awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
rivet-dev avatar

rivet-dev/agentos

0
View on GitHub↗
4,858 stars·274 forks·Rust·Apache-2.0·2 viewsrivet.dev/agentos↗

Agentos

Agent OS is a lightweight sandbox runtime for running code written by AI agents. It provides a virtualized POSIX userspace inside WebAssembly, with processes, signals, files, sockets, a shell, and core utilities, so unmodified Linux programs and Node.js, TypeScript, and Python scripts execute in isolation from the host. It is used as an embeddable library inside an existing backend process, or through a hosted HTTP API.

Many isolated environments run inside one compact runtime on ordinary Linux hosts, with no hypervisor, nested virtualization, or full virtual machine per agent. Every file, process, and network operation goes through the virtualized kernel, so guest code sees no host files, environment variables, or network until access is explicitly granted. Access is opened through mounts, network permissions, and host functions, which are trusted application functions exposed to guest code so credentials and secrets never enter the sandbox. Permissions, memory and processor limits, and per-process isolation are configurable. Linux tools such as coreutils, curl, and sqlite are compiled to WebAssembly against a patched C library and host-syscall layer.

Beyond execution, the runtime covers persistent virtual machines whose files, installed packages, and servers outlast a single call, plus a virtual filesystem, command and terminal sessions, and captured program output. Code can be evaluated as one-off expressions, run as isolated modules, or kept in persistent contexts, with optional TypeScript type-checking and package installation. Sandboxed programs can make network calls and serve development servers under host control, with expiring preview links for reaching them from outside. Packages are built into immutable, versioned archives mounted read-only into the guest, and recurring commands can be scheduled. The same design supports loading untrusted plugins in isolated environments.

Features

  • AI Execution Sandboxes - Runs untrusted code written by AI agents inside isolated WebAssembly sandboxes so generated programs cannot touch the host or each other.
  • Code Execution Sandboxes - Executes code written by AI agents inside isolated sandboxes so untrusted output cannot affect the host or other workloads.
  • In-Process Agent Hosts - Hosts many isolated agent environments inside one compact runtime on standard Linux hosts, with no hypervisor or nested virtualization needed.
  • In-Process Embedded Runtimes - Installs as a library and runs inside an existing backend process, avoiding hypervisors, nested virtualization, or a virtual machine per agent.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI
  • Unmodified Program Compatibility - Provides a POSIX userspace inside WebAssembly with processes, signals, files, sockets, and a shell so existing Linux programs run without changes.
  • Userspace Kernels - Implements processes, signals, files, sockets, and a shell as a virtualized kernel inside WebAssembly so unmodified Linux programs run in isolation.
  • Embedded Scripting Sandboxes - Embeds a lightweight sandbox runtime as a library inside an existing backend process so many isolated environments run without hypervisors.
  • Native Function Exposers - Exposes trusted host functions to sandboxed code as ordinary calls so credentials and secrets never enter the sandbox.
  • Linux Compatibility Layers - Runs unmodified Linux programs, shells, and Node.js, TypeScript, or Python scripts in a virtual POSIX userspace with its own processes and files.
  • Multi-Language Sandbox Execution - Executes Node.js with npm, TypeScript with type checking, and Python with pip using persistent contexts that can be reset between runs.
  • Multi-Language Script Execution - Executes JavaScript, TypeScript, and Python code or files, type-checks TypeScript, installs packages, and keeps persistent execution contexts between runs.
  • WebAssembly Runtimes - Runs untrusted code and Linux programs inside isolated WebAssembly sandboxes with a virtualized POSIX userspace, driven from a library or hosted API.
  • Deny-by-Default Guest Isolation - Virtualizes every file, process, and network operation as a kernel call, hiding host files, environment variables, and network until access is granted.
  • Scoped Sandbox Host Access - Opens host access only through explicit mounts, network permissions, and host functions, with memory and processor limits, keeping credentials out of guest code.
  • Untrusted Code Sandboxes - Runs untrusted scripts and shell code in isolated engines so guest code cannot reach host files, processes, environment variables, or network by default.
  • Host-Call Interfaces - Binds trusted host functions that agents call as ordinary JavaScript calls, keeping secrets and credentials out of the guest.
  • File and Process Management Tools - Reads, writes, and mounts files, runs and signals commands, and opens interactive terminal sessions inside an isolated POSIX-style environment.
  • Virtual Directory Mounts - Provides a virtual filesystem to read, write, list, and move files, with mounts that expose selected host data to guest code.
  • Virtualized Filesystem Layers - Gives sandboxed code a Linux-style virtual filesystem isolated from the host, with mounts exposing selected host data on request.
  • Python Execution Sandboxes - Executes Python programs inside the same isolated runtime, giving Python-based agents a safe Linux-compatible place to run.
  • Pseudo-Terminal Commands - Starts processes, streams output, signals or waits on them, and opens interactive pseudo-terminal sessions inside the isolated environment.
  • Sidecar Runtime Routing - Keeps permissions, filesystem rules, defaults, and package handling in one separate sidecar process that thin language clients talk to.
  • Host-to-Guest RPCs - Exposes the application's own async functions as globals inside the virtual machine so guest code never receives credentials.
  • Linux-Compatible Kernels - Implements a virtualized Linux-style kernel with processes, signals, files, sockets, and a shell so existing Linux programs run unmodified in a sandbox.
  • Web App Sandbox Runtimes - Integrates the sandbox runtime into a host application through an SDK so developers can run isolated code from their own program.
  • Persistent Virtual Machines - Creates long-lived virtual machines whose files, installed packages, and servers outlast a single call, with scripting, filesystem, network, and process interfaces.
  • Emulated Syscall Handlers - Routes every file, process, and network operation through kernel calls so guest code sees nothing of the host until access is granted.
  • C/C++ to WebAssembly Compilers - Compiles upstream Linux tools such as coreutils, curl, and sqlite to WebAssembly using a patched C library and host-syscall layer.
  • Host Function Exposure - Exposes trusted host async functions as globals callable from sandboxed code, so credentials stay outside the sandbox.
  • In-Process Runtimes - Runs many isolated sandboxes inside one library-managed runtime in the host process, with no hypervisor or per-agent virtual machine.
  • Persistent Execution Contexts - Keeps variables and program memory alive between calls and runs several independent contexts side by side in one environment.
  • Sandbox Network Security Controls - Lets sandboxed programs make network calls and serve development servers while the host controls every connection, with expiring preview links.
  • Host Resource Access - Opens host resources to guests only through explicit mounts, host functions, and network permissions while the virtual kernel enforces limits.
  • Sandbox Permissions - Grants or denies sandboxed programs access to files, network, and processes so each environment does only what is explicitly allowed.
  • Sandbox Permission Policies - Set permissions, resource limits, and mounts for each call, denying external network access by default and merging any custom policy over the defaults.
  • Untrusted Plugin Isolation - Loads user-supplied plugins as untrusted code in isolated environments so an application can be extended without risking its stability.
  • Sandbox Resource Caps - Caps memory, processor time, and similar resources for isolated code so runaway or malicious programs cannot exhaust the host.

