Runtime for fleets of autonomous agents · Apache 2.0
Agents are useful because they can reach things.
So review the reach.
Agents are most useful when they can read files, install packages, call APIs and use credentials. OpenShell gives them that without unrestricted access to your data, secrets or network. You declare what each agent can touch in a policy, and OpenShell enforces it.
Kernel-level enforcement
Each agent runs in an isolated sandbox. Kernel controls confine which files it can access and which system calls it can make, and every network connection passes a policy check before it leaves.
Formally verified policy changes
Before a change is approved, formal verification flags risky new access it would grant — so those changes wait for human review.
policy.diff — proposed change
1 finding · held- 12 network:
- 13 allow:
- 14+ - host: registry.internal
- 15+ methods: [GET]
- 16+ - host: api.partner.example
- 17+ credentials: provider/partner
This change would let the agent reach a new host with credentials. Risky new access waits for a person.
Illustrative policy fragment. The review behaviour is the project’s stated design: the prover flags new credentialed hosts and new API methods before a change is applied.
Diff content is illustrative. What is reproduced verbatim is the rule: changes that grant risky new access do not take effect until a human approves them.
Credentials
The agent never holds one
Agents never see real credentials. OpenShell adds them only to requests bound for approved endpoints.
Every call
Checked on the way out
Every network connection passes through a policy check before it leaves the sandbox — not after, and not on the honour system.
Telemetry
What it does not collect
The project states it collects no sandbox names, hostnames, file paths, prompts, credentials, model names or user content — and can be compiled out entirely.