OpenShell

What is OpenShell?

OpenShell is an open-source AI agent runtime environment launched by NVIDIA and licensed under the Apache 2.0 License. It uses sandboxes and declarative access policies to manage the files agents can read, the network connections they can initiate, and the credentials they can use, making it ideal for development teams that need to integrate coding assistants or automated agents into real-world work environments.

Version 0.1.3, released on October 9, 2026, includes improvements to MCP request validation, sandbox restart, and enterprise proxy support. During deployment, testing should be conducted in conjunction with your team’s network architecture, identity management, and tool permissions.

core functionality

1. Isolated Operating Environment:Have the agent perform tasks within a sandbox, using file and process restrictions to limit its access, thereby avoiding handing over the entire work computer directly to an automation program.
2. Network Access Control:Use policies to define permitted destinations and inspect network connections leaving the sandbox to help restrict the outbound transmission of unauthorized data.
3. Document Agent:Keep actual credentials within controlled environments and request additional authentication information only for requests that meet policy objectives, thereby reducing the opportunities for agents to come into direct contact with keys.
4. Policy Change Review:Analyze policy changes before expanding access permissions to help identify new areas of access; administrators remain responsible for designing and approving permissions.
5. Deployment and Scaling:Provides command-line, SDK, and Kubernetes deployment documentation to facilitate the step-by-step integration of existing models, tools, and workflows.

Target Audience and Practical Value

OpenShell is ideal for agent developers, platform engineers, and security teams—especially in scenarios where AI needs to read and write code and call APIs, while clear permission boundaries must be maintained. By centralizing the management of access rules, teams can more easily verify “which files can be read and which services can be accessed” and review the rules as tasks change.

It requires some basic operations and maintenance knowledge. The default sandbox is a stripped-down Ubuntu environment without any pre-installed agents; users must also select and configure agents and model services. The fact that the project code is open source does not mean that external model inference is free; related services may be billed separately.

For example, a team can restrict code analysis tasks to specific project directories and approved model endpoints, while configuring separate access scopes for network retrieval tasks. Breaking down different tasks into appropriate boundaries first, then adjusting policies based on logs, makes auditing easier than granting all permissions at once. Enterprises with existing complex network and identity systems also need to schedule compatibility testing.

Procedure for use

1. First, review the support matrix and set up a Linux, Apple Silicon Mac, or Windows WSL2 environment (which is in experimental support), and configure a compatible container or virtualization backend.
2. Follow the installation instructions for the stable version from the official documentation, verify the download source and version, and set up a test sandbox.
3. Import the required agents and models, and start by using a file containing non-sensitive examples to restrict network and file permissions to only what is necessary for the task.
4. Run small-scale tasks to review logs, access denials, and results; once you have confirmed that the policy behaves as expected, gradually expand its scope of use.

A sandbox does not guarantee absolute security. Incorrect whitelists, overly permissive mount directories, and untrusted tools can still pose risks; production environments should follow official security recommendations. The project provides a toggle for anonymous telemetry, and teams should also review their data and monitoring requirements before deployment.

Comparison with Similar Solutions

Project Address

• Official Website and Documentation: Learn about architecture, installation, policies, and security recommendations.
• GitHub Repositories: View source code, license, issue discussions, and release notes.