Secure operating system without a sandbox.

A lightweight library for giving your agents an OS.No containers, no VMs — just file system, networking, bash, Python, and Node.

Read the Docs
runs
PiPi
Claude CodeClaude Code
CodexCodex
OpenCodeOpenCode

A lightweight computer as a library.

  • agentOS boots a small virtual OS per agent: kernel, file system, processes, sockets, deny-by-default permissions.
  • It runs on V8 isolates, the same primitive behind Cloudflare Workers and every browser tab.
  • No hypervisor, no containers, no network gap.
npm install @rivet-dev/agentos @agentos-software/pi

Before: a sandbox service

Your backend
network
Sandbox1 GiB
Sandbox1 GiB
Sandbox1 GiB

After: agentOS

Your backend
OSOSOSOSOSOSOSOS
22–131 MB per agent

Sandbox services are infrastructure. agentOS is a library.

Sandbox services run VM fleets across a network gap, behind vendor accounts and API keys. agentOS runs in your process, in your VPC or on-prem.

agentOSSandbox service
Where agents runInside your backend processOn external infrastructure, across an untrusted network boundary
IsolationWebAssemblyMicroVM
Setupnpm installVendor account and API keys
Cold startUp to 516× fasterHundreds of ms
PriceUp to 1738× cheaper~$1.60/day per agent
MemoryUp to 47× lessMinimum 1 GiB per agent
Custom integrationsDirect JS function callsCustom API + authentication
CredentialsNever leave the hostInjected into the sandbox
GPUs and native binariesMount Docker, E2B, or DaytonaNative

What staying in-process saves.

Benchmark document
Cold Start
0xfaster
agentOSWhat's measured: Time from requesting an execution to first code running.

Why the gap: agentOS runs agents in-process — V8 isolates and Wasm inside your host. No VM to boot, no network hop, no disk image. Sandboxes must boot an entire environment, allocate memory, and establish a network connection before code can run.

Sandbox baseline: E2B, the fastest mainstream sandbox provider as of March 30, 2026.

agentOS: Median of 10,000 runs (100 iterations x 100 samples) on Intel i7-12700KF.
4.8 ms
Fastest sandbox440 ms
Memory Per Instance?Sandboxes reserve idle RAM per agent.
0xsmaller
agentOSWhat's measured: Memory footprint added per concurrent execution.

Why the gap: In-process isolates share the host's memory. Each additional execution only adds its own heap and stack. Sandboxes allocate a dedicated environment with a minimum memory reservation, even if the code inside uses far less.

Sandbox baseline: Daytona, the cheapest mainstream sandbox provider as of March 30, 2026. Default sandbox: 1 vCPU + 1 GiB RAM.

agentOS: ~22 MB for the minimal shell workload under sustained load.
~22 MB
Cheapest sandbox~1024 MB
Cost Per Execution-Second?Assumes one agent per sandbox, needed for isolation.
0xcheaper
agentOSWhat's measured: server price per second / concurrent executions per server

Why it's cheaper: Each execution uses ~22 MB instead of a ~1024 MB sandbox minimum. And you run on your own hardware, which is significantly cheaper than per-second sandbox billing.

Sandbox baseline: Daytona, the cheapest mainstream sandbox provider as of March 30, 2026. Default sandbox: 1 vCPU + 1 GiB RAM at $0.0504/vCPU-h + $0.0162/GiB-h.

agentOS: ~22 MB baseline per execution, assuming 70% utilization (industry-standard HPA scaling threshold). Select a hardware tier above to compare.
$0.000000073/s
Cheapest sandbox$0.000018/s

Everything the agent needs is already there.

File system, execution, tools, approvals, and memory live in the same process as your code.

Node.js runtime docs

agentos vm · /home/agentos
The agent writes one program instead of a chain of tool calls.

Any harness and framework

Pi, Claude Code, Codex, OpenCode, Eve, and Flue behind one API.

File system

Mount a host directory, S3, or Google Drive. State survives sleep.

Execution

Node, Python, and shell behind one exec API. Real host capabilities, not stubs.

Bindings

Agents call your JavaScript functions host-side. Credentials never enter the VM.

Human in the loop

Deny by default. Your app approves every tool call, in your UI.

Memory

Sessions persist with replayable transcripts. sqlite3 runs inside the VM.

Built for every kind of agent.

Orchestration is just code.

Sessions, workflows, multiplayer, and approvals are objects in your code, not services you deploy.

agents.ts
import { createClient } from "@rivet-dev/agentos/client";
import type { registry } from "./server";
 
const client = createClient<typeof registry>("http://localhost:6420");
const agent = client.vm.getOrCreate("my-agent").connect();
 
// Stream events (tool calls, text output, etc.)
agent.on("sessionEvent", (data) => console.log(data.event));
 
// Create a session and send a prompt
const session = await agent.createSession("pi", { env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! } });
await agent.sendPrompt(session.sessionId, "Write a Python script that calculates pi");

Multiplayer

Humans and agents share one live session.

Durable sessions

Pause, resume, and replay every run with durable state.

Workflows

Multi-step workflows survive restarts and resume where they stopped.

Observability

Every event and tool call streams back to your code.

Ships wherever your backend ships.

Each VM is a Rivet Actor with durable state. Your existing deployment works.

Library

npm install and run in your process. No servers.

Get Started
Rivet

Rivet Cloud

Managed agentOS on Rivet's edge network. Scales to millions of agents.

Sign Up

Self-Host

Run the open-source platform on Kubernetes, VMs, or bare metal.

Self-Hosting Docs

Turn your backend into the agent platform.

Open source under Apache 2.0. One npm install away.

Read the DocsView on GitHub