Projects sharing features with Substrate

This project is an infrastructure platform designed to provide secure, isolated, and ephemeral cloud-based Linux environments for AI agents and automated code execution. It functions as an orchestrator that provisions on-demand virtual machines, allowing developers to run arbitrary code generated by large language models within hardware-level security boundaries. The platform distinguishes itself through its ability to manage stateful, long-lived sessions that persist across multiple execution calls, enabling complex, multi-step workflows. It supports high-concurrency scaling, allowing for th

This project is a library of declarative configuration patterns and templates for implementing network policies within Kubernetes clusters. It provides a collection of reference guides and ready-to-use snippets designed to establish pod isolation and zero-trust traffic rules. The project focuses on implementing a default-deny security posture, where all network traffic is blocked until explicitly authorized through a whitelist. It provides specific templates for restricting lateral movement and securing microservice boundaries using label-based selectors and port-specific filtering. Its capa

This is an open-source framework for building stateful, durable AI agents that run on Cloudflare Workers. It provides a runtime for long-lived agents that maintain a persistent identity, local SQL storage, and real-time connections, utilizing a lifecycle where agents hibernate when idle and wake on demand. The project distinguishes itself through its multi-channel orchestration, allowing a single agent to be deployed across voice, email, and chat interfaces with unified state. It implements the Model Context Protocol for standardized tool and data exchange and includes a dedicated framework f

AgentENV is a distributed sandbox platform that launches isolated Firecracker microVMs across many machines, so AI agents can run their workloads in parallel and at scale. Each environment gets its own dedicated Linux kernel, and a gateway and scheduler control plane places and manages environments across a multi-node cluster. It also serves an E2B-compatible HTTP API, so existing E2B Python and TypeScript SDK code works unchanged against your own infrastructure. Environments are snapshot-driven. The runtime captures incremental memory and disk snapshots, pauses and resumes idle environments

Sandstorm is a self-hosted platform for running large numbers of isolated sandboxes for AI agents across a cluster of machines. A central master places sandboxes onto worker nodes, which join by pairing code or dial out from behind a NAT. Each node isolates workloads with either Firecracker microVMs or gVisor, a user-space kernel for hosts without KVM. Master, node, and web console roles ship in a single executable. What sets it apart is density and start speed. Children are forked from a warmed parent snapshot using shared copy-on-write memory, so many sandboxes start in milliseconds without

CubeSandbox is a Kubernetes-based platform for executing AI agents in secure, lightweight environments. It provides a code execution sandbox that uses hardware isolation and dedicated guest kernels to run untrusted code without risking the host system. The project features a network egress firewall that restricts outbound communication via domain allowlists and audit logging. It also includes a container snapshotting manager capable of capturing the runtime memory and disk state of environments to enable instant cloning and recovery. The platform covers cluster orchestration through a web-ba

protoactor-go is a framework for building concurrent and distributed systems in Go using the actor model. It provides a distributed actor system that enables isolated entities to communicate via asynchronous messaging and share state across a cluster. The framework implements a multi-language actor protocol, allowing interoperability between actors written in Go, C#, and Java. It further supports a virtual actor implementation, where actors are automatically instantiated across a network based on a unique identity. The system includes a supervision model for managing actor lifecycles and fau

Rivet is a distributed infrastructure for managing the lifecycle, addressing, and persistence of stateful actors and durable execution engines. It provides a distributed process sandbox that executes application logic within lightweight isolates, ensuring resource isolation and fast cold starts. The system is designed to coordinate multi-step operations using persistent queues and timers to guarantee reliable task completion across distributed environments. The platform specifically enables the orchestration of stateful AI agents that maintain persistent memory and state across long-running i

The Google Cloud Go Client Library is a set of Go packages and a software development kit used to interact with Google Cloud platform services and APIs. It provides the primary means for Go applications to integrate with cloud service endpoints through simplified language patterns and automated API request handling. The project features specialized libraries for managing identity and access via service accounts, API keys, and environment-based credential resolution. It includes dedicated SDKs for programmatic resource orchestration and the deployment and management of serverless functions, co

