Interactive Click any component for details. Collapse columns with the chevrons on small screens.

agent=model + skills + mcp

session=agent + env + vaults

1 · Configure

2 · Compose

3 · Run

4 · Reachoptional

The self-hosted agent platform for any LLM provider and any sandbox

Run agent fleets you control — durable sessions, sandboxed tools, and vault-backed credentials. Deploy on Cloudflare Workers, or self-host with Docker. Bring your own models and sandboxes.

Read the docs Try hosted GitHub

Works with Cloudflare · Kubernetes · Anthropic · OpenAI-compatible · E2B & Daytona (self-host)

Apache 2.0 · no vendor lock-in · same codebase cloud or self-host

Primitives

What Open Managed Agents is

A platform for running agent fleets, not a chat UI. Four objects carry the whole model.

Agent

A versioned config: model, prompt, tools, skills, MCP, harness. Sessions pin a version at creation; updates never rewrite live runs.

Session

A conversation with a durable event log. Streaming, crash recovery, and lifecycle all hang off this state — not an ephemeral chat window.

Environment

The execution sandbox: packages, network policy, container image. Reusable across agents, so a fleet shares one runtime shape.

Vault

A credential store that never enters the sandbox. An outbound proxy injects tokens at the network layer, matched by URL.

Demo

See it run

Pick a use case and follow trigger → agent → result — including the local bridge, Kubernetes, and the browser sandbox.

One agent, wired to your stack

Slackcustomer asks

agent

sandbox

skills: docs-lookup

memory

reply in-thread

Customer threads open sessions; answers are drafted from your docs.

Building blocks

Skills, MCP, artifacts

What an agent assembles: reusable know-how (skills), external tools over MCP, and durable outputs (artifacts) that land in the session log.

Skills

Reusable prompt fragments + files mounted into the sandbox and injected into the system prompt. Write once, attach to any number of agents; versioned and auditable.

MCP servers

Connect remote MCP servers — GitHub, Linear, Firecrawl, anything. Every call is proxied through the control plane, the only layer that holds the upstream credential; the sandbox never sees it.

Artifacts

What agents produce: files in /workspace, memory-store notes, generated reports/charts, opened PRs. All land in the session's event log and surface as replayable outputs.

Request path

What one request touches

Every message runs the same durable path: the session log records it, the harness drives the model loop, tools run in the sandbox, and the outbound proxy injects vault credentials the sandbox never sees.

Request — what runs here

Your message streams in over SSE. The harness appends it to the session's event log first — written durably before anything else runs — then hands it to the model loop.

Flexibility

Any model, any sandbox

Point models at Anthropic, an OpenAI-compatible gateway, or your own endpoint; run tools on Cloudflare Containers, Kubernetes, OpenShell, a browser WASM VM, your machine via the CLI, a micro-VM vendor, or a Worker isolate. The control plane owns context, state, and memory on a durable spine — so model and sandbox layers swap without rewriting the rest.