All 57 Dependencies

Every package OpenShell depends on, ranked by repo health score.

OpenShell is an open-source security runtime built by NVIDIA specifically for autonomous AI agents. As AI coding agents like Claude Code, Codex, and Copilot gain the ability to run arbitrary shell commands, browse the web, and call external APIs, the question of what they are allowed to do — and what they can exfiltrate — becomes critical. OpenShell answers this by wrapping each agent in a container sandbox with a multi-layer policy engine that enforces network egress rules, filesystem boundaries, and process constraints from application layer down to kernel.

At its core, OpenShell operates through three components: a Gateway that serves as the authenticated control plane managing sandbox lifecycle and policy delivery; Supervisors that run inside each sandbox enforcing policy where process identity, filesystem access, and outbound connections are visible; and a Policy Engine backed by OPA (Open Policy Agent) and an SMT-based formal prover using Z3 that can mathematically verify whether a given policy configuration could allow data exfiltration paths before you ever run an agent.

Policies are declarative YAML files with two classes of controls: static sections (filesystem access paths, process restrictions via Landlock and seccomp) that are locked at sandbox creation, and dynamic sections (network egress rules, inference routing) that can be hot-reloaded on running sandboxes without restart. The privacy-aware inference router strips caller credentials and injects controlled backend credentials when agents call model APIs, ensuring API keys never leak through the agent's network traffic.

The project is currently in alpha, targeting single-developer single-environment setups, with the stated roadmap toward multi-tenant enterprise deployments. Compute backends include Docker, Podman, MicroVM, and Kubernetes, with experimental GPU passthrough support for local inference workloads. OpenShell is built agent-first — the project itself ships with agent skills for gateway troubleshooting, policy generation, and diagnostics.

23 temp-env 0.3 37 hex 0.4 39 json-patch 1.4 outdated 39 rand_core 0.6 outdated 40 serde_yml 0.0.12 outdated 47 oauth2-rs 5 49 ArcSwap 1 50 serde-repr 0.1 52 hmac 0.12 outdated 53 prost-reflect 0.16.5 55 HTTPX >=0.27 56 libloading 0.8 outdated 58 cloudpickle >=3.0 62 jsonwebtoken 9 outdated 62 tar 0.4 64 dialoguer 0.11 outdated 67 ipnet 2 68 base64 0.22 outdated 68 rust-petname 2 outdated 68 prost 0.14 68 prost 0.14 69 serial_test 3 outdated 70 bytes 1 70 http-body 0.1 outdated 71 sha2 0.10 outdated 71 x509-parser 0.16 outdated 72 proc-macro2 1 74 hyper-rustls 0.27 75 tempfile 3 76 hyper-util 0.1 76 serde_json 1 77 async-trait 0.1 77 Chrono 0.4 77 flate2 1 77 quote 1 77 serde 1 78 rust-oci-client 0.16 outdated 78 rcgen 0.13 outdated 82 rand 0.9 outdated 85 notify 8 outdated 85 Regorus 0.9 outdated 85 zstd 0.13 outdated 88 bollard 0.20 outdated 88 tonic 0.14 90 russh 0.57 outdated 92 aws-config 1 92 aws-config 1 92 aws-config 1 92 futures 0.3 92 jsdom ^25.0.1 outdated 92 Mermaid ^11.4.0 92 syn 2 outdated 93 hyper 1 93 Tokio 1.43 94 libc 0.2 outdated 97 gRPC Python (grpcio) >=1.60 98 Protocol Buffers >=4.25

All 57 Dependencies

Join founders buildingwith open source

Search