    • Star history

    Star history chart for rivet-dev/agentosStar history chart for rivet-dev/agentos

    How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

    Frequently asked questions

    What does rivet-dev/agentos do?

    Agent OS is a lightweight sandbox runtime for running code written by AI agents. It provides a virtualized POSIX userspace inside WebAssembly, with processes, signals, files, sockets, a shell, and core utilities, so unmodified Linux programs and Node.js, TypeScript, and Python scripts execute in isolation from the host. It is used as an embeddable library inside an existing backend process, or through a hosted HTTP API.

    What are the main features of rivet-dev/agentos?

    The main features of rivet-dev/agentos are: AI Execution Sandboxes, Code Execution Sandboxes, In-Process Agent Hosts, In-Process Embedded Runtimes, Unmodified Program Compatibility, Userspace Kernels, Embedded Scripting Sandboxes, Native Function Exposers.

    Which projects share features with rivet-dev/agentos?

    Projects with overlapping indexed features include: superradcompany/microsandbox — Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes… holzschu/a-shell — a-shell is a local Unix-like shell environment and terminal emulator for iOS. It functions as a Unix shell interface,… pydantic/monty — Monty is a sandboxed execution environment designed primarily for running Python code generated by AI models. It… atmosphere/atmosphere — Atmosphere is a Java-based framework for building and coordinating AI agents. It provides a real-time transport layer… mattpocock/sandcastle — Sandcastle is a TypeScript library for launching AI coding agents from scripts or CI pipelines and running them… dagger/container-use — container-use is a containerized AI execution environment and code sandbox designed to provide a secure space for AI…

    Projects sharing features with Agentos

    These projects share indexed features with Agentos. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
    • superradcompany/microsandboxsuperradcompany avatar

      superradcompany/microsandbox

      6,570View on GitHub↗

      Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

      Rust
      View on GitHub↗6,570
    • holzschu/a-shellholzschu avatar

      holzschu/a-shell

      3,778View on GitHub↗

      a-shell is a local Unix-like shell environment and terminal emulator for iOS. It functions as a Unix shell interface, a Python programming environment, and a WebAssembly runtime, providing a command-line interface for system management and automation on mobile devices. The project distinguishes itself through the ability to compile and execute C and C++ code on iOS via WebAssembly. It further extends its functionality by supporting the installation of pure Python packages and precompiled WebAssembly modules. The system covers a broad range of capabilities, including local file system managem

      Perl
      View on GitHub↗3,778
    • pydantic/montypydantic avatar

      pydantic/monty

      8,854View on GitHub↗

      Monty is a sandboxed execution environment designed primarily for running Python code generated by AI models. It provides a secure, isolated runtime that blocks host access, enforces resource limits, and supports pre-execution type checking against built-in type hints to catch signature mismatches before code runs. The sandbox can persist its interpreter state at external function calls, allowing execution sessions to be serialized, stored, and later resumed from a file or database. What distinguishes Monty is its combination of stateful, resumable execution with multi-language native embeddi

      Rust
      View on GitHub↗8,854
    • atmosphere/atmosphereAtmosphere avatar

      Atmosphere/atmosphere

      3,830View on GitHub↗

      Atmosphere is a Java-based framework for building and coordinating AI agents. It provides a real-time transport layer for streaming data via WebSockets, SSE, gRPC, and WebTransport, alongside a multi-agent orchestration framework for managing agent fleets through sequential, parallel, and graph-based execution workflows. The project features a durable workflow engine that persists agent state as snapshots, allowing long-running tasks to survive system restarts and incorporate human-in-the-loop approvals. It also implements Model Context Protocol servers to expose tools, resources, and prompt

      Javaacpagentic-aiembabel
      View on GitHub↗3,830
    Compare all 30 related projects→