OpenShell

About

Policy-enforced sandboxes for AI agents

Each agent runs in its own sandbox. Kernel controls limit which files it can read and which system calls it can make, and every outbound network connection passes a policy check first. Agents never see real credentials: OpenShell adds them only to requests bound for approved endpoints. Before a policy change is applied, a formal verification step flags new access it would grant (a new host with credentials, a new API method) so a human can review it. The installer sets up the CLI and a local gateway on Linux, macOS on Apple Silicon or Windows with WSL 2 (experimental), using Docker, Podman or host virtualization. The default sandbox is a minimal Ubuntu image with no agent installed, and the docs at docs.nvidia.com/openshell walk through running OpenCode inside one. There are SDKs for Python, TypeScript, Go and Rust, a Helm chart for Kubernetes, and agent skills (npx skills add NVIDIA/OpenShell) that teach a coding agent to drive the CLI and write policies. Anonymous telemetry is on by default and can be turned off with OPENSHELL_TELEMETRY_ENABLED=false. The repo is Apache-2.0 with about 18.4k GitHub stars and is trending on GitHub.

Features

• Isolated sandbox per agent with kernel-level file and syscall rules
• Policy check on every outbound network connection
• Credentials injected only for approved endpoints, never shown to the agent
• Formal verification flags risky policy changes for human review
• SDKs for Python, TypeScript, Go and Rust
• Gateway deployable to Kubernetes with Helm

Install