The Agent Governance Platform

Deploy agents that do real work — safely

// scoped permissions, bounded execution, full audit trail — every action logged in real time. Open source. Local-first.

agenticbox run demo — scoped execution session

Illustrative — based on real enforcement output from agenticbox run demo

# One-line install (daemon + CLI)
$ curl -fsSL https://agenticbox.co/install.sh | bash

github.com/morpheus-sh/agenticbox · Rust-native · Local-first

// from agent built to agent deployed

How it works

Five commands. That's the whole loop — from kicking the tires to shipping to production with a tamper-evident audit trail.

$ agenticbox run demo # See it in action
$ agenticbox run security-analyst # Auto-fetch & deploy
$ agenticbox run security-analyst --dry-run # Preview permissions
$ agenticbox audit --verify # Tamper-evident audit trail
$ agenticbox deploy # Ship to production
// what's running today

The runtime

Every primitive an agent needs to do real work without wrecking real systems.

[01] Shipped

Sandbox Execution

Container-based execution with full lifecycle management. Agents run in isolated containers (Docker or Podman, auto-detected) that start and stop on demand — no pre-built images, no persistent daemons required.

$ agenticbox run hermes
[sandbox] detecting runtime... docker
[sandbox] pulling base image "agent-runtime:slim"
[sandbox] container a8f3c1 created
[sandbox] container started — cgroup: cpu=2cores mem=1G
[agent] stdio relay established (PTY)
[agent] running... session: 0x7e2a
[sandbox] container a8f3c1 stopped on exit
[sandbox] container removed — audit log written
[02] Shipped

Scoped Permissions

Per-agent allow/deny: terminal, filesystem, browser, network.

ALLOWED terminal.exec
ALLOWED fs.read /data
BLOCKED fs.write /prod
BLOCKED net.outbound
evaluated by PolicyEngine
[03] Shipped

Filesystem Governance

Path resolution guards prevent escapes via symlinks and ../.

> resolve "/data/../etc/passwd"
canonicalize → /etc/passwd
DENIED root not in allowed
roots: /data /tmp/agent
[04] Shipped

Agent Packages

Run agents like Docker containers: agenticbox run hermes. TOML manifests — shareable, forkable.

[agent]
name = "hermes"
image = "agent-runtime:slim"
[permissions]
terminal = true   fs = ["/data:ro"]   net = "off"
[image.setup]
commands = ["pip install hermes-agent"]
[05] Shipped

Session Persistence

SQLite-backed session management. Model config, permissions, and status survive restarts.

sqlite: sessions.db
● 0x7e2a running
● 0x3b1c paused
restored on daemon boot
[06] Shipped

Desktop Console

Tauri desktop UI (no Electron). Manage agents, view sessions, monitor resources.

tauri://console
▎ agents: 3 active
▎ cpu: 18%   mem: 412M
native · cross-platform
// one engine, many verticals

Vertical templates

Available today: the enforcement engine that makes bounded execution safe. Security vertical template in development. Business verticals on the same engine, coming next.

[SEC]

Security Analyst

Sandboxed malware detonation with real behavioral telemetry. Drop a suspicious binary into a bounded container — every filesystem access, network call, and credential read is caught or allowed in real-time. Offline by default. Full audit trail for forensic documentation. The permission engine IS the analysis harness.

  • malware detonation — --network offline
  • credential exfil detection — FsGuard blocks ~/.ssh, .env, AWS keys
  • C2 observation without reach — allowlist mode
  • full session replay for incident response
  • RE toolchain — radare2, binwalk, YARA, Ghidra headless
  • agent red-teaming — bounded blast radius
Available Now
[CX]

Customer Support

Scoped access to customer data. Bounded actions — refund yes, delete no. Full audit trail for every ticket the agent touches.

Roadmap
[OPS]

Sales Ops

CRM updates, prospecting, pipeline management. Agent sends real emails, updates real records.

Roadmap
[IT]

IT Ops

Provisioning, password resets, ticket handling. Agent touches identity systems safely.

Roadmap
[FIN]

Finance Ops

Reconciliation, reporting, anomaly flagging. Agent touches financial systems with audit trails.

Roadmap
// why you can trust it

The governance layer

[01]

Permissions

What the agent is allowed to do. Terminal, filesystem, network, browser — scoped and enforced. This is what makes it safe to let an agent refund a customer or modify a production record.

[02]

Accountability

Every action attributed, logged, auditable. Tamper-evident audit trail with SHA-256 chain hashing — agenticbox audit --verify detects any modification. This is what makes it compliant to let an agent operate in regulated environments.

[03]

Ownership Boundaries

Clear boundaries: resources, outputs, budgets, assets. What belongs to the agent vs. the organization.

[04]

Identity (emerging)

Agents get their own credentials, accounts, digital identity — provisioned and revocable. The moat that compounds silently as agents accumulate trust.

// the same playbook, a different layer

The Vercel for agent deployment

Vercel AgenticBox
git push → live site agenticbox deploy → agent in production
Edge network + serverless Bounded container runtime (Docker + Podman)
DDoS protection, rate limits, auth Permissions, scopes, audit trails
Next.js templates per use case Vertical agent templates (security analyst, customer support, ops/SRE)
Developers ship web apps Companies ship agent workforces

Vercel didn't build web apps. They made deployment so smooth that developers stopped managing servers.
AgenticBox makes agent deployment so safe that companies stop building custom guardrails.

Star it. Fork it. Build with it.

AgenticBox is fully open source. No signup, no waitlist — just clone and run.

Star on GitHub Install now

Read the docs