking. It calls your systems during the call and connects to the phone network. With a closed platform you see none of that code, only a dashboard and a contract.

With open code, the software that runs your calls is software you can read. Dograh's source code is public under the BSD 2-Clause license, and it runs on a fork of Pipecat, an open-source voice framework under the same license. Your engineers can check what happens to a recording and which services a call reaches, before any caller hears the agent.

Open source also changes who decides where the software runs. You can run Dograh on a laptop or on servers in your own data centre or cloud account, and nobody at Dograh has to approve the install. You can change the code and keep running your changed version.

This guide stays with what open source means for one voice agent. If you want the projects themselves compared, frameworks and full platforms alike, our guide to the best open-source voice AI platforms covers each license and what ships with it.

Two layers, two licenses

A voice agent has two layers, and each has its own license to check. Dograh is the orchestration layer that runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. Our post on the orchestration layer in voice AI lists every job that layer runs.

You can fill the model layer in three ways in Dograh: Dograh's own models, any provider you bring your own key for, or open-weight models you host yourself. You set them per organization in Model Configurations, and an agent can use a different setup from the default.

The open code in the first layer says nothing about the second. A model maker can publish weights under terms that are not an open-source license at all. NVIDIA's Magpie TTS ships under NVIDIA's own Open Model License, so it is open weights, not open source. Parakeet speech-to-text models use CC-BY-4.0, which asks for attribution. F5-TTS uses CC BY-NC 4.0, which rules out commercial use. Read the license on every model card before a model hears a paying customer's call.

Why regulated teams care about open code

For a bank or a hospital, open code is evidence the team can check for itself. In an April 2026 post on open source in regulated industries, the Linux Foundation wrote that "transparency is the primary currency" in those settings. It described a bank tuning a model on local data "within their own firewalls".

Where the data goes is the other half. In Cloudian's 2026 survey of 203 enterprise IT decision-makers, 91% said they would choose on-premises, private cloud or hybrid infrastructure over public cloud for AI that involves sensitive company data. A platform you can run yourself is one way to meet that.

Some voice vendors argue the opposite, that closed voice models, trained on licensed recordings in a private environment, are the safer choice. That is a fair point about one model's training data, and it belongs to the model layer. It says nothing about the software that runs the call. A closed platform deployed in your private cloud moves the servers, yet you still cannot read what it does with a call. With open code you can, and you can still pick any voice model whose license and training data you trust.

Open code does not make a deployment compliant by itself. The rules, from health privacy to call recording consent, are in our guide to compliant AI voice agents. The short version for buyers in healthcare, finance and government is what open-source voice AI is and why it matters for regulated teams.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Where it runs: your servers or a managed cloud

The same open-source platform can run on your servers or on someone else's, and the choice turns on who runs the servers. Self-hosted, Dograh runs on machines you control, so call records sit in your own database and storage. On Dograh Cloud, Dograh runs the servers and you start building at once. The Enterprise plan adds on-premise or private-cloud deployment with Dograh's help, with data residency and a data perimeter.

The agents are the same either way. A workflow is a JSON definition, so an agent built on Dograh Cloud can move to a self-hosted install later. You can also mix the two. A Service Key from a Dograh Cloud account lets a self-hosted install use Dograh's managed models, billed to that Cloud account.

Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost). Dograh Cloud has a 1¢-a-minute platform fee. Self-hosted Dograh runs 10 concurrent calls by default, adjustable with DEFAULT_ORG_CONCURRENCY_LIMIT, and your servers and phone provider set the practical ceiling. Dograh Cloud's Pay as you go plan includes 10 concurrent calls, and for more you contact Dograh.

Our post on self-hosted vs managed-cloud voice AI walks through the choice. The deployment options list each path, from a laptop to a production server.

Running it yourself with Docker

A self-hosted Dograh install is a set of containers started by one script. Dograh ships two images, the API and the web app, and the Docker setup runs them with Postgres for call records, Redis, and MinIO for recordings, all through Docker Compose.

On a laptop, the starter script writes random passwords into a .env file, asks before it starts and pulls the newest images. The first start takes 2 to 3 minutes. Then you open http://localhost:3010, create an account and make a test call in the browser, with no phone line needed. The machine needs at least 8 GB of RAM and 2 CPU cores.

