rivet-dev/agentos

A portable open-source operating system for AI agents.
Near-zero cold starts (~6 ms), up to 32x cheaper than sandboxes.
Built-in ACP agents: Pi, Claude Code, and OpenCode

Documentation | Quickstart

Why agentOS

• Runs inside your process: No VMs to boot, no containers to pull. Agents start in milliseconds with minimal memory overhead.
• Embeds in your backend: Agents call your functions directly via bindings. No network hops, no complex auth between services.
• Granular security: Deny-by-default permissions for filesystem, network, and process access. The same isolation technology trusted by browsers worldwide.
• Deploy anywhere: Just an npm package. Works on your laptop, Rivet Cloud, Railway, Vercel, Kubernetes, or any container platform.
• Open source: Apache 2.0 licensed. Self-host or use Rivet Cloud for managed infrastructure.

agentOS vs Sandbox

agentOS is a lightweight VM that runs inside your process. Sandboxes are full Linux environments. agentOS integrates agents into your backend with bindings and granular permissions. Sandboxes give you a full OS for browsers, native binaries, and dev servers.

You don't have to choose: agentOS works with sandboxes through the sandbox extension, spinning up a full sandbox on demand and mounting the sandbox's file system when the workload needs it.

Quick start

npm install @rivet-dev/agentos-core @agentos-software/common @agentos-software/pi

import { AgentOs } from "@rivet-dev/agentos-core";
import common from "@agentos-software/common";
import pi from "@agentos-software/pi";

const vm = await AgentOs.create({ software: [common, pi] });

// Create a session and send a prompt
const { sessionId } = await vm.createSession("pi", {
  env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! },
});

vm.onSessionEvent(sessionId, (event) => {
  console.log(event);
});

await vm.prompt(sessionId, "Write a hello world script to /home/agentos/hello.js");

// Read the file the agent created
const content = await vm.readFile("/home/agentos/hello.js");
console.log(new TextDecoder().decode(content));

vm.closeSession(sessionId);
await vm.dispose();

agentOS can run Node.js and shell scripts inside the VM:

// Node.js
await vm.writeFile("/hello.mjs", 'import fs from "fs"; fs.writeFileSync("/out.txt", "hi"); console.log(fs.readFileSync("/out.txt", "utf8"));');
await vm.exec("node /hello.mjs");

// Bash
await vm.exec("echo 'hi' > /out.txt && cat /out.txt");

See the Quickstart guide for the full walkthrough.

Benchmarks

All benchmarks compare agentOS against the fastest/cheapest mainstream sandbox providers as of March 2026.

Cold start

_{agentOS: median of 10,000 runs on Intel i7-12700KF. Sandbox: E2B.}

Memory per instance

_{Sandbox baseline: Daytona minimum (1 vCPU + 1 GiB RAM).}

Cost per execution (self-hosted)

_{Sandbox baseline: Daytona at $0.0504/vCPU-h + $0.0162/GiB-h. Self-hosted assumes 70% utilization.}

Features

Agents

• Multi-agent support: Run built-in Pi, Claude Code, and OpenCode agents with a unified API, plus install registry command packages such as Codex as VM software
• Sessions via ACP: Create, manage, and resume agent sessions over the Agent Communication Protocol
• Universal transcript format: One transcript format across all agents for debugging, auditing, and comparison
• Automatic persistence: Every conversation is saved and replayable without extra code

Infrastructure

• Mount external storage as a filesystem: S3-compatible storage, Google Drive, host directories, overlay filesystems, or custom backends
• Bindings: Define JavaScript functions that agents call as CLI commands inside the VM
• Cron, webhooks, and queues: Schedule tasks, receive external events, and serialize work with built-in primitives
• Sandbox extension: Pair with full sandboxes (E2B, Daytona, etc.) for heavy workloads like browsers or native compilation

Orchestration

• Multiplayer: Multiple clients observe and collaborate with the same agent in real time
• Agent-to-agent: Agents delegate work to other agents through host-defined bindings
• Workflows: Chain agent tasks into durable workflows with retries, branching, and resumable execution
• Authentication: Integrate with your existing auth model (API keys, OAuth, JWTs)

Security

• Deny-by-default permissions: Granular control over filesystem, network, process, and environment access
• Programmatic network control: Allow, deny, or proxy any outbound connection
• Resource limits: Set precise CPU and memory limits per agent
• VM isolation: Each agent runs in its own VM with no shared state

Architecture

agentOS is built on an in-process operating system kernel. The kernel manages a virtual filesystem, process table, pipes, PTYs, and a virtual network stack. Everything runs inside the kernel -- nothing executes on the host.

See the Architecture docs for details.

Registry

Browse pre-built agents, tools, filesystems, and software packages at the agentOS Registry.

WASM Command Packages

Meta-Packages

License

Apache-2.0