// Agent profile
Agent Substrate is a secure-by-default execution runtime for AI agents, engineered to run millions of sandboxed environments with 10x higher density than standard container runtimes. Built in Go and leveraging Kubernetes for infrastructure provisioning, it provides sub-500ms resume operations at 500+ suspend/resume cycles per second, 30x+ actor oversubscription by multiplexing stateful workloads across a smaller pool of physical resources, and native zero-trust kernel and network isolation. The system supports full-state snapshots for hibernation, real-time actor-to-worker assignment with traffic routing, and multiple sandbox technologies including microVMs and gVisor. Framework-agnostic — deploy LangChain apps, MCP servers, coding agents, or any containerized workload. Apache-2.0 licensed, 3.5K stars.
Agent Substrate operates at a different layer than most agent tools listed on AgentConn. Rather than providing agent logic, prompts, or orchestration, it is the execution runtime underneath — the infrastructure that actually runs your agent containers in production. Think of it as a specialized container runtime purpose-built for agent workloads, where the dominant pattern is millions of short-lived or suspendable processes that need fast state persistence and high-density packing.
The core insight is that standard container runtimes (Docker, containerd) are optimized for long-running services, not for the bursty, stateful, suspend/resume pattern typical of AI agents. Agent Substrate redesigns the execution layer for this workload, achieving 10x density improvements and sub-500ms resume from snapshot.
Suspend and Resume: Agents can be suspended to disk and resumed from full-state snapshots in under 500ms. This eliminates idle compute costs for agents waiting on human input, external API responses, or scheduled triggers. The system handles 500+ suspend/resume cycles per second per node.
Actor Oversubscription: By multiplexing stateful agent workloads across a smaller pool of physical resources, Substrate achieves 30x+ oversubscription ratios. Agents that are mostly idle (waiting for events, sleeping between polling intervals) share resources rather than each reserving dedicated compute.
Zero-Trust Isolation: Every sandbox gets native kernel and network isolation by default. No opt-in security configuration — the secure posture is the only posture. Supports microVM and gVisor backends.
The system is composed of several layered components: ateapi (control plane API for lifecycle management), atelet (node-level supervisor coordinating snapshots and state transfers), atenet (networking controller for routing and proxy), and ateom (interior helpers managing checkpoint/restore). Kubernetes handles infrastructure provisioning and worker lifecycle, while Substrate adds agent-specific scheduling optimizations on top.
Platform and infrastructure teams running agent workloads at scale. If you have hundreds or thousands of agents that need to run concurrently, suspend and resume, and share compute resources efficiently, Substrate replaces the generic container runtime with one optimized for this pattern. It pairs naturally with higher-level agent frameworks and orchestrators.
Local-first session intelligence and analytics platform for coding agents, supporting Claude Code, Codex, and 20+ other agents.
817 structured cybersecurity skills for AI agents mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and MITRE F3.
Isolated-VM agent sandbox with sub-100ms boot — run AI agents on real machines with their own kernel, filesystem, and network. Pure Rust, open source.