Frappe CRM, or customization as reviewable code instead of metadata in a running database?
Frappe CRM, the metadata-driven CRM app
People ask this as: frappe crm alternative when customization must live as reviewable code
Frappe CRM is a working end-user CRM app on the Frappe low-code framework, with the most mature metadata-driven customization model in the researched set and a managed cloud behind it; this is a framework that generates a CRM into your repository. The axis of the comparison is where a customization lives — metadata in a running database, or code in a repository a human reviews. Every fact about Frappe here traces to one dated internal research file; nothing was installed or run, and what that file does not carry is absent from this page rather than inferred.
Where this stops
Read this before the rest of the page. Every line below is a thing this does not do.
Every fact about another project on this page is single-sourced to
docs/strategy/COMPETITOR_MAP.md and dated 2026-08-04. Nothing from
another project was installed, configured or run, and there is no network access here to re-verify
any of it.
- No hands-on evaluation: nothing from Frappe was installed, configured or run to produce this page.
- Every competitor fact is single-sourced to docs/strategy/COMPETITOR_MAP.md and dated 2026-08-04.
- Licence descriptions are factual summaries of published texts, not legal advice.
- No authentication, tenancy or RBAC in this framework; an actor header is an assertion, not an identity (L-01).
- SQLite only. PostgreSQL is on a track, not in the code (L-02).
- This is a framework, not a product you sign up for: no hosted CRM, no free tier, no account (L-07).
- Nothing installs from npm: the bootstrap runs from a checkout, ownership is copying source, and upgrading is merging (L-08).
- No build-rate or speed claim in either direction — the benchmark has not been run (L-03).
No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network. Every claim and every limitation is on one page.
Where Frappe CRM wins
It is a CRM your team can use. The research file this page reads — docs/strategy/COMPETITOR_MAP.md, dated August 4, 2026 — records Frappe CRM as an end-user CRM app on the Frappe low-code framework (Python, MariaDB, Vue) at 3.1k GitHub stars, deployable on Frappe Cloud, Docker or bench, with SMBs and the ERPNext ecosystem as its customer. This framework is none of that: there is no hosted product and no account (L-07), no authentication, tenancy or RBAC (L-01), persistence is local SQLite (L-02), and nothing installs from npm — the bootstrap runs from a checkout, so ownership means copying source and upgrading means merging (L-08). If what you need is a CRM in use this quarter, the comparison ends in Frappe's favour before it starts.
Its customization model is a strength on its own terms. The file calls the DocType metadata model the most mature metadata-driven customization model in open-source CRM: forms and APIs are auto-generated from metadata in a running system, so an administrator shapes the application without writing code. Where the person doing the customizing is an admin rather than a developer with a repository, that is the better fit — and the huge ERPNext adjacency the file records means a company already inside that ecosystem has every reason to stay in it.
Where this is different
The axis is where a customization lives. The research file's criticism of Frappe is precise: configuration lives in the database rather than in the repository, and metadata customizations have a weak git and review story — in its words, the worst possible shape for a coding agent, because there are no diffs, no review and no tests. Here the same act produces source. A module manifest becomes a migration, a service, a REST resource, an SDK method and Admin screens with no page code (C-01); modules then evolve through explicit revisions, a checked-in state file and append-only named migrations, so history is added to rather than rewritten (C-19); and one command reads checked-in source and reports what the application actually is as deterministic JSON (C-14). None of that says the metadata model is wrong. It says the two models are built for different reviewers: an admin in a running system there, a human reading a diff here.
The agent surface. The file records no first-party MCP in Frappe, with the community building third-party bridges, and it reads the demand recorded in frappe#33170 — MCP with permissions and audit — as evidence for the governance thesis this framework is built on. Here MCP is first-class in every project: the server exposes project context and narrow write tools, and anything that generates code or destroys state is dry-run unless an explicit apply flag is passed (C-18), while every mutation leaves an audit event and a step-level trace behind it (C-16). The symmetry should be stated honestly: their gap is a missing first-party agent surface on a working product, and this is a working agent surface on a framework with no product around it.
The stack difference is recorded but not scored. The file describes Python/MariaDB as outside the coding-agent mainstream and Frappe's AI story as entirely third-party. That is the file's characterisation, not a measurement — the benchmark that could turn it into one has not been run, so no build-rate claim appears here in either direction (L-03).
