NVIDIA/OpenShell: OpenShell is the protected, non-public runtime for autonomous AI brokers. · GitHub

OpenShell is the protected, non-public runtime for fleets of autonomous AI brokers. Agents are most helpful after they can learn recordsdata, set up packages, name APIs, and use credentials. OpenShell offers them that functionality with out giving them unrestricted entry to your information, secrets and techniques, or community. You declare what every agent can contact in a coverage, and OpenShell enforces it.

OpenShell governs what brokers can do in two methods: it devices the kernel to implement coverage on each file entry, system name, and community connection at runtime, and it makes use of formal verification to verify what a coverage change would enable earlier than it’s utilized.

• Kernel-level enforcement. Each agent runs in an remoted sandbox. Kernel controls confine which recordsdata it might probably entry and which system calls it might probably make, and each community connection passes by way of a coverage verify earlier than it leaves the sandbox. Agents by no means see actual credentials; OpenShell provides them solely to requests certain for accredited endpoints.
• Formally verified coverage adjustments. Before a coverage change is accredited, OpenShell makes use of formal verification to flag dangerous new entry it could grant, akin to reaching a brand new host with credentials or calling a brand new API methodology, so these adjustments watch for human assessment.

See Architecture for the way the gateway, supervisor, and sandbox match collectively.

You want Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization. See the Support Matrix for particulars.

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The installer units up the CLI and a neighborhood gateway. The default sandbox picture is minimal Ubuntu with no agent put in. To run an actual agent, comply with Run Your First Agent: it runs OpenCode in opposition to a free OpenRouter mannequin and reveals methods to approve new entry because the agent wants it.

• Sandboxes: pictures, runtimes, GPUs, and lifecycle.
• Policies: filesystem, community, and course of guidelines, with the advisor and prover for reviewing adjustments.
• Providers: credentials that work solely at accredited endpoints, together with inference.
• Gateways: the management airplane for sandboxes, coverage, and entry.
• Kubernetes: deploy the gateway with Helm. Your CNI should implement CommunityPolicy.
• Extensibility: middleware, interceptors, and compute drivers.
• Tutorials: step-by-step coverage and agent walkthroughs.
• Prerelease and development builds: strive an upcoming launch or the most recent commit on important.

Install the general public OpenShell abilities on your coding agent:

npx abilities add NVIDIA/OpenShell

The abilities train your agent to drive the OpenShell CLI, write sandbox insurance policies, and debug gateways and inference routing. They dwell in skills/ and work with out an OpenShell supply checkout.

SDKs join functions to an OpenShell gateway. They don’t set up the CLI. Use the identical OpenShell launch for the SDK and the gateway when potential.

OpenShell is constructed agent-first: it’s developed with the identical agent-driven workflows it permits. See CONTRIBUTING.md for growth setup and the contribution workflow, and AGENTS.md for repository coding conventions.

OpenShell collects nameless telemetry, restricted to operational classes and counts, to assist enhance the challenge. It doesn’t gather sandbox names, hostnames, file paths, prompts, credentials, supplier or mannequin names, or consumer content material. To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs. You may also compile telemetry out completely. See Telemetry for particulars and the community telemetry reports for printed utilization traits.

This software program mechanically retrieves, accesses or interacts with exterior supplies. Those retrieved supplies should not distributed with this software program and are ruled solely by separate phrases, situations and licenses. You are solely chargeable for discovering, reviewing and complying with all relevant phrases, situations, and licenses, and for verifying the safety, integrity and suitability of any retrieved supplies on your particular use case. This software program is supplied “AS IS”, with out guarantee of any type. The creator makes no representations or warranties concerning any retrieved supplies, and assumes no legal responsibility for any losses, damages, liabilities or authorized penalties out of your use or lack of ability to make use of this software program or any retrieved supplies. Use this software program and the retrieved supplies at your individual threat.

This challenge is licensed beneath the Apache License 2.0.