Omnigent is a policy-governed orchestrator for coding agents. It runs several agent harnesses, such as Claude Code and Codex, together in one session, and a single harness identifier decides which agent handles a session, so teams can swap agents without rewriting their definitions. Sub-agents can each use their own harness, model, prompt, and sandbox inheritance, which lets one agent review another's work or split a task with it. Every agent action passes through layered policies set at the server, agent, and session levels. Each policy function allows, denies, or abstains, and a denial stop

Cumora is a cross-platform team chat where AI agents join humans as teammates in shared rooms, direct messages, and group conversations. Agents sit in the same roster as people, show availability states such as working, thinking, or resting, and coordinate with humans through a shared Kanban board, calendar, collaborative documents, and email. The same web codebase ships as a browser app, an Electron desktop app, and Capacitor-wrapped iOS and Android apps. Agents can be hosted in two ways. A self-hosted server stack runs each cloud agent in its own isolated Kubernetes pod with shell, file, br

T-Pot is a multi-honeypot orchestration platform and threat intelligence collector. It utilizes a Docker-based security sandbox to deploy and manage a collection of diverse decoy services that simulate vulnerable targets to lure attackers and record their activity. The system features a distributed sensor network where remote nodes capture attack logs and transmit them via encrypted communication to a central hub. This central hub employs an analytics stack to transform raw logs into geographic maps and interactive dashboards for adversary behavior visualization. To increase the realism of si

OpenDots is a platform for hosting long-lived AI agents, called dots, that keep running over time instead of living inside a single short chat. Each agent gets its own sandboxed computer with a browser, files, and a terminal that persist across restarts, with permission checks, an action record, and the option for a human to take over. The same AI coworker carries one conversation across written chat, real-time voice calls, and Slack, and a workspace of shared spaces and nested pages sits alongside it. People stay in control of what agents do. The chat interface streams agent activity live, w

OpenBot is a local-first desktop workspace for running persistent AI agents. Each agent has its own instructions, avatar, dedicated workspace, task queue, memories, and file sharing, so ongoing work carries across sessions. It runs Codex, Claude, Grok, and custom OpenAI-compatible or ACP agents side by side and lets them collaborate through shared channels, with per-agent access levels set by role. A headless server build keeps agents running when the desktop is off. It can run in Docker, on a Linux machine, on a cloud instance, or in a managed sandbox that sleeps when idle and wakes on deman

This project is a Java-based framework integration that provides an AI agent runtime, a graph-based AI workflow engine, and an LLM orchestration framework for Spring applications. It enables the development of stateful autonomous agents and the implementation of retrieval-augmented generation systems using document processing and vector databases. The framework distinguishes itself through a graph-based workflow runtime for designing complex AI pipelines with conditional routing and persistent state. It supports multi-agent orchestration via service-discovery coordination and provides human-i

Deepagents is an LLM agent orchestration platform and stateful application server designed for deploying and managing AI agents built with computational graphs. It provides a containerized runtime environment that handles agent execution, state persistence, and the versioning of AI assistants. The platform distinguishes itself through deep integration with the Model Context Protocol, allowing agents to function as servers that expose tools and capabilities to external clients. It features a sophisticated observability suite for capturing execution traces, performing LLM-based evaluations agai

Sandcastle is a TypeScript library for launching AI coding agents from scripts or CI pipelines and running them unattended inside isolated sandboxes. A single programmatic call starts a chosen agent, runs it for a set number of iterations, and returns the commits, branch, and per-iteration results. Sandboxes can be Docker or Podman containers, native operating-system sandboxes (Bubblewrap on Linux, Seatbelt on macOS, with no image or daemon), or cloud providers such as E2B, Modal, and Fly.io Sprites. Agents can also run directly on the host with no isolation. The agent and sandbox layers are

