OpenShell is a kernel-level sandbox that lets AI-agent fleets touch files, APIs and credentials under enforced policy, without unrestricted system access.
Yes, OpenShell is open source under the Apache-2.0 license.
OpenShell is free to use.
Yes, OpenShell can be self-hosted (the source is available under the Apache-2.0 license).
OpenShell is a kernel-level runtime sandbox that lets fleets of autonomous AI agents access files, packages, APIs, and credentials while enforcing security policy at the kernel level — granting real capability without unrestricted system access. Open source: yes (Apache-2.0); self-hostable, since it is a runtime you run yourself. It is free, has ~10.3k stars, is owned by NVIDIA, and supports Claude Code — the highest-traction and flagship drop in this batch.
OpenShell's tagline is "the safe, private runtime for autonomous AI agents," and the design follows from that: rather than giving an agent a normal shell with your full permissions, it isolates each agent and enforces policy on file access, system calls, and network connections at the kernel level. Credentials are handled by injection — agents never see the real secrets; OpenShell supplies them only for approved endpoints. Policy changes can be reviewed against formal verification before approval. It installs via a one-line curl script, ships SDKs for Python, TypeScript, Go, and Rust, runs on Linux, macOS on Apple Silicon, and Windows under WSL 2, and integrates with Claude Code. Open source: yes (Apache-2.0); self-hostable; free.
The moment GTM agents stop drafting and start acting — pulling from a CRM, calling billing APIs, using credentials, installing packages — the blast radius of a compromised or hallucinating agent becomes a business problem, not a demo bug. OpenShell is the governance/sandbox layer for exactly that: it lets a fleet of agents have real capability while a kernel-level policy keeps them inside a boundary and keeps the actual credentials out of their reach. That it is NVIDIA-backed with ~10.3k stars and Claude Code support makes it a serious candidate for the runtime tier of an agentic stack. The honest read: it is still a vendor-described security boundary — kernel-level enforcement and "agents never see real credentials" are the maker's claims, not independently audited here — and running a kernel-level runtime is a real operational commitment, so review the security model and plan to keep it patched before you trust it with production credentials.