What is Open Ontologies?
Open Ontologies is a command-line engine and MCP server for teams that look after a production ontology. An ontology is a formal vocabulary for a domain, written in the W3C standards RDF and OWL (or SKOS for taxonomies and thesauri): it says what a Supplier, a Jurisdiction or a Diagnosis is and how they relate, so that software and reasoners can draw conclusions from it. Knowledge-graph and data-governance teams maintain these files, and a one-line edit can change thousands of downstream conclusions.
The engine treats an ontology change the way Terraform treats infrastructure: plan a proposed Turtle file against the store, read the blast radius and risk score, apply, watch for drift and roll back. Its reasoner can also write a derivation certificate that a separate checker, proved sound in Lean 4, re-verifies without the engine or a network. It ships as one binary with an embedded Oxigraph triple store and SQLite for state, plus a Docker image on GHCR, a pure-Python engine (open-ontologies-lite 0.5.0 on PyPI) and a desktop Studio.
Fabio Rovai maintains it at Tesseract Semantics, a UK company that sells a hosted platform and enterprise engagements built on the engine. The repository was created on 9 March 2026, is MIT-licensed, has about 2,600 GitHub stars and 287 forks, and released v2.1.0 on 23 October 2026. Its README declares the MCP registry name io.github.fabio-rovai/open-ontologies, but a search of the official registry on 31 October 2026 returned no entry.
Is Open Ontologies worth it?
Open Ontologies answers a question most ontology tooling leaves to code review: what does this change actually do? A text diff of one added rdfs:domain triple is one line long. The README plans exactly that change and reports no classes added, none removed and a blast radius of zero triples; the conservativity check then finds 901 new consequences in 0.04 seconds, because every individual using that property has just acquired a new type. That second number is the reason to look at it.
The plan step is the Terraform part. The proposed Turtle is the complete desired state, so anything missing from it is deleted, and the plan lists added and removed classes, properties and individuals, how many triples reference what is going (the blast radius), a low, medium or high risk score and a logic block that flags new defects or an inconsistency the change introduces. Locked IRIs cannot be removed, the last 100 plans are kept by ID, and SPARQL watchers can block the next apply or roll back automatically. One design choice matters for pipelines: apply does not re-read the risk score, so a high-risk plan goes through unless your CI gates on it or a monitor blocks it.
The auditor proof is neither a signature nor a hash chain. It is a derivation certificate: two tab-separated files, the asserted triples and one line per inferred triple naming the rule and its premises, plus a SHA-256 digest of the assertions. A small checker written in Lean 4, whose soundness is a machine-checked theorem, replays every line and exits 1 on a forged conclusion, naming the rule. That covers the forward-chaining RDFS and OWL RL profiles and Horn rules you supply, which earn a weaker verdict word. The OWL DL tableau, which the v2.1.0 notes say now matches HermiT 1.4.3's 500 subsumptions on the Pizza ontology, returns answers with no certificate, and the digest binds a proof to bytes, not to whoever produced them. The docs state all of this plainly.
The AI sits outside the engine. Per SECURITY.md there is no model inside it and no outbound call in a default build; an agent in Claude Code or Cursor is simply a caller of its 124 onto_* tools, and the quickstart has Claude drafting OWL that the engine then validates and reasons over. Read and write tools share one surface: onto_apply, onto_rollback, onto_clear, onto_push and onto_reason (which writes inferences into the store by default) sit beside query and lint, so a tool profile such as validation or governance is worth setting. Network access comes only from tools that ask for it, the embeddings build's 448 MB model download, and the Studio chat panel, which sends your conversation to Anthropic or an OpenAI-compatible provider.
Against the incumbents it is a complement rather than a replacement. Protégé, Stanford's free OWL editor, is where you draw the class hierarchy, and the README says so. Stardog and TopQuadrant sell a governed server with connectors and access control; Open Ontologies has an embedded Oxigraph store, reaches other triple stores only through SPARQL endpoints and keeps its state in local SQLite. The rough edges are those of a project under eight months old with a long tail of research features: storage is in memory unless OPEN_ONTOLOGIES_STORAGE_MODE=persistent is set, so a load followed by a separate reason call certifies nothing, and the published binaries leave out the tools that need optional Cargo features. For a team whose real problem is proving that last Tuesday's edit did what the ticket said, the certificate earns the setup: a file an auditor can check without trusting the vendor, the engine or the model that drafted the ontology.
Where it earns its place
A knowledge-graph engineer at a bank maintaining a sanctions and supplier ontology
Gate ontology pull requests on what a change means, not just its diff
Run open-ontologies batch with load and plan in CI against the proposed Turtle, fail the job on a high risk_score or new logic defects, and archive the certificate directory with the merge. Free; the CI must gate explicitly, because apply will not refuse a high-risk plan on its own.