Mercury Agent is a personal AI agent that runs as a long-lived background process on your own machine. It restarts after crashes and at login, keeps working on tasks after the terminal is closed, and serves every connected chat channel from one shared local memory. The same agent can be reached from a terminal, Telegram, Discord, Slack, Signal and a local web dashboard, with access rules such as pairing codes and admin roles applied per channel. Every file edit, shell command, network fetch and git action is checked against folder scopes, a fixed blocklist and per-session approval modes befor

LangGraph is a framework for building stateful, multi-step agentic workflows by modeling application logic as a directed graph. It provides a runtime environment where complex tasks are orchestrated through interconnected nodes and edges, allowing developers to manage state transitions, persistent memory, and control flow across long-running automated processes. The platform distinguishes itself through its native support for human-in-the-loop automation, enabling developers to define breakpoints that pause execution for manual review, modification, or approval. It also features checkpoint-ba

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

Opensnitch is a host-based application firewall for Linux that monitors and intercepts outbound network connections in real time. By hooking into kernel-level interfaces, it tracks system-wide network activity and maps connection attempts to specific local processes, allowing users to explicitly permit or deny traffic on a per-application basis. The project distinguishes itself through its ability to manage security policies across multiple distributed nodes from a single, unified dashboard. This centralized management is secured via encrypted socket communication, enabling consistent rule en

Claude Code is a command-line interface and multi-agent orchestration framework designed for autonomous software engineering. It enables AI agents to perform codebase modifications, debugging, and Git workflow management while coordinating multiple specialized agents to decompose and execute complex engineering tasks in parallel. The system distinguishes itself through a high degree of isolation and safety, utilizing Git worktrees to create independent working directories for concurrent agents and implementing a tiered permission system that combines user rules, project policies, and OS-level

This project is a container-native runtime designed for building, orchestrating, and executing autonomous AI agents. It provides a framework for managing multi-agent teams and complex workflows by packaging agent configurations as portable container images. By leveraging declarative configuration files, the system allows users to define agent personas, model routing, and tool access without requiring changes to application code. The platform distinguishes itself through its deep integration with container infrastructure, ensuring that agent tasks and external tools run within isolated environ

QLExpress is a dynamic scripting engine and expression language for the Java platform. It functions as a runtime expression evaluator and business rule engine, allowing applications to execute scripts and evaluate business logic without requiring system recompilation. The engine distinguishes itself through a secure scripting sandbox that enforces security policies via class whitelisting and execution timeouts. It supports high-precision mathematics to prevent rounding errors and provides language alias support to create domain-specific languages that resemble natural language. Additional cap

BunkerWeb is a containerized suite of infrastructure tools that functions as a cloud-native web application firewall and Nginx reverse proxy. It provides a security layer for web applications, combining traffic routing with automated SSL certificate management and a web-based security dashboard for monitoring and configuration. The project distinguishes itself through its deep integration with container orchestrators, serving as a Kubernetes ingress controller that automates security settings and service discovery via container labels. It features a plugin-based extension model and a manageme

Bunkerized Nginx is a containerized security automation system that provides a secure reverse proxy and web application firewall. It focuses on protecting web applications by monitoring container labels within cloud-native orchestration systems to automatically update security settings and firewall rules. The system distinguishes itself through automated security operations, including the automatic management of SSL certificates and an automated client banning mechanism that blocks IP addresses based on HTTP status codes. It features bot challenge mechanisms using CAPTCHAs, JavaScript, or coo

Humanlayer is an LLM coding agent orchestrator and AI-driven workflow manager designed to coordinate multiple agents in researching, designing, and implementing features across complex codebases. It provides a multi-agent development workspace that groups AI sessions, versioned design artifacts, and worktrees into collaborative team tasks. The system features a bring-your-own-key LLM gateway to connect external AI model subscriptions and API keys. It utilizes remote AI agent daemons to run long-term coding sessions on cloud infrastructure, maintaining progress independently of the user's acti