How to choose
Choose Frappe CRM if you want a CRM in use soon rather than a repository to build one in; if customization by an administrator in a running system is how your organisation works; if you are in or near the ERPNext ecosystem; if a managed cloud matters; and if the AGPL app licence fits what you are shipping — the file records the app as AGPL while the underlying framework is MIT.
Choose this framework in the narrow case: the deliverable is a bespoke commercial process that must exist as reviewable code in your repository, written mostly by a coding agent, with approvals, audit and trace as framework primitives — and you can supply authentication, hosting, PostgreSQL, import and export yourself, because none of them is here (L-01, L-02).
If what you actually want is a governed MCP endpoint over a hosted CRM — permissions, audit, an identity behind every call — the honest answer is that neither column has it today: the file records Frappe's MCP as third-party bridges, and the server here is stdio and local only, with no authentication anywhere (L-01).
What this comparison does not cover
No hands-on evaluation. Nothing from Frappe was installed, configured, benchmarked or run in producing this page. Every fact traces to docs/strategy/COMPETITOR_MAP.md, researched on August 4, 2026, and this environment has no network access to re-verify any of it.
No feature matrix. The file does not enumerate Frappe CRM's pipeline, UI, reporting or automation features, so this page says nothing about them, and nothing should be inferred from the omission.
No pricing. The file records that Frappe Cloud exists and carries no price for it, so no cost comparison is possible here.
Licence descriptions are factual summaries of published texts, not legal advice. The AGPL-app, MIT-framework split is the file's summary; questions about share-alike obligations belong with counsel.
When the competitor research is refreshed, this entry must be re-read against it. A dated page is only as good as its date.
The evidence this page rests on
Claims and limitations are printed from site/claims.json word for word. Job statuses come from docs/benchmarks/jobs.json; a job with no page of its own is listed with its status rather than linked.
Claims
- C-01 Write a module manifest; the agent turns it into a migration, a service, a REST resource, an SDK method and Admin screens — with no page code.
LimitGenerated CRUD only. The factory does not generate workflows or approvals for a custom object — that is still handwritten (JTBD-06, partially supported).
- C-14 One command tells an agent what an application actually is — packages, capabilities, resources, actions, policies, providers — read from checked-in source, in a single deterministic JSON report.
LimitSource-only and read-only. It never opens the database, contacts a provider, reads a secret, or reports runtime, CI or authorization state — and it lists those blind spots as machine-readable limitations in its own output.
- C-16 Every mutation goes through a module service or a named workflow, and leaves an audit event and a step-level trace behind it.
LimitAudit records what the process did under an asserted actor. It is not a tamper-evident or externally attestable log, and it is not a compliance control.
- C-18 The MCP server exposes project context and narrow write tools to a coding agent; anything that generates code or destroys state is dry-run unless you pass an explicit apply flag.
LimitStdio only, local only. There is no hosted or authenticated MCP endpoint, and the server inherits the local process's authority.
- C-19 Generated modules evolve without rewriting history: explicit revisions, a checked-in state file and append-only named migrations.
LimitThe view is source-only: what the checked-in revisions and migrations say is knowable; what a particular database has actually applied is not.
Limitations
- L-01 No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network.
- L-02 SQLite only. Persistence is Node's built-in SQLite adapter. PostgreSQL is on the Production Spine track and is not implemented.
- L-03 The build benchmark has not been run. The protocol is designed and published; no Successful Agent Build Rate exists yet. Any number you see quoted for this project is not ours.
- L-07 This is a framework, not a product you sign up for. There is no hosted CRM, no free tier and no account. The output is an application in your repository that you run.
- L-08 Ownership today means copying source, not installing a dependency. There is a project bootstrap and there is no published package, and the two are different facts. The repository's bootstrap command scaffolds a project that boots, reports `valid` from `app inspect` and exits 0 from `project doctor`, offline and with no install — run from a checkout of this repository. The package published under the reserved npm name is still an empty 0.0.1 placeholder, so the `npm create` route installs nothing until a human publishes it. Either way the framework is vendored into the project rather than depended on by version: you own the result outright, and upgrading means merging, not bumping.
Jobs it covers
- JTBD-01 Manage a custom CRM business object end to end — validated end to end
- JTBD-02 Request commercial approval on a deal — validated end to end
- JTBD-15 Enforce team / tenant permissions — not supported
- JTBD-AX-01 Discover installed packages, capabilities and policies — validated end to end
- JTBD-AX-02 Extend the CRM for a goal without patching the kernel — validated end to end