// Agent profile
OpenShell (nvidia/openshell) is an open-source agent runtime that lets AI agents perform useful actions — reading files, installing packages, calling APIs, using credentials — while enforcing strict security boundaries. It uses kernel-level isolation (Landlock + seccomp) to sandbox each agent with zero default permissions, and Z3-based formal verification to flag risky policy changes before they take effect. At 10.8K GitHub stars, it supports Linux, macOS Apple Silicon, and WSL 2 with Kubernetes deployment via Helm. The core runtime is written in Rust with Python and TypeScript SDKs for integration. Apache 2.0 licensed.
OpenShell is NVIDIA’s open-source runtime designed for deploying fleets of autonomous AI agents safely. The core problem it solves: agents need real capabilities (filesystem access, network calls, credential use) to be useful, but unconstrained agents are a security liability. OpenShell enforces a dual-enforcement model — kernel-level isolation prevents agents from accessing anything not explicitly permitted, while formal verification catches dangerous policy changes before they go live.
Every agent runs in a sandbox with zero default permissions. Access to files, syscalls, and network endpoints must be explicitly granted through policies. Credentials are injected only for approved endpoints, never exposed directly to the agent. When policies change, Z3-based formal verification analyzes the diff and flags any new access grants that could be risky, requiring human review before taking effect.
The runtime is built in Rust for performance and memory safety. Python and TypeScript SDKs let developers integrate OpenShell into existing agent frameworks. Deployment scales from single-machine Docker/Podman setups to Kubernetes clusters via Helm charts.
DevOps and security teams deploying AI agents in production use OpenShell to enforce least-privilege access across agent fleets. It fits anywhere agents need real system access — CI/CD automation, infrastructure management, code generation with execution — while maintaining auditable security boundaries. The formal verification layer is particularly valuable in regulated environments where policy changes need provable safety guarantees.
OpenShell is infrastructure-level tooling, not an agent framework itself. It provides the secure runtime layer that sits beneath agent applications. The Rust core means extending the runtime requires Rust knowledge, though the SDKs cover most integration needs. macOS support uses a compatibility layer rather than native Landlock (Linux-only kernel feature). Currently at v0.1.x — the API surface is stabilizing but may see breaking changes.
Local-first session intelligence and analytics platform for coding agents, supporting Claude Code, Codex, and 20+ other agents.
817 structured cybersecurity skills for AI agents mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and MITRE F3.
Isolated-VM agent sandbox with sub-100ms boot — run AI agents on real machines with their own kernel, filesystem, and network. Pure Rust, open source.