Open source · self-hostable

Your Agent has a computer — and a durable inbox

Message a teammate, not a throwaway chat. The home session keeps the event log across crash and reconnect. A long-lived home runtime (bridge or herdr) keeps working when the laptop is closed. Isolated turns still get ephemeral sandboxes — this is not an always-on shared VM. Any LLM provider, any sandbox, self-hosted.

Open Console Install CLI / docs Try hosted GitHub

Works with Cloudflare · Kubernetes · Anthropic · OpenAI-compatible · E2B & Daytona (self-host)

Apache 2.0 · no vendor lock-in · same codebase cloud or self-host

How it fits

Configure · compose · run · reach

Four steps from API key to a live agent. Click any card for a short explanation and links.

Interactive Click any component for details. Collapse columns with the chevrons on small screens.

agent=model + skills + mcp

session=agent + env + vaults

1 · Configure

2 · Compose

3 · Run

4 · Reachoptional

Primitives

What Open Managed Agents is

A platform for running agent fleets, not a chat UI. Four objects carry the whole model.

Agent

A versioned teammate: model, prompt, tools, skills, MCP, harness. Opening an Agent lands on its home session — a pinned inbox that survives crash and reconnect.

Session

A conversation with a durable event log (SessionDO, persist-before-broadcast). Home is long-lived; extra sessions stay ephemeral for isolated work.

Environment

The execution sandbox: packages, network policy, container image. Reusable across agents, so a fleet shares one runtime shape.

Vault

A credential store that never enters the sandbox. An outbound proxy injects tokens at the network layer, matched by URL.

Demo

See it run

Pick a use case and follow trigger → agent → result — including the local bridge, Kubernetes, and the browser sandbox.

One agent, wired to your stack

Slackcustomer asks

agent

sandbox

skills: docs-lookup

memory

reply in-thread

Customer threads open sessions; answers are drafted from your docs.

Building blocks

Skills, MCP, artifacts

What an agent assembles: reusable know-how (skills), external tools over MCP, and durable outputs (artifacts) that land in the session log.

Skills

Reusable prompt fragments + files mounted into the sandbox and injected into the system prompt. Write once, attach to any number of agents; versioned and auditable.

MCP servers

Connect remote MCP servers — GitHub, Linear, Firecrawl, anything. Every call is proxied through the control plane, the only layer that holds the upstream credential; the sandbox never sees it.

Artifacts

What agents produce: files in /workspace, session outputs, memory-store notes, generated reports and charts. The Console session Inspector aggregates them on the Artifacts tab from the event log — no extra storage layer. An agent can mark a keep-this deliverable with the opt-in output_file tool (`agent.output_declared`); those are badged ★ Declared output.

Request path

What one request touches

Every message runs the same durable path: the session log records it, the harness drives the model loop, tools run in the sandbox, and the outbound proxy injects vault credentials the sandbox never sees.

Request — what runs here

Your message streams in over SSE. The harness appends it to the session's event log first — written durably before anything else runs — then hands it to the model loop.

Flexibility

Any model, any sandbox

Point models at Anthropic, an OpenAI-compatible gateway, or your own endpoint; run tools on Cloudflare Containers, Kubernetes, OpenShell, a browser WASM VM, your machine via the CLI, a micro-VM vendor, or a Worker isolate. The control plane owns context, state, and memory on a durable spine — so model and sandbox layers swap without rewriting the rest.