A compliance lead preparing for an external model audit
Hand the auditor evidence for derived conclusions that they can re-check themselves
Ship asserted.tsv, derivations.tsv and asserted.sha256 from a reason --certificate run; the auditor builds the Lean checker with lake build and runs oo-cert offline, getting exit 0 or the rejected line and rule. OWL DL unsatisfiability results are not covered and need a separate explanation.
A data engineer at a government agency mapping spreadsheets into a published vocabulary
Turn CSV and XLSX registers into validated RDF and see what breaks
Ask Claude through the MCP server to call onto_map, onto_ingest and onto_shacl, then onto_reason, with the validation tool profile selected. PostgreSQL and DuckDB ingest needs a source build with the sql features.
Before you commit
- Setup
- Download the release binary for macOS, Linux or Windows, or docker pull ghcr.io/fabio-rovai/open-ontologies:latest, run open-ontologies init, then add open-ontologies serve to the MCP client config; the quickstart claims a validated, queryable ontology in under 2 minutes. Auditors need a Lean 4 toolchain, or the oo-cert binary, which ships prebuilt for x86_64 Linux only.
- Integrations
- 124 MCP tools over stdio or streamable HTTP, also exposed as CLI subcommands; reads and writes Turtle, N-Triples, RDF/XML, N-Quads and TriG and exports OWL functional syntax; ingests CSV, JSON, NDJSON, XML, YAML, XLSX and Parquet, plus PostgreSQL and DuckDB in source builds; pulls from and pushes to remote SPARQL endpoints; a catalogue of 33 standard ontologies.
- Data and privacy
- Everything is local by default: graphs in Oxigraph, plans, versions and lineage in SQLite under ~/.open-ontologies. No LLM and no outbound calls in a default build; whatever an agent reads through the tools goes to that agent's model provider. serve-http binds to 127.0.0.1 with an optional bearer token and no TLS; on 0.0.0.0 without a token anyone on the network gets full read and write access. WASM plugins run in-process and are not sandboxed beyond fuel limits.
- Cost at scale
- The engine is free and runs on a laptop; reasoning cost is CPU time, bounded by a per-phase timeout. The embeddings build adds a 448 MB ONNX model. Tesseract Semantics' hosted platform and support are priced on request.
- Limits
- Storage is in memory unless OPEN_ONTOLOGIES_STORAGE_MODE=persistent is set; --data-dir is a flag, not an environment variable. The published binaries and GHCR image omit eight tools that need the embeddings, plugins, postgres or duckdb features. The DL tableau supports SHIQ without nominals, and certificates bind to bytes rather than to a store's history.
What’s good
- Plans report semantic consequences, not only a text diff
- Certificates re-check offline with a proved-sound Lean checker
- One Rust binary, no JVM, no LLM inside, no default telemetry
- Locks, watchers, auto-rollback and an append-only lineage log
What’s not
- Apply ignores the risk score unless CI or a monitor gates it
- OWL DL answers carry no certificate
- In-memory storage by default catches out CLI users
- 124 tools mix read and write; profiles needed to narrow them
Best for
Knowledge-graph teams who change a production OWL or RDF ontology regularly and must show a reviewer or auditor what each change entailed.
Open Ontologies: common questions
- Is Open Ontologies worth it?
- Open Ontologies brings Terraform-style plans and checkable proofs to ontology changes, and it is unusually honest about where its guarantees stop. We rate it 4.1 out of 5.
- How much does Open Ontologies cost?
- Free and open source (MIT). Tesseract Semantics sells a hosted platform and enterprise support at unpublished prices, and offers a no-cost one-month evaluation to its next ten enterprise teams.
- What are the downsides of Open Ontologies?
- Apply ignores the risk score unless CI or a monitor gates it; oWL DL answers carry no certificate; in-memory storage by default catches out CLI users; 124 tools mix read and write; profiles needed to narrow them.
- Who is Open Ontologies best for?
- Knowledge-graph teams who change a production OWL or RDF ontology regularly and must show a reviewer or auditor what each change entailed.
- How much does Open Ontologies cost for a team or in production?
- The engine is free and runs on a laptop; reasoning cost is CPU time, bounded by a per-phase timeout. The embeddings build adds a 448 MB ONNX model. Tesseract Semantics' hosted platform and support are priced on request.
- Is Open Ontologies safe for company data?
- Everything is local by default: graphs in Oxigraph, plans, versions and lineage in SQLite under ~/.open-ontologies. No LLM and no outbound calls in a default build; whatever an agent reads through the tools goes to that agent's model provider. serve-http binds to 127.0.0.1 with an optional bearer token and no TLS; on 0.0.0.0 without a token anyone on the network gets full read and write access. WASM plugins run in-process and are not sandboxed beyond fuel limits.
Answers checked Oct 31, 2026.
Make Open Ontologies? Show this rating on your site
