OpenShell

A self-hosted AI agent runtime for Linux and Apple Silicon macOS that controls file, network and credential access and supports private model endpoints.

OpenShell is a self-hosted runtime for teams that need autonomous AI agents to work with files and APIs under explicit access limits. It runs agents in isolated sandboxes and enforces policies at the kernel level.

Coding agent support: Run Claude Code, OpenCode, Codex or GitHub Copilot CLI with restrictions on the files and network destinations each agent can access.
Credential protection: Agents receive credential placeholders, while OpenShell supplies the actual secrets only to requests sent to approved endpoints.
Policy review: Version-controlled YAML policies define access, and formal verification flags risky policy changes for human review before they take effect.
Private inference: Connect selected sandboxes to self-hosted or private model endpoints and restrict model traffic to approved destinations.

OpenShell is open source under Apache 2.0. It runs on Linux and Apple Silicon macOS with Docker, Podman or host virtualization. The gateway can also run on Kubernetes. Workloads can use the default Ubuntu environment or a custom containerized environment.

File and process restrictions remain fixed for a sandbox's lifetime; network rules and credential attachments can change while it runs. Anonymous operational telemetry is enabled by default and can be disabled. It excludes prompts, user content, credentials, file paths, hostnames and provider or model names.