Contributing and community

Carina core is MIT licensed. You can install from npm, clone source, and contribute without a contributor agreement.

Questions before contributing? Email [email protected].

Start here

Resource	Link
Source (core only)	github.com/malike2356/carina-mutant
npm package	carina-agent
Community hub	carinaai.uk/community
Questions and ideas	GitHub Discussions
Bugs and features	Issues
Conduct	CODE_OF_CONDUCT

The private carina-ai monorepo is VERLOX internal (ops, Scout server, deploy). Contributors work in carina-mutant only.

Best first contribution: a skill pack

Skill packs are the lowest barrier and highest leverage path. You add domain workflows and knowledge without changing the agent core.

1. Read Creating packs
2. Study property-uk in the public repo under src/skills/packs/property-uk/
3. Propose your pack with the skill pack issue template
4. Open a PR or publish to skills.carinaai.uk

Development from source

git clone https://github.com/malike2356/carina-mutant.git
cd carina-mutant
pnpm install
pnpm build
pnpm test

See Getting started for Postgres, Redis, and first-run setup.

Code contributions

• Fork carina-mutant, branch from main
• Run pnpm test and pnpm build before opening a PR
• One focused change per PR when possible
• Full guide: CONTRIBUTING.md

Look for issues labeled good first issue.

What to build together

Area	Examples
Skill packs	Finance, legal, healthcare workflows (your domain expertise)
Tools	New MCP-compatible tools with tests
Gateways	Channel adapter improvements, docs for setup
Providers	New LLM provider wiring
Docs	Tutorials, troubleshooting, examples

Commercial vs open source

Open (MIT)	Commercial (VERLOX)
carina-agent core	Carina Cloud hosted SaaS
Skill packs you author	Labyrinth Scout separate security product
Self-host with Docker/npm	Enterprise trust and provisioning

You can self-host Carina Mutant for free under MIT and optionally add the separate Scout product or Carina Cloud later.

Security

Report vulnerabilities privately per SECURITY.md. Do not open public issues for security bugs.