A server that real callers reach needs at least 8 GB of RAM and 4 vCPUs. It also needs HTTPS, because browsers only open the microphone on a secure page. Our tutorial on how to self-host a voice AI agent with Docker goes from the download to that first browser test call, step by step.

How far in-house: BYOK, local models, air gap

How much of a call stays inside your network depends on the models and a few defaults, as much as on where Dograh runs. Self-hosting keeps the platform and the call records on your servers. If the models are hosted APIs, the audio still goes to those providers. Bringing your own keys (BYOK) changes whose contract covers the models, and the audio still reaches the provider.

Audio stays in-house only when open-weight models run on your servers too. Dograh connects them through a provider called Local Models (Speaches), pointed at OpenAI-compatible model servers such as Ollama or vLLM. Our guide to running voice AI on local, self-hosted models covers which models to pick and the hardware they need.

A default install also reaches out in a few places until you switch them off. Telemetry is on by default in the Docker setup. To switch it off, run ENABLE_TELEMETRY=false ./start_docker.sh and delete POSTHOG_API_KEY from docker-compose.yaml, since the start script ignores a telemetry setting in .env. The quickstart also opens a public trycloudflare.com tunnel to the API so phone calls can reach a test install, and a production install uses its own domain instead. Your first test call runs on Dograh's model service, set up at first sign-in, so connect your own models before real calls.

The phone network sits outside any boundary you draw. Every call from a phone passes through a carrier. The tightest setup ends the carrier's line at your own phone system, connected to Dograh through Asterisk, and keeps everything behind it inside. Our post on air-gapped voice agents lists every connection a default install makes and the switch for each.

What the BSD-2 license lets you ship

Dograh's license asks very little of you. BSD-2 is a permissive license, and under the BSD 2-Clause license you can use Dograh, change it, sell products built on it and keep your changes private. If you pass the code or a built copy to someone else, the copyright notice and license text travel with it.

Copyleft licenses work the other way. Under the GNU Affero General Public License (AGPL), if you change the software and people use your changed version over a network, you have to offer them your source code. A closed platform's terms let you use the service and nothing more. You get no copy to run and no code to read.

Two things sit outside Dograh's license. Each model has its own terms, as the section on layers shows. The Docker setup also runs other programs as separate services under their own licenses, such as MinIO from Dograh's AGPLv3 fork, and Redis, whose current 7.x release is source-available rather than open source. Running them unchanged is the normal case. If you plan to change one of them, or to offer the stack to others as a service, check how its license applies and confirm your position with counsel. Our post on BSD-licensed voice AI explains each case in plain words.

What open source does not do for you

Open code hands you control, and the work that comes with it. Someone has to patch the servers and keep the HTTPS certificate valid. Updating Dograh means pulling new images, and the API and web app images must always carry the same version tag.

A fresh install is set up for a quick start, so close its defaults before real callers arrive. Signup is open by default, so set ENABLE_SIGNUP=false in .env after the first account and re-run the start script. Dograh has no retention setting and no automatic deletion for recordings and transcripts, so your own storage rules decide how long calls are kept. Self-hosted, recording upload can be switched off only for the whole server, and transcripts are still saved.

Compliance stays with you too, whatever the license. Our data residency checklist for voice AI walks through every setting that decides where call data goes.

Where to start

Prove one call before you decide how far in-house to go. Build an agent on Dograh Cloud or on a local Docker install, and make a browser test call. Then decide where the platform runs for real callers and which models hear the audio. Close the defaults above before the first real call.

Test on a real phone line before launch. Most phone calls still reach the agent as 8 kHz audio, while a browser demo runs at 16 kHz, so the speech model can hear names and numbers differently.

Each part of open-source voice AI above has its own deep dive:

• What Is Open-Source Voice AI? Why Regulated Teams Pick It
• Self-Hosted vs Managed-Cloud Voice AI: Who Runs the Servers?
• How to Self-Host a Voice AI Agent With Docker
• Air-Gapped Voice Agents: AI Calling With Zero Data Egress
• BSD-Licensed Voice AI: What You Can Build, Sell and Rebrand